add dedicated service account to cluster-version-operator- and version- pods

ehearne-redhat · ehearne-redhat · commit 90fd30316ae6 · 2026-03-26T09:47:26.000Z
This change adds a dedicated service account to the pods mentioned above. The ClusterRoleBinding `cluster-version-operator-1`
bind the necessary `cluster-admin` ClusterRole to the `cluster-version-operator` ServiceAccount.

Manifests in `install/` directory have been re-ordered to ensure correct application of manifests. With the addition of bespoke service accounts, we needed to move the deployment manifest further down. The cluster-version-operator ClusterRoleBinding remains as it is required for upgrade tests to pass. We aim to safely remove this in an additional PR/issue.

update-payload pod just needs its own service account, no additional permissions required.

TestRenderManifestDeployment_expected_cvo_deployment.yaml has a bespoke service account added to match the CVO
Deployment, so that the tests pass for this change.
diff --git a/install/0000_00_cluster-version-operator_02_service_account-cluster-version-operator.yaml b/install/0000_00_cluster-version-operator_02_service_account-cluster-version-operator.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: cluster-version-operator
+  namespace: openshift-cluster-version
+  annotations:
+    kubernetes.io/description: Dedicated Service Account for the Cluster Version Operator.
+    include.release.openshift.io/self-managed-high-availability: "true"
diff --git a/install/0000_00_cluster-version-operator_02_service_account-update-payload.yaml b/install/0000_00_cluster-version-operator_02_service_account-update-payload.yaml
@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: update-payload
+  namespace: openshift-cluster-version
+  annotations:
+    kubernetes.io/description: Dedicated Service Account for the Update Payload.
+    include.release.openshift.io/self-managed-high-availability: "true"
diff --git a/install/0000_00_cluster-version-operator_03_roles-cluster-version-operator.yaml b/install/0000_00_cluster-version-operator_03_roles-cluster-version-operator.yaml
@@ -0,0 +1,14 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: cluster-version-operator-1
+  annotations:
+    include.release.openshift.io/self-managed-high-availability: "true"
+subjects:
+- kind: ServiceAccount
+  name: cluster-version-operator
+  namespace: openshift-cluster-version
+roleRef:
+  kind: ClusterRole
+  name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
diff --git a/install/0000_00_cluster-version-operator_03_roles-default.yaml b/install/0000_00_cluster-version-operator_03_roles-default.yaml
@@ -3,11 +3,11 @@ kind: ClusterRoleBinding
 metadata:
   name: cluster-version-operator
   annotations:
-    kubernetes.io/description: Grant the cluster-version operator permission to perform cluster-admin actions while managing the OpenShift core.
     include.release.openshift.io/self-managed-high-availability: "true"
 roleRef:
   kind: ClusterRole
   name: cluster-admin
+  apiGroup: rbac.authorization.k8s.io
 subjects:
 - kind: ServiceAccount
   namespace: openshift-cluster-version
diff --git a/install/0000_00_cluster-version-operator_30_deployment.yaml b/install/0000_00_cluster-version-operator_30_deployment.yaml
@@ -23,6 +23,7 @@ spec:
         k8s-app: cluster-version-operator
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: cluster-version-operator
       containers:
       - name: cluster-version-operator
         image: '{{.ReleaseImage}}'
diff --git a/install/0000_00_cluster-version-operator_40_service.yaml b/install/0000_00_cluster-version-operator_40_service.yaml
diff --git a/pkg/cvo/updatepayload.go b/pkg/cvo/updatepayload.go
@@ -232,6 +232,7 @@ func (r *payloadRetriever) fetchUpdatePayloadToDir(ctx context.Context, dir stri
 			},
 		},
 		Spec: corev1.PodSpec{
+			ServiceAccountName:    "update-payload",
 			ActiveDeadlineSeconds: deadline,
 			InitContainers: []corev1.Container{
 				setContainerDefaults(corev1.Container{
diff --git a/pkg/payload/render_test.go b/pkg/payload/render_test.go
@@ -23,7 +23,7 @@ func TestRenderManifest(t *testing.T) {
 				ReleaseImage:   "quay.io/cvo/release:latest",
 				ClusterProfile: "some-profile",
 			},
-			manifestFile:         "../../install/0000_00_cluster-version-operator_03_deployment.yaml",
+			manifestFile:         "../../install/0000_00_cluster-version-operator_30_deployment.yaml",
 			expectedManifestFile: "./testdata/TestRenderManifest_expected_cvo_deployment.yaml",
 		},
 	}
diff --git a/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml b/pkg/payload/testdata/TestRenderManifest_expected_cvo_deployment.yaml
@@ -23,6 +23,7 @@ spec:
         k8s-app: cluster-version-operator
     spec:
       automountServiceAccountToken: false
+      serviceAccountName: cluster-version-operator
       containers:
       - name: cluster-version-operator
         image: 'quay.io/cvo/release:latest'

Original file line number	Diff line number	Diff line change
`@@ -23,7 +23,7 @@ func TestRenderManifest(t *testing.T) {`
`23`	`23`	`ReleaseImage: "quay.io/cvo/release:latest",`
`24`	`24`	`ClusterProfile: "some-profile",`
`25`	`25`	`},`
`26`		`- manifestFile: "../../install/0000_00_cluster-version-operator_03_deployment.yaml",`
	`26`	`+ manifestFile: "../../install/0000_00_cluster-version-operator_30_deployment.yaml",`
`27`	`27`	`expectedManifestFile: "./testdata/TestRenderManifest_expected_cvo_deployment.yaml",`
`28`	`28`	`},`
`29`	`29`	`}`