The pods started by mysql operator use default service account

[surajssd]

The pods started by the mysql-operator as a part of mysql cluster have service account default. Rather they should have their own dedicated service account created and assigned.

[AMecea]

This is a nice observation. I've already opened a PR that allows specifying on the cluster the service account name, #286.

What do you think?

[surajssd]

The code wise extension looks good to me, what I also trying to solve with this is making mysql operator related all pods run within an environment that has PSP enabled.

And hence #258 #291 and this issue #274 are baby steps towards it. So having a broader picture of how we can automatically install PSP if needed when doing this could be of help. Not sure if the PSP needed for the mysql cluster pods should be installed by the operator or by the chart itself.

[calind]

Continuing here from the discussions on #286. The current proposed solution is:

1. Add --default-cluster-service-account cli option, which defaults to mysql-cluster
2. If user doesn't specify any serviceAccountName use the one from options

[marratj]

Hi, as we are currently testing out the MySQL operator in our environment and also want to take advantage of specifying the Service Account of the Cluster Pods:

Does this also affect the sidecar Pods (e.g. for taking backups)?

We'd like to use the new "Workload Identity" Feature of GKE, which maps Kubernetes SAs directly to GCP IAM SAs.

For this we ideally need two things:

• Have a different service account than default also for the sidecar (as we don't want to map the GCP SA with write access to our GCS bucket to the default SA in the namespace)
• Make rclone in the sidecar image use gcloud application default credentials (we have rebuilt the sidecar image for this, which just omits the service account file option so that rclone uses default credentials with which the Pod is running)

EDIT: actually I mean the Pods that are generated by the MysqlBackup jobs need to be able to have a different serviceAccountName for this.