Per workspace backup SA

A SA is created for every backup workspace to avoid ownership conflict.

Signed-off-by: Ales Raszka <[email protected]>

Author: Allda

controllers/backupcronjob/backupcronjob_controller.go

@@ -347,7 +347,7 @@ func (r *BackupCronJobReconciler) createBackupJob(
 		Spec: batchv1.JobSpec{
 			Template: corev1.PodTemplateSpec{
 				Spec: corev1.PodSpec{
-					ServiceAccountName: JobRunnerSAName,
+					ServiceAccountName: JobRunnerSAName + "-" + workspace.Status.DevWorkspaceId,
 					RestartPolicy:      corev1.RestartPolicyNever,
 					SecurityContext: &corev1.PodSecurityContext{
 						FSGroup: ptr.To[int64](0),

controllers/backupcronjob/rbac.go

@@ -17,10 +17,11 @@ package controllers
 
 import (
 	"context"
-	"fmt"
 
 	dw "github.com/devfile/api/v2/pkg/apis/workspaces/v1alpha2"
 	"github.com/devfile/devworkspace-operator/pkg/constants"
+	"github.com/devfile/devworkspace-operator/pkg/dwerrors"
+	"github.com/devfile/devworkspace-operator/pkg/provision/sync"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
@@ -35,9 +36,16 @@ func (r *BackupCronJobReconciler) ensureJobRunnerRBAC(ctx context.Context, works
 		roleName = "devworkspace-job-runner-role"
 		rbName   = "devworkspace-job-runner-rolebinding"
 	)
+	clusterAPI := sync.ClusterAPI{
+		Client:           r.Client,
+		NonCachingClient: r.NonCachingClient,
+		Scheme:           r.Scheme,
+		Logger:           r.Log,
+		Ctx:              ctx,
+	}
 
 	sa := &corev1.ServiceAccount{
-		ObjectMeta: metav1.ObjectMeta{Name: JobRunnerSAName, Namespace: workspace.Namespace, Labels: map[string]string{
+		ObjectMeta: metav1.ObjectMeta{Name: JobRunnerSAName + "-" + workspace.Status.DevWorkspaceId, Namespace: workspace.Namespace, Labels: map[string]string{
 			constants.DevWorkspaceIDLabel:          workspace.Status.DevWorkspaceId,
 			constants.DevWorkspaceWatchSecretLabel: "true",
 		}},
@@ -47,8 +55,9 @@ func (r *BackupCronJobReconciler) ensureJobRunnerRBAC(ctx context.Context, works
 	if err := controllerutil.SetControllerReference(workspace, sa, r.Scheme); err != nil {
 		return err
 	}
-	if _, err := controllerutil.CreateOrUpdate(ctx, r.Client, sa, func() error { return nil }); err != nil {
-		return fmt.Errorf("ensuring ServiceAccount: %w", err)
+
+	if _, err := sync.SyncObjectWithCluster(sa, clusterAPI); err != nil {
+		return dwerrors.WrapSyncError(err)
 	}
 
 	return nil