executor/k8s: create a dedicated ServiceAccount for job pods

[marcleblanc2]

Paired with sourcegraph/sourcegraph#16392

• Job pods spawned by the Kubernetes executor run as the namespace's default ServiceAccount, with its token automounted, so they share an identity with other workloads in the namespace
  • In a stock charts/sourcegraph deployment: gitserver, searcher, indexed-search, blobstore, redis, the code intel workers, syntect-server, and the OTel and node-exporter pods
• This blocks identity-based policy (NetworkPolicy by ServiceAccount, Istio AuthorizationPolicy) on the job pods, and hands untrusted batch change / auto-indexing code a Kubernetes API token it shouldn't have

This change:

• Adds executor.kubernetesJob.serviceAccount.{create,name,annotations,automountToken} values
• Renders a sg-executor-job ServiceAccount by default, with no RBAC bindings and automountServiceAccountToken: false on the ServiceAccount object itself, so even executor images that predate sourcegraph/sourcegraph#16392 stop mounting the token once they run as this SA
• Passes KUBERNETES_JOB_SERVICE_ACCOUNT_NAME and KUBERNETES_JOB_AUTOMOUNT_SERVICE_ACCOUNT_TOKEN through the executor ConfigMap
  • Executors that predate the sourcegraph PR ignore both keys, so their job pods keep running as default until the image is upgraded

Design notes:

• The ServiceAccount is gated on executor.configureRbac as well as serviceAccount.create, matching sg-executor and its Role/RoleBinding
• A second executor release in the same namespace (for example batches next to codeintel) already sets configureRbac: false and will not fight over ownership of the SA
• The SA is created in executor.namespace (explicit metadata.namespace), since a pod can only reference a ServiceAccount in its own namespace
  • Note: The existing sg-executor Role and RoleBinding render in the Helm release namespace, so the controller can only create jobs in another namespace if RBAC there is configured out of band; that is pre-existing and not changed here
• serviceAccount.name: "" opts out entirely and falls back to the namespace default SA, preserving today's behaviour

Test plan

• helm unittest charts/sourcegraph-executor/k8s
  • 14 passed
  • 7 new cases covering the default render, configureRbac: false, create: false with an existing name, empty name, a non-release executor.namespace, annotations, and automountToken: true
• helm lint charts/sourcegraph-executor/k8s
  • Only the pre-existing empty-queueName warning
• helm template sourcegraph-executor charts/sourcegraph-executor/k8s -n sourcegraph --set executor.queueName=codeintel renders the new ServiceAccount and the two ConfigMap keys
• helm-docs regenerated charts/sourcegraph-executor/k8s/README.md

Follow-ups

• Update the executor Kubernetes deployment docs once sourcegraph/sourcegraph#16392 lands and its release is known
• Optionally extend examples/network-policy to key on the new ServiceAccount

Changelog

The sourcegraph-executor/k8s chart now creates a dedicated sg-executor-job ServiceAccount for executor job pods, with no RBAC bindings and no token mount, configurable under executor.kubernetesJob.serviceAccount

[github-actions]

Open the Diff Tour for this PR in Sourcegraph