fix(fastdeploy): run KV-sync Job under the namespace default SA#27
Merged
Conversation
The tanstack-kv sync Job was pinned to BUILD_SERVICE_ACCOUNT (deco-operator-builders), copied from the cfworkers build path. That SA is for AWS IRSA (S3) and only exists in the operator namespace, so sync Jobs created in a site's own namespace failed to schedule (SA not found). The sync Job needs no special identity — it clones via a GitHub token and writes KV via a Cloudflare token (both from env), with no AWS/IRSA and no Kubernetes API access. Default the ServiceAccount to empty (→ namespace "default" SA); allow an explicit override via DECOFILE_SYNC_SERVICE_ACCOUNT if a cluster requires one. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
hugo-ccabral
force-pushed
the
fix/fastdeploy-sync-default-sa
branch
from
7985ee8 to
c536449
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The
tanstack-kvsync Job was pinned toBUILD_SERVICE_ACCOUNT(deco-operator-builders), copied from the cfworkers build path. That SA exists for AWS IRSA (S3 artifact/log upload) and the chart only creates it in the operator namespace — so a sync Job created in a site's own namespace (sites-<site>) fails to schedule (ServiceAccount not found).The sync Job needs no special identity: it clones via a GitHub token and writes Cloudflare KV via a CF token, both from env — no AWS/IRSA, no Kubernetes API. So default its ServiceAccount to empty → Kubernetes uses the namespace
defaultSA (always present). Optional override viaDECOFILE_SYNC_SERVICE_ACCOUNTfor clusters that require a specific SA.No chart change needed (the value defaults empty). After release, sites can run fast-deploy from their own namespace instead of only
deco-system.🤖 Generated with Claude Code
Summary by cubic
Default the tanstack KV-sync Job to the namespace’s default ServiceAccount to fix SA-not-found scheduling failures in site namespaces. Add an optional override via
DECOFILE_SYNC_SERVICE_ACCOUNT(replacesBUILD_SERVICE_ACCOUNT).Written for commit c536449. Summary will update on new commits.