Use non-default service account for unpacker pods

[akihikokuroda]

The unpacker pods are using the default service account in the provisioner namespace (rukpak-system). It is not good practice from security point of view.

[akihikokuroda]

There are 2 options:

• use the hardcoded service account other than default
• Add an optional service account name in the ImageSource API.

WDYT?

[joelanford]

My two cents:

1. We should use something other than the default SA as our default. I'd suggest putting that SA in our kustomize manifests and updating our image source to use the same name. Ideally, that default SA name would be a flag passed in to the binary, so that it could be overridden at runtime (but I know that means expanding the function parameter list for source.NewDefaultUnpacker())
2. We should add a bundle.spec.source.image.serviceAccountName. If set, that would override the default from 1)

[github-actions]

This issue has become stale because it has been open 60 days with no activity. The maintainers of this repo will remove this label during issue triage or it will be removed automatically after an update. Adding the lifecycle/frozen label will cause this issue to ignore lifecycle events.