feat(argo-workflows): Allow adding additional ServiceAccounts to RoleBinding

[dbeilin]

I added an option to add additional SAs to the RoleBinding and ClusterRoleBinding that is created by default under controller.clusterWorkflowTemplates and workflow.rbac. This way users can configure other Service Accounts to be bound to that default Role.

Example: by providing a list of ServiceAccounts:

    serviceAccounts:
      - name: my-service-account
        namespace: my-namespace

I got the following result (helm template -f values.yaml . --show-only templates/controller/workflow-rb.yaml):

---
# Source: argo-workflows/templates/controller/workflow-rb.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: release-name-argo-workflows-workflow
  labels:
    helm.sh/chart: argo-workflows-0.41.4
    app.kubernetes.io/name: argo-workflows-workflow-controller
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/component: workflow-controller
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: argo-workflows
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: release-name-argo-workflows-workflow
subjects:
  - kind: ServiceAccount
    name: argo-workflow
    namespace: default
  - kind: ServiceAccount
    name: my-service-account
    namespace: "my-namespace"
---
# Source: argo-workflows/templates/controller/workflow-rb.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: release-name-argo-workflows-workflow
  labels:
    helm.sh/chart: argo-workflows-0.41.4
    app.kubernetes.io/name: argo-workflows-workflow-controller
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/component: workflow-controller
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: argo-workflows
  namespace: argo
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: release-name-argo-workflows-workflow
subjects:
  - kind: ServiceAccount
    name: argo-workflow
    namespace: argo
  - kind: ServiceAccount
    name: my-service-account
    namespace: "my-namespace"

And CRB (helm template -f values.yaml . --show-only templates/controller/workflow-controller-crb.yaml):

---
# Source: argo-workflows/templates/controller/workflow-controller-crb.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: release-name-argo-workflows-workflow-controller
  labels:
    helm.sh/chart: argo-workflows-0.41.4
    app.kubernetes.io/name: argo-workflows-workflow-controller
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/component: workflow-controller
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: argo-workflows
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: release-name-argo-workflows-workflow-controller
subjects:
  - kind: ServiceAccount
    name: release-name-argo-workflows-workflow-controller
    namespace: "argo"
---
# Source: argo-workflows/templates/controller/workflow-controller-crb.yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: release-name-argo-workflows-workflow-controller-cluster-template
  labels:
    helm.sh/chart: argo-workflows-0.41.4
    app.kubernetes.io/name: argo-workflows-workflow-controller
    app.kubernetes.io/instance: release-name
    app.kubernetes.io/component: workflow-controller
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/part-of: argo-workflows
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: release-name-argo-workflows-workflow-controller-cluster-template
subjects:
  - kind: ServiceAccount
    name: release-name-argo-workflows-workflow-controller
    namespace: "argo"
  - kind: ServiceAccount
    name: my-service-account
    namespace: "my-namespace"

Checklist:

• I have bumped the chart version according to versioning
• I have updated the documentation according to documentation
• I have updated the chart changelog with all the changes that come with this pull request according to changelog.
• Any new values are backwards compatible and/or have sensible default.
• I have signed off all my commits as required by DCO.
• My build is green (troubleshooting builds).

[yu-croco]

Thank you for your contribution. LGTM.