From c8bda77bd5ecec6b33b008e6a74616d84cd3fca2 Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Mon, 31 Aug 2026 09:13:44 +0530 Subject: [PATCH] fix for secret sa --- ...ncubator-infra-k8s-admin-prd-ase1-values.yaml | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml index 33f778f..b21916d 100644 --- a/values/incubator-infra-k8s-admin-prd-ase1-values.yaml +++ b/values/incubator-infra-k8s-admin-prd-ase1-values.yaml @@ -73,12 +73,16 @@ appSpec: chartDir: contour valuesDir: contour - name: external-secrets - # Fresh install, no existing release to adopt — no nameOverride - # needed. Replaces the Vault Agent Injector for pulling secrets into - # pods. This just brings the controller up; wiring a - # SecretStore/ClusterSecretStore to Vault as the actual backend is a - # separate step once this is healthy (needs a Kubernetes auth method - # enabled on the Vault side first). + # Correction from an earlier version of this file: "no nameOverride + # needed" was wrong. Without one, the Application (and therefore the + # Helm release name the chart templates with) becomes + # "external-secrets-admin-prd" — so the controller's ServiceAccount + # actually ends up named external-secrets-admin-prd, not + # external-secrets. secretstores/vault-backend.yaml's + # serviceAccountRef assumes the plain name, and Vault's role was bound + # to bound_service_account_names=external-secrets — both need this + # pinned name to match. + nameOverride: external-secrets namespace: external-secrets chartDir: external-secrets valuesDir: external-secrets