Add ...serviceAccount.annotations config for our k8s ServiceAccounts

[AndreaGiardini]

I am using this helm chart on GKE. The preferred method to authorize GKE workloads is using Google workload identity ( https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity )

In order to use workload identity it's necessary to add a specific annotation( iam.gke.io/gcp-service-account ) to the k8s serviceaccount. In this way we can link the k8s serviceaccount with google's service account.

Adding annotations to the hub's serviceAccount was not possible with the current helm chart so I implemented it in this PR.

Let me know if you have any question

[welcome]

Thanks for submitting your first pull request! You are awesome! 🤗

If you haven't done so already, check out Jupyter's Code of Conduct. Also, please make sure you followed the pull request template, as this will help us review your contribution more quickly.

You can meet the other Jovyans by joining our Discourse forum. There is also a intro thread there where you can stop by and say Hi! 👋

Welcome to the Jupyter community! 🎉

[consideRatio]

Feel free to come with suggestions, but I need more time to think myself still

[consideRatio]

This would render to...

annotations:
labels:
  # ...

If rbac.serviceAccount.annotations is falsy, and that would be invalid k8s YAML specification. This on the other hand would be okay.

Suggested change

	annotations:
	{{- with .Values.rbac.serviceAccount.annotations }}
	{{- . | toYaml | nindent 4 }}
	{{- end }}
	{{- with .Values.rbac.serviceAccount.annotations }}
	annotations:
	{{- . | toYaml | nindent 4 }}
	{{- end }}

[consideRatio]

There are more service accounts because we have more pods that all need som permissions against the k8s-apiserver, and I think we would need annotations specific to the service accounts.

So, something related to hub must be part of the config of this annotation, so its not applied to all serviceaccounts

[AndreaGiardini]

I will follow your suggestion. I added it to the rbac section because it was it changes files in the rbac yml file but I have nothing against moving it to the hub section

[consideRatio]

I think I'd like our configuration to follow the configuration locations suggested here: https://helm.sh/docs/chart_best_practices/rbac/

So, hub.serviceAccount.annotations would be the configuration location of relevance then I figure.

[AndreaGiardini]

@consideRatio Thank you for the feedback. I implemented the changes you requested. Can you have a second look please?

[AndreaGiardini]

@consideRatio sorry for pinging again, I would love to see this in v1.0.0 :) let me know if there is something else missing

[consideRatio]

@AndreaGiardini thanks for your work, I'll help get it merged!

This is what remain in my mind and I figure I'll push a commit for this later today if you haven't already:

• schema.yaml entry about this configuration
• lint-and-validate-values.yaml entry for this configuration

[welcome]

Congrats on your first merged pull request in this project! 🎉

Thank you for contributing, we are very proud of you! ❤️

[AndreaGiardini]

Many thanks @consideRatio !

[consideRatio]

Thank you @AndreaGiardini!