Add support for securityContext and serviceAccount

pkg/account/main.go

@@ -7,6 +7,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/jaegertracing/jaeger-operator/pkg/apis/jaegertracing/v1"
+	"github.com/jaegertracing/jaeger-operator/pkg/util"
 )
 
 // Get returns all the service accounts to be created for this Jaeger instance
@@ -22,11 +23,11 @@ func getMain(jaeger *v1.Jaeger) *corev1.ServiceAccount {
 	trueVar := true
 	return &corev1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      JaegerServiceAccountFor(jaeger),
+			Name:      JaegerServiceAccountFor(jaeger, ""),
 			Namespace: jaeger.Namespace,
 			Labels: map[string]string{
 				"app":                          "jaeger",
-				"app.kubernetes.io/name":       JaegerServiceAccountFor(jaeger),
+				"app.kubernetes.io/name":       JaegerServiceAccountFor(jaeger, ""),
 				"app.kubernetes.io/instance":   jaeger.Name,
 				"app.kubernetes.io/component":  "service-account",
 				"app.kubernetes.io/part-of":    "jaeger",
@@ -46,6 +47,21 @@ func getMain(jaeger *v1.Jaeger) *corev1.ServiceAccount {
 }
 
 // JaegerServiceAccountFor prints service name for Jaeger instance
-func JaegerServiceAccountFor(jaeger *v1.Jaeger) string {
-	return fmt.Sprintf("%s", jaeger.Name)
+func JaegerServiceAccountFor(jaeger *v1.Jaeger, component string) string {
+	sa := ""
+	switch component {
+	case "collector":
+		sa = util.Merge([]v1.JaegerCommonSpec{jaeger.Spec.Collector.JaegerCommonSpec, jaeger.Spec.JaegerCommonSpec}).ServiceAccount
+	case "query":
+		sa = util.Merge([]v1.JaegerCommonSpec{jaeger.Spec.Query.JaegerCommonSpec, jaeger.Spec.JaegerCommonSpec}).ServiceAccount
+	case "ingester":
+		sa = util.Merge([]v1.JaegerCommonSpec{jaeger.Spec.Ingester.JaegerCommonSpec, jaeger.Spec.JaegerCommonSpec}).ServiceAccount
+	case "all-in-one":
+		sa = util.Merge([]v1.JaegerCommonSpec{jaeger.Spec.AllInOne.JaegerCommonSpec, jaeger.Spec.JaegerCommonSpec}).ServiceAccount
+	}
+
+	if sa == "" {
+		return fmt.Sprintf("%s", jaeger.Name)
+	}
+	return sa
 }

pkg/account/main_test.go

@@ -33,5 +33,14 @@ func TestWithSecurityOAuthProxy(t *testing.T) {
 
 func TestJaegerName(t *testing.T) {
 	jaeger := v1.NewJaeger("foo")
-	assert.Equal(t, "foo", JaegerServiceAccountFor(jaeger))
+	jaeger.Spec.ServiceAccount = "bar"
+	jaeger.Spec.Collector.ServiceAccount = "col-sa"
+	jaeger.Spec.Query.ServiceAccount = "query-sa"
+	jaeger.Spec.AllInOne.ServiceAccount = "aio-sa"
+
+	assert.Equal(t, "foo", JaegerServiceAccountFor(jaeger, ""))
+	assert.Equal(t, "col-sa", JaegerServiceAccountFor(jaeger, "collector"))
+	assert.Equal(t, "query-sa", JaegerServiceAccountFor(jaeger, "query"))
+	assert.Equal(t, "aio-sa", JaegerServiceAccountFor(jaeger, "all-in-one"))
+	assert.Equal(t, "bar", JaegerServiceAccountFor(jaeger, "ingester"))
 }

pkg/apis/jaegertracing/v1/jaeger_types.go

@@ -86,13 +86,15 @@ type Jaeger struct {
 // JaegerCommonSpec defines the common elements used in multiple other spec structs
 // +k8s:openapi-gen=true
 type JaegerCommonSpec struct {
-	Volumes      []v1.Volume             `json:"volumes"`
-	VolumeMounts []v1.VolumeMount        `json:"volumeMounts"`
-	Annotations  map[string]string       `json:"annotations,omitempty"`
-	Labels       map[string]string       `json:"labels,omitempty"`
-	Resources    v1.ResourceRequirements `json:"resources,omitempty"`
-	Affinity     *v1.Affinity            `json:"affinity,omitempty"`
-	Tolerations  []v1.Toleration         `json:"tolerations,omitempty"`
+	Volumes         []v1.Volume             `json:"volumes"`
+	VolumeMounts    []v1.VolumeMount        `json:"volumeMounts"`
+	Annotations     map[string]string       `json:"annotations,omitempty"`
+	Labels          map[string]string       `json:"labels,omitempty"`
+	Resources       v1.ResourceRequirements `json:"resources,omitempty"`
+	Affinity        *v1.Affinity            `json:"affinity,omitempty"`
+	Tolerations     []v1.Toleration         `json:"tolerations,omitempty"`
+	SecurityContext *v1.PodSecurityContext  `json:"securityContext,omitempty"`
+	ServiceAccount  string                  `json:"serviceAccount,omitempty"`
 }
 
