From bd1b88bb559c9764330368484177f871a18d49db Mon Sep 17 00:00:00 2001 From: AMontagu Date: Mon, 15 Jun 2026 16:03:55 +0200 Subject: [PATCH] fix(common): run hook Jobs under the app ServiceAccount MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Deployment sets serviceAccountName but the hook Jobs do not, so db-migrate / collectstatic (and any .Values.jobs) run as the namespace `default` SA. That SA has no IRSA / EKS Pod Identity, so any AWS call in a Job fails — e.g. collectstatic pushing static files to S3 dies with botocore NoCredentialsError, which fails the PreSync phase and blocks the rollout. Only bites fresh/cold-start namespaces; existing envs already have their SA from a prior sync. - templates/jobs.yaml: set serviceAccountName: {{ include "common.fullname" $ }} on the Job pod spec ($ because it's inside range .Values.jobs). - templates/serviceaccount.yaml: create the SA as a PreSync hook (sync-wave -3, before hook Jobs at -1) so a fresh namespace has it before the hooks run. hook-delete-policy BeforeHookCreation; identity binds by SA name so the recreate is safe and the running Deployment keeps its projected token. - Chart.yaml: 1.0.19 -> 1.0.20 Co-Authored-By: Claude Fable 5 --- sky/common/Chart.yaml | 2 +- sky/common/templates/jobs.yaml | 1 + sky/common/templates/serviceaccount.yaml | 16 ++++++++++++---- 3 files changed, 14 insertions(+), 5 deletions(-) diff --git a/sky/common/Chart.yaml b/sky/common/Chart.yaml index 3fa65db..8a2881c 100644 --- a/sky/common/Chart.yaml +++ b/sky/common/Chart.yaml @@ -2,5 +2,5 @@ apiVersion: v2 name: common description: Common Helm chart for Kubernetes type: application -version: 1.0.19 +version: 1.0.20 appVersion: "v0.1.0" diff --git a/sky/common/templates/jobs.yaml b/sky/common/templates/jobs.yaml index ae7775a..f83adf7 100644 --- a/sky/common/templates/jobs.yaml +++ b/sky/common/templates/jobs.yaml @@ -17,6 +17,7 @@ metadata: spec: template: spec: + serviceAccountName: {{ include "common.fullname" $ }} containers: - name: {{ .name }} {{- if and (.image).tag .image.repository }} diff --git a/sky/common/templates/serviceaccount.yaml b/sky/common/templates/serviceaccount.yaml index 2d180fc..26fd9b8 100644 --- a/sky/common/templates/serviceaccount.yaml +++ b/sky/common/templates/serviceaccount.yaml @@ -2,9 +2,17 @@ apiVersion: v1 kind: ServiceAccount metadata: name: {{ include "common.fullname" . }} - labels: - {{- include "common.labels" . | nindent 4 }} - {{- with .Values.serviceAccount.annotations }} annotations: + # Created in PreSync (wave -3, before PreSync hook Jobs such as db-migrate / + # collectstatic at -1) so that on a fresh namespace the hook pods can run + # under this SA — which carries the workload's IRSA / EKS Pod Identity — + # instead of the credential-less `default` SA. hook-delete-policy is + # BeforeHookCreation; the identity is bound by SA name, so recreate is safe. + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation + argocd.argoproj.io/sync-wave: "-3" + {{- with .Values.serviceAccount.annotations }} {{- toYaml . | nindent 4 }} - {{- end }} + {{- end }} + labels: + {{- include "common.labels" . | nindent 4 }}