Fix pipeline default service account

[Bobgy]

Which issue is resolved by this Pull Request:
Resolves kubeflow/kubeflow#4803

Description of your changes:

1. Use kf-user as pipeline default sa.
2. Bind pipeline-runner clusterrole to kf-user to avoid breaking existing usages.

Checklist:

• Unit tests have been rebuilt:
  1. cd manifests/tests
  2. make generate-changed-only
  3. make test

---

This change is 

[Bobgy]

/assign @jlewi

[Bobgy]

/retest
The error doesn't seem related

[Bobgy]

Strange, I got error:

util.py                     72 INFO     failed to apply:  (kubeflow.error): Code 500 with message: kfApp Apply failed for kustomize:  (kubeflow.error): Code 500 w
ith message: Apply.Run  Error error when creating "/tmp/kout809907334": ClusterRoleBinding.rbac.authorization.k8s.io "pipeline-runner" is invalid: subjects[1].nam
espace: Required value

I guess when referring to a service account not defined in the same kustomize package, it must have a namespace.

[Bobgy]

I'm not sure this is the right fix, because it seems https://github.com/kubeflow/kfctl/search?q=kf-user&unscoped_q=kf-user kf-user sa only exists in gcp and aws clusters.

I think we'd need a solution to let each application flexibly define what service account needs what binding in their yamls. KCC can support that for GCP, we'd need something similar.

[Bobgy]

The error message seems irrelevant, will retry again.
/retest

[Bobgy]

@jlewi Should I use var replace here?

[Bobgy]

The failed step cannot pull image: gcr.io/kubeflow-ci/test-worker-py3:789005d.
I checked on gcr.io, the image doesn't exist, seems like we are pinning to an invalid image.

[IronPan]

/lgtm

[gabrielwen]

/retest

[gabrielwen]

@Bobgy the test is fixed :)

[jlewi]

/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jlewi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jlewi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Bobgy]

Thanks! @jlewi @gabrielwen