feat(PrefectWorkPool): add ServiceAccount support#244
Merged
mitchnielsen merged 3 commits intomainfrom Feb 12, 2026
Merged
Conversation
Users deploying PrefectWorkPool resources through GitOps workflows were encountering RBAC permission errors because worker pods always used the namespace's default ServiceAccount. This caused pod and job listing failures with "APIForbiddenError: pods is forbidden" messages. Added an optional `serviceAccountName` field to the PrefectWorkPoolSpec that allows users to specify a custom ServiceAccount for worker pods. When not specified, the field defaults to empty string, maintaining backward compatibility by using the namespace's default ServiceAccount. Changes: - Added `serviceAccountName` optional field to PrefectWorkPoolSpec - Updated controller to apply the ServiceAccount to worker pod deployments - Added helper function to handle default behavior when field is not set - Generated updated CRDs with the new field - Added three test cases covering custom SA, default SA, and empty string scenarios - Updated sample manifests with commented example - Regenerated CRD documentation Closes #243 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
mitchnielsen
changed the title
The other PrefectWorkPool helpers (Image, EntrypointArguments, ToEnvVars, etc.) are methods on the type. Move getServiceAccountName to match. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
jamiezieziula
approved these changes
Feb 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Users deploying PrefectWorkPool resources through GitOps workflows were encountering RBAC permission errors because worker pods always used the namespace's default ServiceAccount. This caused pod and job listing failures with "APIForbiddenError: pods is forbidden" messages.
Added an optional
serviceAccountNamefield to the PrefectWorkPoolSpec that allows users to specify a custom ServiceAccount for worker pods. When not specified, the field defaults to empty string, maintaining backward compatibility by using the namespace's default ServiceAccount.Changes
serviceAccountNameoptional field to PrefectWorkPoolSpecTesting
All 128 unit tests pass, including 3 new tests specifically for ServiceAccount behavior.
Closes #243