Clarify service account naming with/without release prefix

[colek42]

Clarify service account naming with/without release prefix

Problem

There's inconsistency in documentation about whether ServiceAccount names should include the Helm release prefix.

Current State

Helm Charts:

# In secretstores.yaml
serviceAccountRef:
  name: {{ .Values.kratos.serviceAccount.name | default "kratos" | quote }}

Documentation:

ServiceAccount: {release-name}-archivista

Investigation Needed

1. Check what ServiceAccount names are actually created by the subcharts
2. Verify if the release prefix is automatically added by subchart templates
3. Determine if SecretStore should reference the prefixed or unprefixed name

Possible Outcomes

Option A: Current Helm approach is correct

• Subcharts create ServiceAccounts with their own naming
• SecretStore references should match what subcharts create
• Documentation should be updated to clarify this

Option B: ServiceAccounts need release prefix

• All ServiceAccounts should include release prefix for uniqueness
• SecretStore references need updating
• Subcharts may need modification

Files to Review

• charts/kratos/templates/serviceaccount.yaml
• charts/judge-api/templates/serviceaccount.yaml
• charts/archivista/templates/serviceaccount.yaml
• charts/judge/templates/secretstores.yaml

Impact

• Medium Priority: Affects ESO authentication with Vault
• May impact multi-release deployments in same namespace

Labels

• documentation
• investigation-needed
• helm-charts

Fix Location

To Be Determined - Need investigation to determine if documentation or Helm charts need updating.