fix(common): run hook Jobs under the app ServiceAccount#23
Open
AMontagu wants to merge 1 commit into
Open
Conversation
The Deployment sets serviceAccountName but the hook Jobs do not, so
db-migrate / collectstatic (and any .Values.jobs) run as the namespace
`default` SA. That SA has no IRSA / EKS Pod Identity, so any AWS call in a
Job fails — e.g. collectstatic pushing static files to S3 dies with
botocore NoCredentialsError, which fails the PreSync phase and blocks the
rollout. Only bites fresh/cold-start namespaces; existing envs already have
their SA from a prior sync.
- templates/jobs.yaml: set serviceAccountName: {{ include "common.fullname" $ }}
on the Job pod spec ($ because it's inside range .Values.jobs).
- templates/serviceaccount.yaml: create the SA as a PreSync hook (sync-wave -3,
before hook Jobs at -1) so a fresh namespace has it before the hooks run.
hook-delete-policy BeforeHookCreation; identity binds by SA name so the
recreate is safe and the running Deployment keeps its projected token.
- Chart.yaml: 1.0.19 -> 1.0.20
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
templates/deployment.yamlsetsserviceAccountName: {{ include "common.fullname" . }}, buttemplates/jobs.yamldoes not — so every hook Job (db-migrate,collectstatic, any.Values.jobs) runs under the namespacedefaultServiceAccount.defaulthas no IRSA / EKS Pod Identity, so any AWS call inside a Job fails. Concretely, on a fresh Objow dev env,collectstaticdied with:pushing static files to S3 — which fails the PreSync phase and blocks the whole rollout. It only bites fresh / cold-start namespaces; existing envs already have their
<release>-commonSA from a prior sync, so they don't surface it.Changes
templates/jobs.yaml— setserviceAccountName: {{ include "common.fullname" $ }}on the Job pod spec. ($, not., because the spec is inside{{- range .Values.jobs }}— same reason the image line usesinclude "common.image" $.)templates/serviceaccount.yaml— create the SA as a PreSync hook atsync-wave: "-3"(before hook Jobs, which are typically at-1), so on a fresh namespace the SA exists before the hooks run. Without this, change Add cilium and argocd #1 would fail cold-starts withserviceaccount "<release>-common" not found(the SA was a plain Sync-phase resource, created after PreSync hooks).hook-delete-policy: BeforeHookCreation; IRSA/Pod Identity binds by SA name, so the delete+recreate is safe and the running Deployment keeps its already-projected token.Chart.yaml—1.0.19→1.0.20.Impact
Strictly an improvement for every consumer: hook Jobs get the same ServiceAccount (and therefore the same IRSA / Pod Identity) as the Deployment, instead of silently running as
default. Existing envs are unaffected (their SA already exists; recreating it via PreSync hook is idempotent).Test plan
helm templaterendersserviceAccountName: <release>-commonon the Job pods and the SA with the PreSync-hook annotations (verified locally).db-migrate/collectstaticrun under it and reach AWS; PreSync passes.