From 978c86a7569bacebb95cbbaa4cd2630deb68e406 Mon Sep 17 00:00:00 2001 From: Imtiaz Uddin Date: Thu, 20 Aug 2026 18:16:44 +0600 Subject: [PATCH] Scope the billing service account helper to the chart Installing the acaas umbrella failed with ServiceAccount "default" in namespace "ace" exists and cannot be imported into the current release: invalid ownership metadata Helm keeps template definitions in one global namespace, and every acaas subchart defines appscode.serviceAccountName. billing-ui, marketplace-api, platform-links and website all define it as {{- default "default" .Values.serviceAccount.name }} so once any of them is enabled its body wins over billing's and the name collapses to "default", which makes the chart try to adopt the namespace's built-in service account. The collision was invisible while billing's own body was identical; it only surfaced once the name started feeding a ServiceAccount object and the role bindings. Rename the define to billing.serviceAccountName, matching the chart-scoped billing.fullname and billing.labels, and update the six call sites. With the acaas values that reproduced the failure, billing now renders acaas-billing for the service account, all three pod specs and all three role bindings. Signed-off-by: Imtiaz Uddin --- charts/billing/templates/_helpers.tpl | 2 +- charts/billing/templates/aggregator/cronjob.yaml | 2 +- charts/billing/templates/aggregator/statefulset.yaml | 2 +- charts/billing/templates/processor/statefulset.yaml | 2 +- charts/billing/templates/rbac/rbac.yaml | 6 +++--- charts/billing/templates/rbac/serviceaccount.yaml | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/billing/templates/_helpers.tpl b/charts/billing/templates/_helpers.tpl index deccdc769..a2b511f35 100644 --- a/charts/billing/templates/_helpers.tpl +++ b/charts/billing/templates/_helpers.tpl @@ -53,7 +53,7 @@ app.kubernetes.io/instance: {{ .Release.Name }} {{/* Create the name of the service account to use */}} -{{- define "appscode.serviceAccountName" -}} +{{- define "billing.serviceAccountName" -}} {{- if .Values.serviceAccount.create }} {{- default (include "billing.fullname" .) .Values.serviceAccount.name }} {{- else }} diff --git a/charts/billing/templates/aggregator/cronjob.yaml b/charts/billing/templates/aggregator/cronjob.yaml index bd3f629a4..6caa6a44d 100644 --- a/charts/billing/templates/aggregator/cronjob.yaml +++ b/charts/billing/templates/aggregator/cronjob.yaml @@ -21,7 +21,7 @@ spec: template: spec: {{- include "appscode.imagePullSecrets" . | nindent 10 }} - serviceAccountName: {{ include "appscode.serviceAccountName" . }} + serviceAccountName: {{ include "billing.serviceAccountName" . }} {{- if eq "true" ( include "distro.openshift" . ) }} securityContext: {{- toYaml (omit .Values.podSecurityContext "runAsUser" "runAsGroup" "fsGroup" "supplementalGroups") | nindent 12 }} diff --git a/charts/billing/templates/aggregator/statefulset.yaml b/charts/billing/templates/aggregator/statefulset.yaml index 6a48887e7..69b8115e7 100644 --- a/charts/billing/templates/aggregator/statefulset.yaml +++ b/charts/billing/templates/aggregator/statefulset.yaml @@ -30,7 +30,7 @@ spec: {{- include "billing.selectorLabels" . | nindent 8 }} spec: {{- include "appscode.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ include "appscode.serviceAccountName" . }} + serviceAccountName: {{ include "billing.serviceAccountName" . }} {{- if eq "true" ( include "distro.openshift" . ) }} securityContext: {{- toYaml (omit .Values.podSecurityContext "runAsUser" "runAsGroup" "fsGroup" "supplementalGroups") | nindent 8 }} diff --git a/charts/billing/templates/processor/statefulset.yaml b/charts/billing/templates/processor/statefulset.yaml index b18852ff0..bb9c35f50 100644 --- a/charts/billing/templates/processor/statefulset.yaml +++ b/charts/billing/templates/processor/statefulset.yaml @@ -30,7 +30,7 @@ spec: {{- include "billing.selectorLabels" . | nindent 8 }} spec: {{- include "appscode.imagePullSecrets" . | nindent 6 }} - serviceAccountName: {{ include "appscode.serviceAccountName" . }} + serviceAccountName: {{ include "billing.serviceAccountName" . }} {{- if eq "true" ( include "distro.openshift" . ) }} securityContext: {{- toYaml (omit .Values.podSecurityContext "runAsUser" "runAsGroup" "fsGroup" "supplementalGroups") | nindent 8 }} diff --git a/charts/billing/templates/rbac/rbac.yaml b/charts/billing/templates/rbac/rbac.yaml index 8170b945a..0481effcb 100644 --- a/charts/billing/templates/rbac/rbac.yaml +++ b/charts/billing/templates/rbac/rbac.yaml @@ -63,7 +63,7 @@ roleRef: name: appscode:license-checker subjects: - kind: ServiceAccount - name: {{ include "appscode.serviceAccountName" . }} + name: {{ include "billing.serviceAccountName" . }} namespace: {{ .Release.Namespace }} --- @@ -102,7 +102,7 @@ roleRef: name: appscode:license-reader subjects: - kind: ServiceAccount - name: {{ include "appscode.serviceAccountName" . }} + name: {{ include "billing.serviceAccountName" . }} namespace: {{ .Release.Namespace }} --- @@ -150,5 +150,5 @@ roleRef: name: {{ include "billing.fullname" . }} subjects: - kind: ServiceAccount - name: {{ include "appscode.serviceAccountName" . }} + name: {{ include "billing.serviceAccountName" . }} namespace: {{ .Release.Namespace }} diff --git a/charts/billing/templates/rbac/serviceaccount.yaml b/charts/billing/templates/rbac/serviceaccount.yaml index 6734bd7e2..62798da4e 100644 --- a/charts/billing/templates/rbac/serviceaccount.yaml +++ b/charts/billing/templates/rbac/serviceaccount.yaml @@ -2,7 +2,7 @@ apiVersion: v1 kind: ServiceAccount metadata: - name: {{ include "appscode.serviceAccountName" . }} + name: {{ include "billing.serviceAccountName" . }} namespace: {{ .Release.Namespace }} labels: {{- include "billing.labels" . | nindent 4 }}