Merge pull request #1266 from ehearne-redhat/ensure-cvo-use-bespoke-service-account

openshift-merge-bot[bot] · web-flow · commit 02f6e7b27feb · 2026-03-26T16:04:58.000Z
OCPBUGS-65621: add dedicated service account to crb, cvo and version pod
diff --git a/install/0000_00_cluster-version-operator_02_service_account-cluster-version-operator.yaml b/install/0000_00_cluster-version-operator_02_service_account-cluster-version-operator.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cluster-version-operator
+  namespace: openshift-cluster-version
+  annotations:
+    kubernetes.io/description: Dedicated Service Account for the Cluster Version Operator.
+    include.release.openshift.io/self-managed-high-availability: "true"
diff --git a/install/0000_00_cluster-version-operator_02_service_account-update-payload.yaml b/install/0000_00_cluster-version-operator_02_service_account-update-payload.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: update-payload
+  namespace: openshift-cluster-version
+  annotations:
+    kubernetes.io/description: Dedicated Service Account for the Update Payload.
+    include.release.openshift.io/self-managed-high-availability: "true"
diff --git a/install/0000_00_cluster-version-operator_03_roles-cluster-version-operator.yaml b/install/0000_00_cluster-version-operator_03_roles-cluster-version-operator.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-version-operator-1
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+subjects:
+- kind: ServiceAccount
+  name: cluster-version-operator
+  namespace: openshift-cluster-version
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
diff --git a/install/0000_00_cluster-version-operator_03_roles-default.yaml b/install/0000_00_cluster-version-operator_03_roles-default.yaml
@@ -3,11 +3,11 @@ kind: ClusterRoleBinding
 metadata:
   name: cluster-version-operator
   annotations:
-    kubernetes.io/description: Grant the cluster-version operator permission to perform cluster-admin actions while managing the OpenShift core.
     include.release.openshift.io/self-managed-high-availability: "true"
 roleRef:
   kind: ClusterRole
   name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
 subjects:
 - kind: ServiceAccount
   namespace: openshift-cluster-version
diff --git a/install/0000_00_cluster-version-operator_30_deployment.yaml b/install/0000_00_cluster-version-operator_30_deployment.yaml
@@ -23,6 +23,7 @@ spec:
         k8s-app: cluster-version-operator
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: cluster-version-operator
       containers:
       - name: cluster-version-operator
         image: '{{.ReleaseImage}}'
diff --git a/install/0000_00_cluster-version-operator_40_service.yaml b/install/0000_00_cluster-version-operator_40_service.yaml
diff --git a/pkg/cvo/updatepayload.go b/pkg/cvo/updatepayload.go
@@ -233,6 +233,7 @@ func (r *payloadRetriever) fetchUpdatePayloadToDir(ctx context.Context, dir stri
 			},
 		},
 		Spec: corev1.PodSpec{
+			ServiceAccountName:    "update-payload",
 			ActiveDeadlineSeconds: deadline,
 			InitContainers: []corev1.Container{
 				setContainerDefaults(corev1.Container{
diff --git a/pkg/payload/render_test.go b/pkg/payload/render_test.go
@@ -29,7 +29,7 @@ func TestRenderManifest(t *testing.T) {
 				ReleaseImage:   "quay.io/cvo/release:latest",
 				ClusterProfile: "some-profile",
 			},
-			manifestFile:         "../../install/0000_00_cluster-version-operator_03_deployment.yaml",
+			manifestFile:         "../../install/0000_00_cluster-version-operator_30_deployment.yaml",
 			expectedManifestFile: "./testdata/TestRenderManifest_expected_cvo_deployment.yaml",
 		},
 	}
diff --git a/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml b/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml
@@ -23,6 +23,7 @@ spec:
         k8s-app: cluster-version-operator
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: cluster-version-operator
       containers:
       - name: cluster-version-operator
         image: 'quay.io/cvo/release:latest'

Original file line number	Diff line number	Diff line change
`@@ -29,7 +29,7 @@ func TestRenderManifest(t *testing.T) {`
`29`	`29`	`ReleaseImage: "quay.io/cvo/release:latest",`
`30`	`30`	`ClusterProfile: "some-profile",`
`31`	`31`	`},`
`32`		`- manifestFile: "../../install/0000_00_cluster-version-operator_03_deployment.yaml",`
	`32`	`+ manifestFile: "../../install/0000_00_cluster-version-operator_30_deployment.yaml",`
`33`	`33`	`expectedManifestFile: "./testdata/TestRenderManifest_expected_cvo_deployment.yaml",`
`34`	`34`	`},`
`35`	`35`	`}`