Support custom service account for DevWorkspaces

[metlos]

Is your enhancement related to a problem? Please describe

Che server can be configured to use a custom service account for workspaces. It can also be configured with custom set of cluster roles that it should bind to the workspace service account. This enables the users to give extra permissions to the workspace pods, should they need it.

We should add this capability to DevWorkspaces, too.

Describe the solution you'd like

IMHO it would work better in the devworkspace-operator "world" if we supported using a pre-existing labeled service account from the user's namespace for workspaces within (and auto-create the service account if no such SA exists).

This would gives us (or the cluster administrator) the ability to prepare the namespace for correct function before any DevWorkspace is deployed there.

From Che point of view we could use the existing configuration for the custom service account and custom (cluster)roles to prepare such service account in the user's namespace. This should be read from the CHE_INFRA_KUBERNETES_WORKSPACE__SA__CLUSTER__ROLES from customCheProperties and cheWorkspaceClusterRole properties in CheCluster v1 and should have some dedicated field(s) in CheCluster v2alpha1, too.

Describe alternatives you've considered

No response

Additional context

No response

[amisevsk]

After some discussion this issue is being de-prioritized. Originally, custom service account support was added to enable building containers within a workspace using podman/buildah (which requires additional permissions on the cluster). This use case is supported more directly by DWO in devfile/devworkspace-operator#679

[skabashnyuk]

@l0rd should we remove this task from step3?

[l0rd]

@skabashnyuk yes

[che-bot]

Issues go stale after 180 days of inactivity. lifecycle/stale issues rot after an additional 7 days of inactivity and eventually close.

Mark the issue as fresh with /remove-lifecycle stale in a new comment.

If this issue is safe to close now please do so.

Moderators: Add lifecycle/frozen label to avoid stale mode.