Use gc service account for Kafka Connect output build

[holysheep]

I want to push Kafka's Connect build output image with debezium connector to the Google Cloud private registry. I prefer to use service account instead of secret for this.

So I've added annotation in KafkaConnect's template for the SA patching like this:

But it does not annotate strimzi-kafka-connect-cluster-connect-build service account, which is addressing docker registry:

And strimzi-kafka-connect-cluster-connect doesnt get annotated either.

Am I doing something wrong or is it not possible to push output artifact without a pushSecret?

[scholzj]

If you want to assign an annotation to the builder pod, you have to do it in .spec.template.buildPod and not in .spec.template.pod. .spec.template.pod would set the annotation to the Connect worker pods.

But none of that would annotate the Service Account. If you want to annotate the Service Account used for the build, it would be .spec.template.buildServiceAccount ;-)