Skip to content

fix(membership): wizard Job uses migration ServiceAccount #388

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Dav-14 wants to merge 2 commits into
base: main
Choose a base branch
from
Open

fix(membership): wizard Job uses migration ServiceAccount #388

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
85e0169
fix(membership): wizard Job uses migration ServiceAccount
Dav-14 Jun 22, 2026
ab80b58
fix(membership): make wizard ConfigMap a hook too
Dav-14 Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,11 +5,11 @@
| Readme | Chart Version | App Version | Description | Hub |
|--------|---------------|-------------|-------------|-----|
| [Agent](./charts/agent/README.md) | 2.15.0 | v2.10.0 | Formance Membership Agent Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/agent)](https://artifacthub.io/packages/search?repo=agent) |
| [Cloudprem](./charts/cloudprem/README.md) | 4.10.0 | latest | Formance control-plane | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cloudprem)](https://artifacthub.io/packages/search?repo=cloudprem) |
| [Cloudprem](./charts/cloudprem/README.md) | 4.10.1 | latest | Formance control-plane | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cloudprem)](https://artifacthub.io/packages/search?repo=cloudprem) |
| [Console-V3](./charts/console-v3/README.md) | 3.7.0 | v2.6.2 | Formance Console | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/console-v3)](https://artifacthub.io/packages/search?repo=console-v3) |
| [Core](./charts/core/README.md) | 1.6.0 | latest | Formance Core Library | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/core)](https://artifacthub.io/packages/search?repo=core) |
| [Formance](./charts/formance/README.md) | 1.14.0 | latest | Formance Platform - Unified Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/formance)](https://artifacthub.io/packages/search?repo=formance) |
| [Membership](./charts/membership/README.md) | 3.6.0 | v2.5.0 | Formance EE Membership API. Manage stacks, organizations, regions, invitations, users, roles, and permissions. | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/membership)](https://artifacthub.io/packages/search?repo=membership) |
| [Formance](./charts/formance/README.md) | 1.14.1 | latest | Formance Platform - Unified Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/formance)](https://artifacthub.io/packages/search?repo=formance) |
| [Membership](./charts/membership/README.md) | 3.6.1 | v2.5.0 | Formance EE Membership API. Manage stacks, organizations, regions, invitations, users, roles, and permissions. | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/membership)](https://artifacthub.io/packages/search?repo=membership) |
| [Portal](./charts/portal/README.md) | 3.7.0 | v2.6.2 | Formance Portal | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/portal)](https://artifacthub.io/packages/search?repo=portal) |
| [Regions](./charts/regions/README.md) | 3.11.0 | latest | Formance Private Regions Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/regions)](https://artifacthub.io/packages/search?repo=regions) |
| [Stargate](./charts/stargate/README.md) | 0.11.0 | latest | Formance EE Stargate gRPC Gateway | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/stargate)](https://artifacthub.io/packages/search?repo=stargate) |
Expand Down
6 changes: 3 additions & 3 deletions charts/cloudprem/Chart.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
dependencies:
- name: membership
repository: file://../membership
version: 3.6.0
version: 3.6.1
- name: portal
repository: file://../portal
version: 3.7.0
- name: console-v3
repository: file://../console-v3
version: 3.7.0
digest: sha256:daed3f4af5ace511de313180abe29e55726644ec51b9acd1a895b1e66ed41369
generated: "2026-06-22T09:33:02.325748+02:00"
digest: sha256:5fb552ea26996bc58762b3c7f7cc37c176e3e8863be3fc2691e4f93e5d2c593e
generated: "2026-06-22T16:53:05.544004+02:00"
2 changes: 1 addition & 1 deletion charts/cloudprem/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 4.10.0
version: 4.10.1

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
Expand Down
2 changes: 1 addition & 1 deletion charts/cloudprem/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Formance cloudprem Helm chart

[![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cloudprem)](https://artifacthub.io/packages/search?repo=cloudprem)
![Version: 4.10.0](https://img.shields.io/badge/Version-4.10.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
![Version: 4.10.1](https://img.shields.io/badge/Version-4.10.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)

