From 93e8eac1514144874e4434af32617cd5a79eea0e Mon Sep 17 00:00:00 2001 From: Lars Francke Date: Mon, 10 Aug 2026 16:38:17 +0200 Subject: [PATCH 1/2] fix: Make serviceAccount.name and serviceAccount.create work Same fix as hive-operator#742, applied to the two CSI workloads. serviceAccount.name had no effect: the ServiceAccount and both workloads hardcoded -serviceaccount, so the value was silently ignored. They now resolve the name through operator.serviceAccountName. With serviceAccount.create=false the helper fell back to "default", giving pods running as the namespace default ServiceAccount without the operator's ClusterRole. It now requires serviceAccount.name, so the chart fails to render instead of installing something that cannot work. Rendered output is unchanged for the default values. _helpers.tpl and serviceaccount.yaml are generated from operator-templating and are ahead of the template until the matching change lands there. --- deploy/helm/listener-operator/templates/_helpers.tpl | 4 ++-- .../templates/csi-node-driver-daemonset.yaml | 2 +- .../templates/csi-provisioner-deployment.yaml | 2 +- deploy/helm/listener-operator/templates/serviceaccount.yaml | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/deploy/helm/listener-operator/templates/_helpers.tpl b/deploy/helm/listener-operator/templates/_helpers.tpl index 7d4d39da..e5354470 100644 --- a/deploy/helm/listener-operator/templates/_helpers.tpl +++ b/deploy/helm/listener-operator/templates/_helpers.tpl @@ -65,9 +65,9 @@ Create the name of the service account to use */}} {{- define "operator.serviceAccountName" -}} {{- if .Values.serviceAccount.create }} -{{- default (include "operator.fullname" .) .Values.serviceAccount.name }} +{{- default (printf "%s-serviceaccount" (include "operator.fullname" .)) .Values.serviceAccount.name }} {{- else }} -{{- default "default" .Values.serviceAccount.name }} +{{- required "serviceAccount.name is required when serviceAccount.create is false, because the chart then does not create a ServiceAccount for the operator to run as." .Values.serviceAccount.name }} {{- end }} {{- end }} diff --git a/deploy/helm/listener-operator/templates/csi-node-driver-daemonset.yaml b/deploy/helm/listener-operator/templates/csi-node-driver-daemonset.yaml index 48f97e96..1b5f2414 100644 --- a/deploy/helm/listener-operator/templates/csi-node-driver-daemonset.yaml +++ b/deploy/helm/listener-operator/templates/csi-node-driver-daemonset.yaml @@ -25,7 +25,7 @@ spec: imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} - serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount + serviceAccountName: {{ include "operator.serviceAccountName" . }} securityContext: {{- toYaml .Values.csiNodeDriver.podSecurityContext | nindent 8 }} containers: diff --git a/deploy/helm/listener-operator/templates/csi-provisioner-deployment.yaml b/deploy/helm/listener-operator/templates/csi-provisioner-deployment.yaml index e4c19e8c..0e92e0be 100644 --- a/deploy/helm/listener-operator/templates/csi-provisioner-deployment.yaml +++ b/deploy/helm/listener-operator/templates/csi-provisioner-deployment.yaml @@ -28,7 +28,7 @@ spec: imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} - serviceAccountName: {{ include "operator.fullname" . }}-serviceaccount + serviceAccountName: {{ include "operator.serviceAccountName" . }} securityContext: {{- toYaml .Values.csiProvisioner.podSecurityContext | nindent 8 }} containers: diff --git a/deploy/helm/listener-operator/templates/serviceaccount.yaml b/deploy/helm/listener-operator/templates/serviceaccount.yaml index 8ba0d58c..10633e5f 100644 --- a/deploy/helm/listener-operator/templates/serviceaccount.yaml +++ b/deploy/helm/listener-operator/templates/serviceaccount.yaml @@ -3,7 +3,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "operator.fullname" . }}-serviceaccount + name: {{ include "operator.serviceAccountName" . }} labels: {{- include "operator.labels" . | nindent 4 }} {{- with .Values.serviceAccount.annotations }} @@ -20,7 +20,7 @@ metadata: {{- include "operator.labels" . | nindent 4 }} subjects: - kind: ServiceAccount - name: {{ include "operator.fullname" . }}-serviceaccount + name: {{ include "operator.serviceAccountName" . }} namespace: {{ .Release.Namespace }} roleRef: kind: ClusterRole From 98ac35a2f66d0d422e48f3ed451660603d90245c Mon Sep 17 00:00:00 2001 From: Lars Francke Date: Mon, 10 Aug 2026 16:50:10 +0200 Subject: [PATCH 2/2] docs: Add a changelog entry for #418 --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f1beb105..9bc117f5 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,8 +9,16 @@ All notable changes to this project will be documented in this file. - Bump stackable-operator to 0.114.0 ([#411]). - Bump stackable-operator to 0.115.0 ([#416]). +### Fixed + +- BREAKING: Honour `serviceAccount.name`, which the ServiceAccount and both CSI workloads + previously ignored in favour of a hardcoded name. `serviceAccount.create=false` now requires + `serviceAccount.name`; it used to fall back to the namespace default ServiceAccount, which lacks + the operator ClusterRole ([#418]). + [#411]: https://github.com/stackabletech/listener-operator/pull/411 [#416]: https://github.com/stackabletech/listener-operator/pull/416 +[#418]: https://github.com/stackabletech/listener-operator/pull/418 ## [26.7.0] - 2026-07-21