Provide an auto-generation service account for multiple users about build

[sbose78]

Yes! I've had demo fails because of this issue :)

From a security perspective, I've debated myself whether it's really an issue because if multiple people/things are sharing a namespace they already have access to a lot of things and therefore they probably should not be in the same namespace if that's an issue :) but I agree that things look different in a multi-tenant world!

If you do have multiple users in the same namespace, you could technically have RBAC setup to only create create secrets and edit service accounts?

Irrespective, maybe we should inspect the service account before every build run and clean it up :) ?

We could potentially have a spec.generateServiceAccount = true
( Or something along those lines ) ?

[zhangtbj]

Yes, we already have the rBAC to control the sercret and sa creation.

But all secrets in one service account and include all docker registry infos but for different build process. I think it looks not good. :)

Yes, I agree to have a spec.generateServiceAccount.

But if spec.generateServiceAccount=true and end-user also set the ServiceAccount in buildRun now. What is the result?

Ignore which setting? I prefer to ignore the ServiceAccount setting in the buildRun and auto generate the new service account.

[sbose78]

So, this breakaway from our usual principle of BuildRun overriding Build is to avoid letting people from breaking the law ;) ?

Sounds good to me!

[zhangtbj]

em.... Good point!

I think we should follow the law, or the world will become mess. :)

So let me change:

• If spec.generateServiceAccount=true and end-user also set the ServiceAccount in buildRun
• We will choose to use the ServiceAccount which define in buildRun so that the end user can customize and override his build config from buildrun.

And I like it now. Thanks! :)

[sbose78]

Haha okay! Go for it.

[zhangtbj]

PR is merged: #105