Add serviceAccount option to agent config

changelog.d/2876.added.md

@@ -0,0 +1 @@
+Added serviceAccount option to agent config

mirrord-schema.json

@@ -433,6 +433,14 @@
             }
           ]
         },
+        "service_account": {
+          "title": "agent.service_account {#agent-service_account}",
+          "description": "Allows setting up custom Service Account for the agent Job and Pod.\\\n\n```json { \"service_account\": \"my-service-account\" } ```",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
         "startup_timeout": {
           "title": "agent.startup_timeout {#agent-startup_timeout}",
           "description": "Controls how long to wait for the agent to finish initialization.\n\nIf initialization takes longer than this value, mirrord exits.\n\nDefaults to `60`.",

mirrord/config/configuration.md

@@ -327,6 +327,10 @@ as targeted agent always runs on the same node as its target container.
 }
 ```
 
+### agent.service_account {#agent-service_account}
+
+Allows setting up custom Service Account for the agent Job and Pod.
+
 ### agent.privileged {#agent-privileged}
 
 Run the mirror agent as privileged container.

mirrord/config/src/agent.rs

@@ -339,6 +339,17 @@ pub struct AgentConfig {
     /// ```
     pub node_selector: Option<HashMap<String, String>>,
 
+    /// ### agent.service_account {#agent-service_account}
+    ///
+    /// Allows setting up custom Service Account for the agent Job and Pod.\
+    ///
+    /// ```json
+    /// {
+    ///   "service_account": "my-service-account"
+    /// }
+    /// ```
+    pub service_account: Option<String>,
+
     /// <!--${internal}-->
     /// Create an agent that returns an error after accepting the first client. For testing
     /// purposes. Only supported with job agents (not with ephemeral agents).

mirrord/kube/src/api/container/job.rs

@@ -284,6 +284,7 @@ mod test {
                         "imagePullSecrets": agent.image_pull_secrets,
                         "nodeSelector": {},
                         "tolerations": *DEFAULT_TOLERATIONS,
+                        "serviceAccountName": agent.service_account,
                         "containers": [
                             {
                                 "name": "mirrord-agent",
@@ -403,6 +404,7 @@ mod test {
                         "imagePullSecrets": agent.image_pull_secrets,
                         "nodeSelector": {},
                         "tolerations": *DEFAULT_TOLERATIONS,
+                        "serviceAccountName": agent.service_account,
                         "containers": [
                             {
                                 "name": "mirrord-agent",

mirrord/kube/src/api/container/pod.rs

@@ -126,6 +126,7 @@ impl ContainerVariant for PodVariant<'_> {
                 image_pull_secrets,
                 tolerations: Some(tolerations.clone()),
                 node_selector: Some(node_selector),
+                service_account_name: agent.service_account.clone(),
                 containers: vec![Container {
                     name: "mirrord-agent".to_string(),
                     image: Some(agent.image().to_string()),