Add Support for ServiceAccounts for MinIO Pods

docs/operator-fields.md

@@ -43,6 +43,7 @@ If the MirrorInstance is named as `mirrorinstance`, resources and their names as
 | spec.nodeSelector | Add a selector which must be true for the MinIOInstance pod to fit on a node. Refer [this document](https://kubernetes.io/docs/concepts/configuration/assign-pod-node/) for details.|
 | spec.tolerations | Define a toleration for the MinIOInstance pod to match on a taint. Refer [this document](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/) for details. |
 | spec.securityContext | Define a security context for the MinIOInstance pod. Refer [this document](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/) for details. |
+| spec.serviceAccountName | Define a ServiceAccountName for the ServiceAccount to use to run MinIO pods created for this MinIOInstance. Refer [this document](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/) for details. |
 | spec.mcs | Defines the mcs configuration. mcs is a graphical user interface for MinIO. Refer [this](https://github.com/minio/mcs) |
 | spec.mcs.image | Defines the mcs image. |
 | spec.mcs.replicas | Number of MCS pods to be created. |

pkg/apis/operator.min.io/v1/types.go

@@ -114,7 +114,7 @@ type MinIOInstanceSpec struct {
 	// Tolerations allows users to set entries like effect, key, operator, value.
 	// +optional
 	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
-	// Security Context allows user to set entries like runAsUser, privlege escalation etc.
+	// Security Context allows user to set entries like runAsUser, privilege escalation etc.
 	// +optional
 	SecurityContext *corev1.PodSecurityContext `json:"securityContext,omitempty"`
 	// Definition for Cluster in given MinIO cluster
@@ -126,6 +126,10 @@ type MinIOInstanceSpec struct {
 	// KES is for setting up minio/kes as MinIO KMS
 	//+optional
 	KES *KESConfig `json:"kes,omitempty"`
+	// ServiceAccountName is the name of the ServiceAccount to use to run pods of all MinIO
+	// Pods created as a part of this MinIOInstance.
+	// +optional
+	ServiceAccountName string `json:"serviceAccountName,omitempty"`
 }
 
 // MinIOInstanceStatus is the status for a MinIOInstance resource

pkg/resources/statefulsets/minio-statefulset.go

@@ -202,7 +202,7 @@ func minioTolerations(mi *miniov1.MinIOInstance) []corev1.Toleration {
 	return tolerations
 }
 
-// Builds the security contexts for a MinIOInstance
+// Builds the security context for a MinIOInstance
 func minioSecurityContext(mi *miniov1.MinIOInstance) *corev1.PodSecurityContext {
 	var securityContext = corev1.PodSecurityContext{}
 	if mi.Spec.SecurityContext != nil {
@@ -337,14 +337,15 @@ func NewForMinIO(mi *miniov1.MinIOInstance, serviceName string) *appsv1.Stateful
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: minioMetadata(mi),
 				Spec: corev1.PodSpec{
-					Containers:       containers,
-					Volumes:          podVolumes,
-					ImagePullSecrets: []corev1.LocalObjectReference{mi.Spec.ImagePullSecret},
-					RestartPolicy:    corev1.RestartPolicyAlways,
-					Affinity:         mi.Spec.Affinity,
-					SchedulerName:    mi.Scheduler.Name,
-					Tolerations:      minioTolerations(mi),
-					SecurityContext:  minioSecurityContext(mi),
+					Containers:         containers,
+					Volumes:            podVolumes,
+					ImagePullSecrets:   []corev1.LocalObjectReference{mi.Spec.ImagePullSecret},
+					RestartPolicy:      corev1.RestartPolicyAlways,
+					Affinity:           mi.Spec.Affinity,
+					SchedulerName:      mi.Scheduler.Name,
+					Tolerations:        minioTolerations(mi),
+					SecurityContext:    minioSecurityContext(mi),
+					ServiceAccountName: mi.Spec.ServiceAccountName,
 				},
 			},
 		},