[Helm] ServiceAccount for TabletServer, CoordinatorServer (#2142)

* ServiceAccount for TabletServer

* ServiceAccount for CoordinatorServer

* helm convention and generic comment

Author: Paritosh-Anand

helm/templates/serviceaccount.yaml

@@ -0,0 +1,30 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+{{- if .Values.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Values.serviceAccount.name | default (include "fluss.fullname" .) }}
+  labels:
+    {{- include "fluss.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

helm/templates/sts-coordinator.yaml

@@ -35,6 +35,9 @@ spec:
         {{- include "fluss.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: coordinator
     spec:
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ .Values.serviceAccount.name | default (include "fluss.fullname" .) }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-coordinator
           image: "{{.Values.image.repository}}:{{ .Values.image.tag }}"

helm/templates/sts-tablet.yaml

@@ -35,6 +35,9 @@ spec:
         {{- include "fluss.selectorLabels" . | nindent 8 }}
         app.kubernetes.io/component: tablet
     spec:
+      {{- if .Values.serviceAccount.create }}
+      serviceAccountName: {{ .Values.serviceAccount.name | default (include "fluss.fullname" .) }}
+      {{- end }}
       containers:
         - name: {{ .Chart.Name }}-tablet
           image: "{{.Values.image.repository}}:{{ .Values.image.tag }}"

helm/values.yaml

@@ -65,4 +65,12 @@ resources: {}
   #     memory: 128Mi
   #   limits:
   #     cpu: 100m
-  #     memory: 128Mi
+  #     memory: 128Mi
+
+serviceAccount:
+  create: false
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+  # Additional annotations to apply to the ServiceAccount.
+  # These can be useful, for example, to support integrations like workload identity.
+  annotations: {}