Formance control-plane

Expand Down
6 changes: 3 additions & 3 deletions charts/formance/Chart.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,6 @@ dependencies:
version: 3.11.0
- name: cloudprem
repository: file://../cloudprem
version: 4.10.0
digest: sha256:e6e6353c32fc72665265ce60d619cb75a12a10de216257d8a5629abefb57d658
generated: "2026-06-22T09:33:03.509948+02:00"
version: 4.10.1
digest: sha256:49322c49a4facc37512fd41c2b0644eccc46d4c834ef4642662b4bb5bb7c53e1
generated: "2026-06-22T16:53:06.658696+02:00"
2 changes: 1 addition & 1 deletion charts/formance/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ maintainers:
icon: "https://avatars.githubusercontent.com/u/84325077?s=200&v=4"

type: application
version: 1.14.0
version: 1.14.1
appVersion: "latest"
# The "-0" suffix is required for GKE compatibility. GKE versions contain
# build metadata like "v1.33.5-gke.2392000" which semver treats as pre-release.
Expand Down
2 changes: 1 addition & 1 deletion charts/formance/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# formance

![Version: 1.14.0](https://img.shields.io/badge/Version-1.14.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
![Version: 1.14.1](https://img.shields.io/badge/Version-1.14.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)

Formance Platform - Unified Helm Chart

Expand Down
2 changes: 1 addition & 1 deletion charts/membership/Chart.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ type: application
# This is the chart version. This version number should be incremented each time you make changes
# to the chart and its templates, including the app version.
# Versions are expected to follow Semantic Versioning (https://semver.org/)
version: 3.6.0
version: 3.6.1

# This is the version number of the application being deployed. This version number should be
# incremented each time you make changes to the application. Versions are not expected to
Expand Down
2 changes: 1 addition & 1 deletion charts/membership/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Formance membership Helm chart

![Version: 3.6.0](https://img.shields.io/badge/Version-3.6.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.5.0](https://img.shields.io/badge/AppVersion-v2.5.0-informational?style=flat-square)
![Version: 3.6.1](https://img.shields.io/badge/Version-3.6.1-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: v2.5.0](https://img.shields.io/badge/AppVersion-v2.5.0-informational?style=flat-square)
Formance EE Membership API. Manage stacks, organizations, regions, invitations, users, roles, and permissions.

## Requirements
Expand Down
4 changes: 4 additions & 0 deletions charts/membership/templates/wizard/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,10 @@ metadata:
namespace: {{ .Release.Namespace }}
labels:
{{- include "core.labels" . | nindent 4 }}
{{- with (include "core.job.annotations" . | fromYaml) }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
data:
config.yaml: |-
wizard:
Expand Down
2 changes: 1 addition & 1 deletion charts/membership/templates/wizard/job.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ spec:
restartPolicy: OnFailure
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
serviceAccountName: {{ include "core.serviceAccountName" . }}
serviceAccountName: {{ include "core.postgres.job.serviceAccountName" . }}

@NumaryBot NumaryBot Jun 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 [major] Keep wizard on an existing SA when migration SA is disabled

When config.migration.serviceAccount.create=false and no config.migration.serviceAccount.name is supplied, this helper renders default-migrate, but the chart does not create that ServiceAccount. The wizard Job previously used core.serviceAccountName in this configuration, so it could run with the normal chart/default SA; after this change the wizard pod will fail to schedule unless operators manually create default-migrate or set a name.

@NumaryBot NumaryBot Jun 22, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟠 [major] Preserve the existing SA when hooks are disabled

When feature.migrationHooks=false, this still switches the wizard Job from the regular core.serviceAccountName to the migration ServiceAccount. In the non-hook path there is no hook-ordering issue, and installs that only configure IAM/RBAC on serviceAccount.annotations (or disable/create a differently named migration SA) will now run the wizard with an unconfigured or missing ServiceAccount even though hooks are off. Consider keeping the previous ServiceAccount unless migration hooks are enabled.

{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
Expand Down
Loading