Add template for ServiceAccount annotations

[crdueck]

ServiceAccount annotations are needed to support web identity credentials: https://www.openpolicyagent.org/docs/latest/management-bundles/#web-identity-credentials

[eshepelyuk]

Hello

1. values schema should be adjusted and corresponding lint test cases added into test/lint.
2. helm unit tests should be added for affected template in test/unit.

[crdueck]

I added a simple unit test for the serviceaccount annotations, but I'm less sure what to do about the values schema and linting you asked for.

The only example of schema & linting I found was for the image field, which makes sense because it has required sub-fields image.{repository,tag}. Whereas annotations aren't required and can have arbitrary sub-fields. My motivating use case just happens to be the IRSA role annotation.

So, could you help me better understand what you would want to see for annotations schema and linting?

[eshepelyuk]

I added a simple unit test for the serviceaccount annotations, but I'm less sure what to do about the values schema and linting you asked for.

The only example of schema & linting I found was for the image field, which makes sense because it has required sub-fields image.{repository,tag}. Whereas annotations aren't required and can have arbitrary sub-fields. My motivating use case just happens to be the IRSA role annotation.

So, could you help me better understand what you would want to see for annotations schema and linting?

Hello

1. schema must reflect\describe entire structure of values.yaml. It was recently introduced, so it's kinda empty, but it's assumed it will be improved with time.
2. annotations are not arbitrary values, it is dictionary of string to string and this can be described via json schema. Also in schema one can point that service account annotation by default is an empty dictionary.

You can use this as an example

https://github.com/eshepelyuk/cmak-operator/blob/master/values.schema.json

[eshepelyuk]

Don't forget to rebase and squash a PR into a single commit.

[crdueck]

I added a schema for the serviceAccount values and a lint check for the annotations. Rebased and squashed as well

[eshepelyuk]

Thanks for the contribution
Will be abailable in 8.5.3

https://github.com/open-policy-agent/kube-mgmt/actions/runs/6748036699