✨ feat: (helm/v1alpha1): Allow ServiceAccount annotations to be configurable

[monteiro-renato]

The use case I have in mind is for example Azure WI configuration.

Sooner or later I think this way of massaging the yaml files is going to become burdensome.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: monteiro-renato
Once this PR has been reviewed and has the lgtm label, please assign kavinjsir for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

Hi @monteiro-renato. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[camilamacedo86]

I fear we give too many options to custom things that do not exist in the project itself. The chart is only a way to package the staff. It should work the same way.

So, I will need to think about it a little

[monteiro-renato]

This, I guess?
I don't think I fully understand what is meant by "The proposed solution may not be capable of generating a fully valid and deployable Helm Chart for all use cases supported by Kubebuilder.". Is there a good resource for me to read on the supported Kubebuilder use cases?

For my team's use case we need to simplify Azure resources management and therefore need to talk to Azure APIs. To talk to the Azure APIs we need valid credentials. The best practice right now is to use Workload Identity. Configuring a k8s workload to use Workload Identity requires a few annotations and labels in some resources (such as a label in the pod spec and an annotation in the k8s service account).

I was able to do these configurations by using Kustomize patches, however, with our current setup, it's easier to deploy via Helm than it is to deploy k8s manifests so I wanted to test how I could achieve a similar goal with Helm.