Merge pull request #1863 from jeloba/dont-create-default-service-accounts

Don't create default ServiceAccounts

Author: openshift-merge-robot

pkg/controller/registry/resolver/step_resolver_test.go

@@ -839,6 +839,19 @@ func TestNamespaceResolverRBAC(t *testing.T) {
 		},
 	}
 	bundle := bundleWithPermissions("a.v1", "a", "alpha", "", nil, nil, nil, nil, simplePermissions, simplePermissions)
+	defaultServiceAccountPermissions := []v1alpha1.StrategyDeploymentPermissions{
+		{
+			ServiceAccountName: "default",
+			Rules: []rbacv1.PolicyRule{
+				{
+					Verbs:     []string{"get", "list"},
+					APIGroups: []string{""},
+					Resources: []string{"configmaps"},
+				},
+			},
+		},
+	}
+	bundleWithDefaultServiceAccount := bundleWithPermissions("a.v1", "a", "alpha", "", nil, nil, nil, nil, defaultServiceAccountPermissions, defaultServiceAccountPermissions)
 	type out struct {
 		steps [][]*v1alpha1.Step
 		subs  []*v1alpha1.Subscription
@@ -865,6 +878,21 @@ func TestNamespaceResolverRBAC(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "don't create default service accounts",
+			clusterState: []runtime.Object{
+				newSub(namespace, "a", "alpha", catalog),
+			},
+			bundlesInCatalog: []*api.Bundle{bundleWithDefaultServiceAccount},
+			out: out{
+				steps: [][]*v1alpha1.Step{
+					withoutResourceKind("ServiceAccount", bundleSteps(bundleWithDefaultServiceAccount, namespace, "", catalog)),
+				},
+				subs: []*v1alpha1.Subscription{
+					updatedSub(namespace, "a.v1", "", "a", "alpha", catalog),
+				},
+			},
+		},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
@@ -1036,6 +1064,18 @@ func bundleSteps(bundle *api.Bundle, ns, replaces string, catalog registry.Catal
 	return steps
 }
 
+func withoutResourceKind(kind string, steps []*v1alpha1.Step) []*v1alpha1.Step {
+	filtered := make([]*v1alpha1.Step, 0)
+
+	for i, s := range steps {
+		if s.Resource.Kind != kind {
+			filtered = append(filtered, steps[i])
+		}
+	}
+
+	return filtered
+}
+
 func subSteps(namespace, operatorName, pkgName, channelName string, catalog registry.CatalogKey) []*v1alpha1.Step {
 	sub := &v1alpha1.Subscription{
 		ObjectMeta: metav1.ObjectMeta{

pkg/controller/registry/resolver/steps.go

@@ -190,11 +190,13 @@ func NewServiceAccountStepResources(csv *v1alpha1.ClusterServiceVersion, catalog
 	}
 
 	for _, perms := range operatorPermissions {
-		step, err := NewStepResourceFromObject(perms.ServiceAccount, catalogSourceName, catalogSourceNamespace)
-		if err != nil {
-			return nil, err
+		if perms.ServiceAccount.Name != "default" {
+			step, err := NewStepResourceFromObject(perms.ServiceAccount, catalogSourceName, catalogSourceNamespace)
+			if err != nil {
+				return nil, err
+			}
+			rbacSteps = append(rbacSteps, step)
 		}
-		rbacSteps = append(rbacSteps, step)
 		for _, role := range perms.Roles {
 			step, err := NewStepResourceFromObject(role, catalogSourceName, catalogSourceNamespace)
 			if err != nil {