fix(chart): Honor postCleanup.serviceAccountName on the post-delete ServiceAccount

.changes/unreleased/Fixed-20260816-093535.yaml

@@ -0,0 +1,6 @@
+kind: Fixed
+body: Honor postCleanup.serviceAccountName for the post-delete ServiceAccount and ClusterRoleBinding subject
+time: 2026-08-16T09:35:35.907047345+01:00
+custom:
+    Author: dttung2905
+    Issue: ""

deployments/kai-scheduler/templates/rbac/post-delete-binding.yaml

@@ -10,7 +10,7 @@ metadata:
     {{- include "kai-scheduler.post-delete-hook-annotations" . | nindent 4 }}
 subjects:
   - kind: ServiceAccount
-    name: post-delete-cleanup
+    name: {{ .Values.postCleanup.serviceAccountName }}
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole

deployments/kai-scheduler/templates/services/post-delete-serviceaccount.yaml

@@ -4,7 +4,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: post-delete-cleanup
+  name: {{ .Values.postCleanup.serviceAccountName }}
   namespace: {{ .Release.Namespace }}
   labels:
     app: kai-operator

deployments/kai-scheduler/tests/post_delete_test.yaml

@@ -4,8 +4,13 @@
 suite: test post-delete cleanup hook
 templates:
   - hooks/post/post-delete-job.yaml
+  - services/post-delete-serviceaccount.yaml
+  - rbac/post-delete-clusterrole.yaml
+  - rbac/post-delete-binding.yaml
 tests:
   - it: should delete only operator-managed deployments in the release namespace
+    templates:
+      - hooks/post/post-delete-job.yaml
     release:
       namespace: custom-ns
     asserts:
@@ -17,6 +22,8 @@ tests:
           pattern: delete deployments? --all
 
   - it: should delete kai-config when the config deployer is enabled
+    templates:
+      - hooks/post/post-delete-job.yaml
     set:
       kaiConfigDeployer.enabled: true
     asserts:
@@ -25,6 +32,8 @@ tests:
           pattern: kubectl delete Config kai-config --ignore-not-found
 
   - it: should preserve kai-config when the config deployer is disabled
+    templates:
+      - hooks/post/post-delete-job.yaml
     set:
       kaiConfigDeployer.enabled: false
     asserts:
@@ -33,6 +42,8 @@ tests:
           pattern: kubectl delete Config kai-config
 
   - it: should not delete kai-config in GitOps mode (pruned as a tracked release resource)
+    templates:
+      - hooks/post/post-delete-job.yaml
     set:
       kaiConfigDeployer.enabled: false
       kaiConfig.render: true
@@ -42,6 +53,8 @@ tests:
           pattern: kubectl delete Config kai-config
 
   - it: should carry the ArgoCD PostDelete hook annotations
+    templates:
+      - hooks/post/post-delete-job.yaml
     asserts:
       - equal:
           path: metadata.annotations["argocd.argoproj.io/hook"]
@@ -51,6 +64,8 @@ tests:
           value: BeforeHookCreation,HookSucceeded
 
   - it: should place the cleanup job in the release namespace
+    templates:
+      - hooks/post/post-delete-job.yaml
     release:
       namespace: custom-ns
     asserts:
@@ -64,3 +79,57 @@ tests:
     asserts:
       - hasDocuments:
           count: 0
+
+  - it: should use the default postCleanup.serviceAccountName on the job
+    templates:
+      - hooks/post/post-delete-job.yaml
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: post-delete-cleanup
+
+  - it: should name the ServiceAccount from postCleanup.serviceAccountName
+    templates:
+      - services/post-delete-serviceaccount.yaml
+    set:
+      postCleanup.serviceAccountName: custom-cleanup-sa
+    asserts:
+      - equal:
+          path: metadata.name
+          value: custom-cleanup-sa
+
+  - it: should keep ClusterRole name fixed when serviceAccountName changes
+    templates:
+      - rbac/post-delete-clusterrole.yaml
+    set:
+      postCleanup.serviceAccountName: custom-cleanup-sa
+    asserts:
+      - equal:
+          path: metadata.name
+          value: post-delete-cleanup
+
+  - it: should bind the custom ServiceAccount while keeping ClusterRoleBinding and roleRef fixed
+    templates:
+      - rbac/post-delete-binding.yaml
+    set:
+      postCleanup.serviceAccountName: custom-cleanup-sa
+    asserts:
+      - equal:
+          path: metadata.name
+          value: post-delete-cleanup
+      - equal:
+          path: subjects[0].name
+          value: custom-cleanup-sa
+      - equal:
+          path: roleRef.name
+          value: post-delete-cleanup
+
+  - it: should point the Job at the custom ServiceAccount
+    templates:
+      - hooks/post/post-delete-job.yaml
+    set:
+      postCleanup.serviceAccountName: custom-cleanup-sa
+    asserts:
+      - equal:
+          path: spec.template.spec.serviceAccountName
+          value: custom-cleanup-sa

deployments/kai-scheduler/values.yaml

@@ -302,6 +302,7 @@ postCleanup:
     name: crd-upgrader
     pullPolicy: IfNotPresent
     # tag: ""  # Optional: Override global.tag or Chart.AppVersion
+  # Name of the ServiceAccount used by the post-delete hook Job.
   serviceAccountName: post-delete-cleanup
   resources: {}