Enable to add Service Account Name in Katib config

[andreyvelich]

Fixes: #1079.

I added functionality to add Service Account Name using Katib config.

We can add Validation part, for example here: https://github.com/kubeflow/katib/blob/master/pkg/webhook/v1alpha3/experiment/validation_webhook.go#L88, to Validate Katib config.

For example, users can't submit Experiment with Service Account, if they don't have appropriate Service Account in Experiment Namespace. I don't know if it useful or not for us.

What do you think @gaocegege @johnugeorge @hougangliu ?

/cc @nrchakradhar.

---

This change is 

[nrchakradhar]

Can you also please update one example to show how to use this. Is it possible to use different service accounts for different experiments.

[andreyvelich]

@nrchakradhar In the current implementation it is not possible to use different Service Account for different Experiment. You need to change katib-config every time you want to change service account for the algorithm.
We can add service account to Experiment API. In that case, each Experiment will have their own service account.
What do you think @johnugeorge @gaocegege @hougangliu ?

[gaocegege]

In the current implementation it is not possible to use different Service Account for different Experiment.

The main problem is that suggestion does not support serviceaccount, right?

[andreyvelich]

In the current implementation it is not possible to use different Service Account for different Experiment.

The main problem is that suggestion does not support serviceaccount, right?

Yes, suggestion Deployment for some cases can have Service Account.

[gaocegege]

Then

We can add service account to Experiment API. In that case, each Experiment will have their own service account.

LGTM.

[andreyvelich]

/hold

Hold until we decide the solution for this.

[johnugeorge]

One problem I see is that Suggestions are hidden to a normal user. If it is just used for suggestion deployments, do we need to expose it?

[nrchakradhar]

Service accounts are subjects. So even if some CRs are hidden, is it better they run as part of that service account providing greater isolation.

[johnugeorge]

@nrchakradhar I meant, putting service account parameter in Experiment API vs Katib config.

[andreyvelich]

For now, we can merge this implementation with katib-config changes. In the future, if more users need to have serviceAccount per Experiment, we will change it.
What do you think @gaocegege @johnugeorge ?

@nrchakradhar I will add documentation about parameters in katib-config.

[johnugeorge]

Sounds good
/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: johnugeorge

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [johnugeorge]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[andreyvelich]

/hold cancel

[andreyvelich]

/retest

[andreyvelich]

/retest