[Feature] [ML] SA Management

chart/kube-arangodb/templates/ml/role.yaml → chart/kube-arangodb/templates/ml-operator/role.yaml

@@ -34,10 +34,17 @@ rules:
         - "get"
         - "list"
         - "watch"
+    - apiGroups:
+        - "rbac.authorization.k8s.io/v1"
+      resources:
+        - "roles"
+        - "rolebindings"
+      verbs: ["*"]
     - apiGroups: [""]
       resources:
-        - "secrets"
         - "pods"
+        - "secrets"
+        - "serviceaccounts"
       verbs: ["*"]
 {{- end }}
 {{- end }}

docs/api/ArangoMLExtension.V1Alpha1.md

@@ -76,31 +76,31 @@ PullSecrets define Secrets used to pull Image from registry
 
 ### .spec.storage.name
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L32)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
 
 Name of the object
 
 ***
 
 ### .spec.storage.namespace
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L35)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
 
 Namespace of the object. Should default to the namespace of the parent object
 
 ***
 
 ### .spec.storage.uid
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L38)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
 
 UID keeps the information about object UID
 
 ## Status
 
 ### .status.conditions
 
-Type: `api.Conditions` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/ml/v1alpha1/extension_status.go#L28)</sup>
+Type: `api.Conditions` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/ml/v1alpha1/extension_status.go#L31)</sup>
 
 Conditions specific to the entire extension
 
@@ -124,23 +124,143 @@ ArangoPipeDatabase define Database name to be used as MetadataService Backend
 
 ### .status.metadataService.secret.name
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L32)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
 
 Name of the object
 
 ***
 
 ### .status.metadataService.secret.namespace
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L35)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
 
 Namespace of the object. Should default to the namespace of the parent object
 
 ***
 
 ### .status.metadataService.secret.uid
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L38)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
+
+UID keeps the information about object UID
+
+***
+
+### .status.serviceAccount.cluster.binding.name
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
+
+Name of the object
+
+***
+
+### .status.serviceAccount.cluster.binding.namespace
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
+
+Namespace of the object. Should default to the namespace of the parent object
+
+***
+
+### .status.serviceAccount.cluster.binding.uid
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
+
+UID keeps the information about object UID
+
+***
+
+### .status.serviceAccount.cluster.role.name
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
+
+Name of the object
+
+***
+
+### .status.serviceAccount.cluster.role.namespace
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
+
+Namespace of the object. Should default to the namespace of the parent object
+
+***
+
+### .status.serviceAccount.cluster.role.uid
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
+
+UID keeps the information about object UID
+
+***
+
+### .status.serviceAccount.name
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
+
+Name of the object
+
+***
+
+### .status.serviceAccount.namespace
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
+
+Namespace of the object. Should default to the namespace of the parent object
+
+***
+
+### .status.serviceAccount.namespaced.binding.name
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
+
+Name of the object
+
+***
+
+### .status.serviceAccount.namespaced.binding.namespace
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
+
+Namespace of the object. Should default to the namespace of the parent object
+
+***
+
+### .status.serviceAccount.namespaced.binding.uid
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
+
+UID keeps the information about object UID
+
+***
+
+### .status.serviceAccount.namespaced.role.name
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
+
+Name of the object
+
+***
+
+### .status.serviceAccount.namespaced.role.namespace
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
+
+Namespace of the object. Should default to the namespace of the parent object
+
+***
+
+### .status.serviceAccount.namespaced.role.uid
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
+
+UID keeps the information about object UID
+
+***
+
+### .status.serviceAccount.uid
+
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
 
 UID keeps the information about object UID
 

docs/api/ArangoMLStorage.V1Alpha1.md

@@ -14,47 +14,47 @@ Default Value: `false`
 
 ### .spec.backend.s3.caSecret.name
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L32)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
 
 Name of the object
 
 ***
 
 ### .spec.backend.s3.caSecret.namespace
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L35)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
 
 Namespace of the object. Should default to the namespace of the parent object
 
 ***
 
 ### .spec.backend.s3.caSecret.uid
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L38)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
 
 UID keeps the information about object UID
 
 ***
 
 ### .spec.backend.s3.credentialsSecret.name
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L32)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L46)</sup>
 
 Name of the object
 
 ***
 
 ### .spec.backend.s3.credentialsSecret.namespace
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L35)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L49)</sup>
 
