Context

Users have been expressing concerns regarding the usage of the IAM role auth feature of AWS sources (#248 (comment)).

Per Amazon's design, users must create one IAM Role and one Trust Relationship per Service Account (hence, per source instance). This is quite a tedious process, and for some people it is just fine to use a shared serviceAccount for selected sources.

Proposal

This PR introduces an alpha feature — currently only enabled in the event source for Amazon SQS (AWSSQSSource kind) — which allows overriding the name of the service account by annotating the source object with alpha.triggermesh.io/aws-iam-service-account: <service account name>.

I have no intention to introduce API changes here. An annotation is easier to test and less intrusive.
If it works, implementing this "properly" inside CRDs will be trivial.

Demo

apiVersion: sources.triggermesh.io/v1alpha1
kind: AWSSQSSource
metadata:
  name: sample1
  annotations:
    alpha.triggermesh.io/aws-iam-service-account: my-shared-serviceaccount  # arbitrary name
spec:
  arn: arn:aws:sqs:eu-central-1:123456789012:queue1
  auth:
    iamRole: arn:aws:iam::123456789012:role/foo  # MUST be identical in sample1 and sample2
  sink:
    ref:
      apiVersion: v1
      kind: Service
      name: event-display

---

apiVersion: sources.triggermesh.io/v1alpha1
kind: AWSSQSSource
metadata:
  name: sample2
  annotations:
    alpha.triggermesh.io/aws-iam-service-account: my-shared-serviceaccount  # arbitrary name
spec:
  arn: arn:aws:sqs:eu-central-1:123456789012:queue2
  auth:
    iamRole: arn:aws:iam::123456789012:role/foo  # MUST be identical in sample1 and sample2
  sink:
    ref:
      apiVersion: v1
      kind: Service
      name: event-display

$ kubectl get serviceaccounts
NAME                       SECRETS   AGE
default                    1         13d
my-shared-serviceaccount   1         28s

$ kubectl get deployments
NAME                             READY   UP-TO-DATE   AVAILABLE   AGE
awssqssource-sample1             1/1     1            1           3m56s
awssqssource-sample2             1/1     1            1           3m56s
event-display-00001-deployment   1/1     1            1           3m58s

$ kubectl get deployments -o jsonpath='{.items[*].spec.template.spec.serviceAccount}'
my-shared-serviceaccount my-shared-serviceaccount

Caveats

• There is no check whatsoever whether the serviceAccount already exists, is used by someone else, etc.
• There is no check whatsoever whether all sources that share a given service account are using the same iamRole value. If not, the iamRole will always be updated to the last reconciled source that uses this serviceAccount.
• The ownerReferences of the serviceAccount will always be updated to the last reconciled source that uses this serviceAccount.

Because this is an alpha, undocumented feature, I believe that none of the above caveats should prevent its testing.

cc. @sebgoa