# Elasticsearch ignoring serviceAccountName setting

**URL:** <https://discuss.elastic.co/t/elasticsearch-ignoring-serviceaccountname-setting/253942>\
**Category:** Elastic Cloud on Kubernetes (ECK)\
**Created:** [November 1, 2020, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-serviceaccountname-setting/253942 "2020-11-01T15:01:35Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![larslevie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larslevie/32/36363_2.png) [@larslevie](https://discuss.elastic.co/u/larslevie)\
**Post date:** [November 1, 2020, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-serviceaccountname-setting/253942/1 "2020-11-01T15:01:35Z")

</div>

I have an Elasticsearch cluster created by the ECK operator. But the operator is not adding the Kube service account name to the pod templates.

Here is the Elasticsearch config (truncated for brevity):

```auto
apiVersion: elasticsearch.k8s.elastic.co/v1
kind: Elasticsearch
metadata:
  name: logging0
spec:
  version: 7.9.3
  serviceAccountName: logging-es
...

```

According to the [ECK API docs](https://www.elastic.co/guide/en/cloud-on-k8s/current/k8s-api-elasticsearch-k8s-elastic-co-v1.html#k8s-api-github-com-elastic-cloud-on-k8s-pkg-apis-elasticsearch-v1-elasticsearchspec), the `serviceAccountName` option "Can only be used if ECK is enforcing RBAC on references."

The operator is running with `enforce-rbac-on-refs` enabled:

```auto
...
      containers:
      - image: "docker.elastic.co/eck/eck-operator:1.2.1"
        imagePullPolicy: IfNotPresent
        name: manager
        args:
          - "manager"
          - "--log-verbosity=0"
          - "--metrics-port=0"
          - "--container-registry=docker.elastic.co"
          - "--max-concurrent-reconciles=3"
          - "--ca-cert-validity=8760h"
          - "--ca-cert-rotate-before=24h"
          - "--cert-validity=8760h"
          - "--cert-rotate-before=24h"
          - "--enable-webhook"
          - "--enforce-rbac-on-refs"
...

```

Is this a bug, or is there additional configuration required to get the service account added to the Elasticsearch pods?

P.S. The service account is needed so that the Pod can use the AWS IAM roles for Kubernetes feature of EKS to access an S3 bucket to store snapshots.

---

<div class="post-metadata">

**Author:** ![larslevie](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/larslevie/32/36363_2.png) [@larslevie](https://discuss.elastic.co/u/larslevie)\
**Post date:** [November 1, 2020, 3:05pm UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-serviceaccountname-setting/253942/2 "2020-11-01T15:05:24Z")

</div>

Just ended up manually added the service account to the pod template. I think I misunderstood the reason for the `serviceAccountName` option -- it isn't intended to add that service account to the pods. It's an annotation for the Operator to know how to enforce RBAC.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 4, 2022, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-ignoring-serviceaccountname-setting/253942/3 "2022-11-04T08:16:43Z")

</div>