From 88d5b61b7073c00c5f7be060b2f8d9a5a781a265 Mon Sep 17 00:00:00 2001 From: Lars Francke Date: Mon, 10 Aug 2026 22:18:10 +0200 Subject: [PATCH 1/2] fix: Make serviceAccount.name and serviceAccount.create work Same fix as hive-operator#742 and listener-operator#418, applied to the two workloads this chart ships. serviceAccount.name had no effect: the ServiceAccount, the controller Deployment and the CSI node driver DaemonSet all hardcoded -serviceaccount, so the value was silently ignored. They now resolve the name through operator.serviceAccountName. With serviceAccount.create=false the helper fell back to "default", giving pods running as the namespace default ServiceAccount without the operator's ClusterRole. It now requires serviceAccount.name, so the chart fails to render instead of installing something that cannot work. Rendered output is unchanged for the default values. _helpers.tpl and serviceaccount.yaml are generated from operator-templating and are ahead of the template until the matching change lands there. --- deploy/helm/secret-operator/templates/_helpers.tpl | 4 ++-- .../helm/secret-operator/templates/controller-deployment.yaml | 2 +- .../secret-operator/templates/csi-node-driver-daemonset.yaml | 2 +- deploy/helm/secret-operator/templates/serviceaccount.yaml | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/deploy/helm/secret-operator/templates/_helpers.tpl b/deploy/helm/secret-operator/templates/_helpers.tpl index 7d4d39da..e5354470 100644 --- a/deploy/helm/secret-operator/templates/_helpers.tpl +++ b/deploy/helm/secret-operator/templates/_helpers.tpl @@ -65,9 +65,9 @@ Create the name of the service account to use */}} {{- define "operator.serviceAccountName" -}} {{- if .Values.serviceAccount.create }} -{{- default (include "operator.fullname" .) .Values.serviceAccount.name }} +{{- default (printf "%s-serviceaccount" (include "operator.fullname" .)) .Values.serviceAccount.name }} {{- else }} -{{- default "default" .Values.serviceAccount.name }} +{{- required "serviceAccount.name is required when serviceAccount.create is false, because the chart then does not create a ServiceAccount for the operator to run as." .Values.serviceAccount.name }} {{- end }} {{- end }} diff --git a/deploy/helm/secret-operator/templates/controller-deployment.yaml b/deploy/helm/secret-operator/templates/controller-deployment.yaml index a2520d3c..1ae22c27 100644 --- a/deploy/helm/secret-operator/templates/controller-deployment.yaml +++ b/deploy/helm/secret-operator/templates/controller-deployment.yaml @@ -27,7 +27,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} # NOTE (@Techassi): Does it maybe make sense to have two different service accounts? - serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount + serviceAccountName: {{ include "operator.serviceAccountName" . }} securityContext: {{- toYaml .Values.controllerService.podSecurityContext | nindent 8 }} containers: diff --git a/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml b/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml index c8d3f73f..3f51b6f2 100644 --- a/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml +++ b/deploy/helm/secret-operator/templates/csi-node-driver-daemonset.yaml @@ -24,7 +24,7 @@ spec: {{- toYaml . | nindent 8 }} {{- end }} # NOTE (@Techassi): Does it maybe make sense to have two different service accounts? - serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount + serviceAccountName: {{ include "operator.serviceAccountName" . }} securityContext: {{- toYaml .Values.csiNodeDriver.podSecurityContext | nindent 8 }} containers: diff --git a/deploy/helm/secret-operator/templates/serviceaccount.yaml b/deploy/helm/secret-operator/templates/serviceaccount.yaml index 8ba0d58c..10633e5f 100644 --- a/deploy/helm/secret-operator/templates/serviceaccount.yaml +++ b/deploy/helm/secret-operator/templates/serviceaccount.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "operator.fullname" . }}-serviceaccount + name: {{ include "operator.serviceAccountName" . }} labels: {{- include "operator.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} @@ -20,7 +20,7 @@ metadata: {{- include "operator.labels" . | nindent 4 }} subjects: - kind: ServiceAccount - name: {{ include "operator.fullname" . }}-serviceaccount + name: {{ include "operator.serviceAccountName" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole From b3e3a511bcf035fe4316da7125b61c067b010472 Mon Sep 17 00:00:00 2001 From: Lars Francke Date: Mon, 10 Aug 2026 22:20:05 +0200 Subject: [PATCH 2/2] docs: Add a changelog entry for #736 --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index b4ed1308..34f4d3e5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,8 +9,16 @@ All notable changes to this project will be documented in this file. - Bump stackable-operator to 0.114.0 ([#730]). - Bump stackable-operator to 0.115.0 ([#735]). +### Fixed + +- BREAKING: Honour `serviceAccount.name`, which the ServiceAccount, the controller Deployment and + the CSI node driver DaemonSet previously ignored in favour of a hardcoded name. + `serviceAccount.create=false` now requires `serviceAccount.name`; it used to fall back to the + namespace default ServiceAccount, which lacks the operator ClusterRole ([#736]). + [#730]: https://github.com/stackabletech/secret-operator/pull/730 [#735]: https://github.com/stackabletech/secret-operator/pull/735 +[#736]: https://github.com/stackabletech/secret-operator/pull/736 ## [26.7.0] - 2026-07-21