Skip to content

fix: Make serviceAccount.name and serviceAccount.create work - #418

Merged
lfrancke merged 2 commits into
mainfrom
push-nxnnzkryvyxp
Aug 17, 2026
Merged

fix: Make serviceAccount.name and serviceAccount.create work#418
lfrancke merged 2 commits into
mainfrom
push-nxnnzkryvyxp

Conversation

@lfrancke

@lfrancke lfrancke commented Aug 10, 2026

Copy link
Copy Markdown
Member

Same fix as stackabletech/hive-operator#742 please read there for details.

Fixing this here before I move the rest to operator templating because when we fix the _helpers.tpl and serviceaccount.yaml in templating they will be merged here and suddenly potentially make the whole create and name stuff actually work but those non-templated two files will still refer to the old SA which now doesn't exist and the pod won't start.

In other words: Currently it's ignored (broken). If we don't fix it here first pods might not start. So we fix it here first, then do templating.

secret-operator has the same two workloads and needs the same fix.

Same fix as hive-operator#742, applied to the two CSI workloads.

serviceAccount.name had no effect: the ServiceAccount and both workloads
hardcoded <fullname>-serviceaccount, so the value was silently ignored. They now
resolve the name through operator.serviceAccountName.

With serviceAccount.create=false the helper fell back to "default", giving pods
running as the namespace default ServiceAccount without the operator's
ClusterRole. It now requires serviceAccount.name, so the chart fails to render
instead of installing something that cannot work.

Rendered output is unchanged for the default values.

_helpers.tpl and serviceaccount.yaml are generated from operator-templating and
are ahead of the template until the matching change lands there.
@dervoeti

Copy link
Copy Markdown
Member

One thing is still a bit off, maybe we could also fix this while we're at it:
serviceaccount.yaml wraps both the ServiceAccount and the ClusterRoleBinding in {{ if .Values.serviceAccount.create }}, so with create=false no binding is rendered:

helm template foo ./deploy/helm/listener-operator --set serviceAccount.create=false --set serviceAccount.name=my-sa | grep '^kind:'
kind: StorageClass
kind: ClusterRole
kind: DaemonSet
kind: Deployment
kind: CSIDriver

So the pods now run as my-sa, but we don't grant it any permissions (the user has to provide the ClusterRoleBinding as well), while roles.yaml renders the ClusterRole unconditionally. Gating only the ClusterRoleBinding on serviceAccount.create seems unintentional.
I'd suggest we move the ClusterRoleBinding out of the if create block (or rename the whole flag to something like rbac.create and gate all three items behind it).

@dervoeti dervoeti moved this from Development: Waiting for Review to Development: In Review in Stackable Engineering Aug 16, 2026
@dervoeti
dervoeti self-requested a review August 16, 2026 15:21
@lfrancke

Copy link
Copy Markdown
Member Author

Ah yes. I saw this over in Hive as well and wondered if there is a reason for that. "Over there" I documented it assuming I didn't know enough about Kubernetes.

But yes: Happy to change it. I would suggest though to not do that in this PR but merge this and secret and then fix it for all of the operators via operator-templating.

@lfrancke

Copy link
Copy Markdown
Member Author

What that means is I need to fix the docs for the value schema in Hive but that's not a problem

@lfrancke

Copy link
Copy Markdown
Member Author

I created a templating PR with more explanation: stackabletech/operator-templating#637

@lfrancke
lfrancke added this pull request to the merge queue Aug 17, 2026
Merged via the queue into main with commit 318e49a Aug 17, 2026
33 of 34 checks passed
@lfrancke
lfrancke deleted the push-nxnnzkryvyxp branch August 17, 2026 08:33
@lfrancke lfrancke moved this from Development: In Review to Development: Done in Stackable Engineering Aug 17, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Development: Done

Development

Successfully merging this pull request may close these issues.

2 participants