 Namespace of the object. Should default to the namespace of the parent object
 
 ***
 
 ### .spec.backend.s3.credentialsSecret.uid
 
-Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L38)</sup>
+Type: `string` <sup>[\[ref\]](https://github.com/arangodb/kube-arangodb/blob/1.2.35/pkg/apis/shared/v1/object.go#L52)</sup>
 
 UID keeps the information about object UID
 

pkg/apis/ml/v1alpha1/extension_conditions.go

@@ -27,5 +27,6 @@ const (
 	ExtensionDeploymentFoundCondition      api.ConditionType = "DeploymentFound"
 	ExtensionBootstrapCompletedCondition   api.ConditionType = "BootstrapCompleted"
 	ExtensionMetadataServiceValidCondition api.ConditionType = "MetadataServiceValid"
+	ExtensionServiceAccountReadyCondition  api.ConditionType = "ServiceAccountReady"
 	LicenseValidCondition                  api.ConditionType = "LicenseValid"
 )

pkg/apis/ml/v1alpha1/extension_status.go

@@ -20,7 +20,10 @@
 
 package v1alpha1
 
-import api "github.com/arangodb/kube-arangodb/pkg/apis/deployment/v1"
+import (
+	api "github.com/arangodb/kube-arangodb/pkg/apis/deployment/v1"
+	shared "github.com/arangodb/kube-arangodb/pkg/apis/shared/v1"
+)
 
 type ArangoMLExtensionStatus struct {
 	// Conditions specific to the entire extension
@@ -29,4 +32,7 @@ type ArangoMLExtensionStatus struct {
 
 	// MetadataService keeps the MetadataService configuration
 	MetadataService *ArangoMLExtensionStatusMetadataService `json:"metadataService,omitempty"`
+
+	// ServiceAccount keeps the information about ServiceAccount
+	ServiceAccount *shared.ServiceAccount `json:"serviceAccount,omitempty"`
 }

pkg/apis/shared/v1/object.go

@@ -25,8 +25,22 @@ import (
 	"k8s.io/apimachinery/pkg/types"
 
 	"github.com/arangodb/kube-arangodb/pkg/apis/shared"
+	"github.com/arangodb/kube-arangodb/pkg/util"
 )
 
+func NewObject(object meta.Object) Object {
+	var n Object
+
+	n.Name = object.GetName()
+	n.UID = util.NewType(object.GetUID())
+
+	if ns := object.GetNamespace(); ns != "" {
+		n.Namespace = util.NewType(ns)
+	}
+
+	return n
+}
+
 type Object struct {
 	// Name of the object
 	Name string `json:"name"`
@@ -71,6 +85,30 @@ func (o *Object) GetUID() types.UID {
 	return ""
 }
 
+func (o *Object) Equals(obj meta.Object) bool {
+	if o == nil {
+		return false
+	}
+
+	if o.Name != obj.GetName() {
+		return false
+	}
+
+	if n := o.Namespace; n != nil {
+		if *n != obj.GetNamespace() {
+			return false
+		}
+	}
+
+	if n := o.UID; n != nil {
+		if *n != obj.GetUID() {
+			return false
+		}
+	}
+
+	return true
+}
+
 func (o *Object) Validate() error {
 	if o == nil {
 		o = &Object{}

pkg/apis/shared/v1/service_account.go

@@ -0,0 +1,40 @@
+//
+// DISCLAIMER
+//
+// Copyright 2023 ArangoDB GmbH, Cologne, Germany
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+// Copyright holder is ArangoDB GmbH, Cologne, Germany
+//
+
+package v1
+
+type ServiceAccount struct {
+	// Object keeps the reference to the ServiceAccount
+	*Object `json:",inline"`
+
+	// Namespaced keeps the reference to core.Role objects
+	Namespaced *ServiceAccountRole `json:"namespaced,omitempty"`
+
+	// Cluster keeps the reference to core.ClusterRole objects
+	Cluster *ServiceAccountRole `json:"cluster,omitempty"`
+}
+
+type ServiceAccountRole struct {
+	// Role keeps the reference to the Kubernetes Role
+	Role *Object `json:"role,omitempty"`
+
+	// Binding keeps the reference to the Kubernetes Binding
+	Binding *Object `json:"binding,omitempty"`
+}