Repository navigation
feat: control.rbac.existingServiceAccount - #39
Merged
Merged
Conversation
Runs the control pod as an existing ServiceAccount when the chart's RBAC is off (control.rbac.create=false), e.g. one with RBAC bound out of band or annotated for EKS IRSA. Before, create=false always ran the pod as the namespace default ServiceAccount. The pod leaves automountServiceAccountToken unset, so the ServiceAccount's own setting decides the API token. The render fails with create=true or control.aws.roleArn, which only annotates the chart's ServiceAccount. Opt-in: without the key, output is unchanged, including create=false with a serviceAccountName or roleArn.
piotr-reducto
marked this pull request as ready for review
November 9, 2026 09:39
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
control.rbac.existingServiceAccount. Withcontrol.rbac.create: false, the control pod can now run as an existing ServiceAccount, for example one with RBAC bound out of band or one annotated for EKS IRSA. Todaycreate: falsealways runs the pod as the namespace'sdefaultServiceAccount.automountServiceAccountTokenunset, so the ServiceAccount's own setting decides. Keep the token for the Kubernetes views, or turn it off when the pod only needs IRSA.create: true, and withcontrol.aws.roleArn.roleArnonly annotates the chart's own ServiceAccount, so in this mode you annotate the ServiceAccount yourself.Opt-in. Without the key, every test values file renders byte-identical to
mainat the same chart version. That includes the existing combinations ofcreate: falsewithserviceAccountNameorroleArn.Chart version
0.4.0->0.4.1. Tests:test/values-existing-service-account.yamland a block intest/test.sh.test.shandcontrol2 configcheckpass locally.