From e4de366d2a5152bde7e9436bff4bba363550ffd8 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Wed, 26 Aug 2026 19:51:05 -0700
Subject: [PATCH] feat: add ServiceAccounts for poimen-memory/kmsvc/immich
 operator Roles

Bind each service's operator Role to a ServiceAccount alongside the
existing oidc:*-admins Group, and wire serviceAccountName into the
pods we control (immich-server, immich-machine-learning,
management-service). poimen-memory's Deployment lives in its own
repo/ArgoCD app, so its SA is created here but not yet wired to a pod.
---
 k8s/apps/immich/deployment.yaml                          | 2 ++
 k8s/apps/immich/rbac.yaml                                | 8 ++++++++
 .../management-service/templates/deployment.yaml         | 1 +
 k8s/infra/rbac/kmsvc-operator-role.yaml                  | 9 +++++++++
 k8s/infra/rbac/poimen-memory-operator-role.yaml          | 9 +++++++++
 5 files changed, 29 insertions(+)

diff --git a/k8s/apps/immich/deployment.yaml b/k8s/apps/immich/deployment.yaml
index 26e3b56..7f048c7 100644
--- a/k8s/apps/immich/deployment.yaml
+++ b/k8s/apps/immich/deployment.yaml
@@ -19,6 +19,7 @@ spec:
       labels:
         app: immich-server
     spec:
+      serviceAccountName: immich
       nodeSelector:
         kubernetes.io/hostname: talos-cp-3
       containers:
@@ -81,6 +82,7 @@ spec:
       labels:
         app: immich-machine-learning
     spec:
+      serviceAccountName: immich
       containers:
         - name: immich-machine-learning
           image: ghcr.io/immich-app/immich-machine-learning:release
diff --git a/k8s/apps/immich/rbac.yaml b/k8s/apps/immich/rbac.yaml
index 759637d..e9a90f9 100644
--- a/k8s/apps/immich/rbac.yaml
+++ b/k8s/apps/immich/rbac.yaml
@@ -3,6 +3,11 @@
 # provisioning-managed (immich-oidc). Same pattern as
 # k8s/apps/paperless/rbac.yaml. Inert until kube-apiserver's OIDC wiring
 # lands (--oidc-groups-claim=groups, --oidc-groups-prefix=oidc:).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: immich
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -29,6 +34,9 @@ subjects:
   - kind: Group
     name: "oidc:immich-admins"
     apiGroup: rbac.authorization.k8s.io
+  - kind: ServiceAccount
+    name: immich
+    namespace: immich
 roleRef:
   kind: Role
   name: immich-operator
diff --git a/k8s/apps/messaging/management-service/templates/deployment.yaml b/k8s/apps/messaging/management-service/templates/deployment.yaml
index 5db0979..3be84fb 100644
--- a/k8s/apps/messaging/management-service/templates/deployment.yaml
+++ b/k8s/apps/messaging/management-service/templates/deployment.yaml
@@ -13,6 +13,7 @@ spec:
       labels:
         app: management-service
     spec:
+      serviceAccountName: kmsvc
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
diff --git a/k8s/infra/rbac/kmsvc-operator-role.yaml b/k8s/infra/rbac/kmsvc-operator-role.yaml
index a83b839..f335a9a 100644
--- a/k8s/infra/rbac/kmsvc-operator-role.yaml
+++ b/k8s/infra/rbac/kmsvc-operator-role.yaml
@@ -3,6 +3,12 @@
 # operator configmap are Strimzi-managed - hand-editing them gets reverted
 # by the operator's reconcile loop or breaks the Kafka cluster. Inert until
 # kube-apiserver's OIDC wiring lands.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kmsvc
+  namespace: sqs
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -27,6 +33,9 @@ subjects:
   - kind: Group
     name: "oidc:kmsvc-admins"
     apiGroup: rbac.authorization.k8s.io
+  - kind: ServiceAccount
+    name: kmsvc
+    namespace: sqs
 roleRef:
   kind: Role
   name: kmsvc-operator
diff --git a/k8s/infra/rbac/poimen-memory-operator-role.yaml b/k8s/infra/rbac/poimen-memory-operator-role.yaml
index 768e868..6bf2e6d 100644
--- a/k8s/infra/rbac/poimen-memory-operator-role.yaml
+++ b/k8s/infra/rbac/poimen-memory-operator-role.yaml
@@ -3,6 +3,12 @@
 # poimen-git-info/poimen-secrets-* (owned by poimen's own repo/ArgoCD app,
 # not this one) are excluded. Inert until kube-apiserver's OIDC wiring lands
 # (--oidc-groups-claim=groups, --oidc-groups-prefix=oidc:).
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: poimen-memory
+  namespace: poimen
+---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
@@ -27,6 +33,9 @@ subjects:
   - kind: Group
     name: "oidc:poimen-memory-admins"
     apiGroup: rbac.authorization.k8s.io
+  - kind: ServiceAccount
+    name: poimen-memory
+    namespace: poimen
 roleRef:
   kind: Role
   name: poimen-memory-operator