 // JaegerQuerySpec defines the options to be used when deploying the query

pkg/deployment/agent.go

@@ -147,8 +147,9 @@ func (a *Agent) Get() *appsv1.DaemonSet {
 						},
 						Resources: commonSpec.Resources,
 					}},
-					Affinity:    commonSpec.Affinity,
-					Tolerations: commonSpec.Tolerations,
+					Affinity:        commonSpec.Affinity,
+					Tolerations:     commonSpec.Tolerations,
+					SecurityContext: commonSpec.SecurityContext,
 				},
 			},
 		},

pkg/deployment/all-in-one.go

@@ -175,9 +175,10 @@ func (a *AllInOne) Get() *appsv1.Deployment {
 						Resources: commonSpec.Resources,
 					}},
 					Volumes:            commonSpec.Volumes,
-					ServiceAccountName: account.JaegerServiceAccountFor(a.jaeger),
+					ServiceAccountName: account.JaegerServiceAccountFor(a.jaeger, "all-in-one"),
 					Affinity:           commonSpec.Affinity,
 					Tolerations:        commonSpec.Tolerations,
+					SecurityContext:    commonSpec.SecurityContext,
 				},
 			},
 		},

pkg/deployment/collector.go

@@ -169,9 +169,10 @@ func (c *Collector) Get() *appsv1.Deployment {
 						Resources: commonSpec.Resources,
 					}},
 					Volumes:            commonSpec.Volumes,
-					ServiceAccountName: account.JaegerServiceAccountFor(c.jaeger),
+					ServiceAccountName: account.JaegerServiceAccountFor(c.jaeger, "collector"),
 					Affinity:           commonSpec.Affinity,
 					Tolerations:        commonSpec.Tolerations,
+					SecurityContext:    commonSpec.SecurityContext,
 				},
 			},
 		},

pkg/deployment/ingester.go

@@ -146,9 +146,10 @@ func (i *Ingester) Get() *appsv1.Deployment {
 						Resources: commonSpec.Resources,
 					}},
 					Volumes:            commonSpec.Volumes,
-					ServiceAccountName: account.JaegerServiceAccountFor(i.jaeger),
+					ServiceAccountName: account.JaegerServiceAccountFor(i.jaeger, "ingester"),
 					Affinity:           commonSpec.Affinity,
 					Tolerations:        commonSpec.Tolerations,
+					SecurityContext:    commonSpec.SecurityContext,
 				},
 			},
 		},

pkg/deployment/query.go

@@ -155,9 +155,10 @@ func (q *Query) Get() *appsv1.Deployment {
 						Resources: commonSpec.Resources,
 					}},
 					Volumes:            commonSpec.Volumes,
-					ServiceAccountName: account.JaegerServiceAccountFor(q.jaeger),
+					ServiceAccountName: account.JaegerServiceAccountFor(q.jaeger, "query"),
 					Affinity:           commonSpec.Affinity,
 					Tolerations:        commonSpec.Tolerations,
+					SecurityContext:    commonSpec.SecurityContext,
 				},
 			},
 		},

pkg/util/util.go

@@ -51,6 +51,8 @@ func Merge(commonSpecs []v1.JaegerCommonSpec) *v1.JaegerCommonSpec {
 	resources := &corev1.ResourceRequirements{}
 	var affinity *corev1.Affinity
 	var tolerations []corev1.Toleration
+	var securityContext *corev1.PodSecurityContext
+	var serviceAccount string
 
 	for _, commonSpec := range commonSpecs {
 		// Merge annotations
@@ -79,16 +81,26 @@ func Merge(commonSpecs []v1.JaegerCommonSpec) *v1.JaegerCommonSpec {
 		}
 
 		tolerations = append(tolerations, commonSpec.Tolerations...)
+
+		if securityContext == nil {
+			securityContext = commonSpec.SecurityContext
+		}
+
+		if serviceAccount == "" {
+			serviceAccount = commonSpec.ServiceAccount
+		}
 	}
 
 	return &v1.JaegerCommonSpec{
-		Annotations:  annotations,
-		Labels:       labels,
-		VolumeMounts: removeDuplicatedVolumeMounts(volumeMounts),
-		Volumes:      removeDuplicatedVolumes(volumes),
-		Resources:    *resources,
-		Affinity:     affinity,
-		Tolerations:  tolerations,
+		Annotations:     annotations,
+		Labels:          labels,
+		VolumeMounts:    removeDuplicatedVolumeMounts(volumeMounts),
+		Volumes:         removeDuplicatedVolumes(volumes),
+		Resources:       *resources,
+		Affinity:        affinity,
+		Tolerations:     tolerations,
+		SecurityContext: securityContext,
+		ServiceAccount:  serviceAccount,
 	}
 }
 

pkg/util/util_test.go

@@ -215,6 +215,35 @@ func TestAffinityOverride(t *testing.T) {
 	assert.Nil(t, merged.Affinity.NodeAffinity)
 }
 
+func TestSecurityContextDefault(t *testing.T) {
+	generalSpec := v1.JaegerCommonSpec{}
+	specificSpec := v1.JaegerCommonSpec{}
+
+	merged := Merge([]v1.JaegerCommonSpec{specificSpec, generalSpec})
+
+	assert.Nil(t, merged.SecurityContext)
+}
+
+func TestSecurityContextOverride(t *testing.T) {
+	intVal := int64(1000)
+	generalSpec := v1.JaegerCommonSpec{
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsUser: &intVal,
+		},
+	}
+	specificSpec := v1.JaegerCommonSpec{
+		SecurityContext: &corev1.PodSecurityContext{
+			RunAsGroup: &intVal,
+		},
+	}
+
+	merged := Merge([]v1.JaegerCommonSpec{specificSpec, generalSpec})
+
+	assert.NotNil(t, merged.SecurityContext)
+	assert.NotNil(t, merged.SecurityContext.RunAsGroup)
+	assert.Nil(t, merged.SecurityContext.RunAsUser)
+}
+
 func TestMergeTolerations(t *testing.T) {
 	generalSpec := v1.JaegerCommonSpec{
 		Tolerations: []corev1.Toleration{{