Use specified ServiceAccountName in RoleBinding

[toomasp]

Currently backup fails due to incorrect serviceAccount being used in the rolebinding, ie:

rpc error: code = Unknown desc = objectstores.barmancloud.cnpg.io "test123-postgresql-objectstore" is forbidden: User "system:serviceaccount:test123:custom-sa" cannot get resource "objectstores" in API group "barmancloud.cnpg.io" in the namespace "test123"

The cluster was created with spec.serviceAccountName set.

[b4stien]

Is there a blocker here? @toomasp could you update this branch? @mnencia @leonardoce @fcanovai what is the process to get this merged?

(Just hit this issue in production)

[toomasp]

Is there a blocker here? @toomasp could you update this branch? @mnencia @leonardoce @fcanovai what is the process to get this merged?

(Just hit this issue in production)

Did, can you proceed with the merge? it's such a simple change tbh.

[taherbert]

We hit this bug in production with v0.15.1. Our Clusters set spec.serviceAccountName to one shared ServiceAccount in each namespace, because EKS Pod Identity gives that account access to the backup bucket. The plugin's RoleBinding named the Cluster's name instead, so the sidecar got forbidden on its ObjectStore and ContinuousArchiving stayed False.

We applied this change to v0.15.1, and unit tests of BuildRoleBinding pass for both cases. From the code, EnsureRoleBinding also updates the subject of a RoleBinding that is already there, so current Clusters get the fix too. At this time, we add our own Role and RoleBinding for the shared account in each namespace, as #1117 describes. Please merge and release this fix.