---
id: serviceaccount-annotations-on
name: "Capability: ServiceAccount cloud-identity annotations settable (ON)"
description: >-
  Renders the product chart with serviceAccount.annotations configured
  for AWS IRSA (eks.amazonaws.com/role-arn) and asserts the rendered
  ServiceAccount carries the exact annotation key/value. The sample chart
  does NOT include a serviceaccount.yaml template — no ServiceAccount is
  rendered. Setting serviceAccount.annotations has no effect because the
  chart lacks both a ServiceAccount template and a
  serviceAccount.annotations knob. This scenario is EXPECTED to FAIL
  (honest red gap) documenting that the chart lacks ServiceAccount
  cloud-identity annotation support.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.36.1
product:
  chart: ./chart
  release: sample
  namespace: sample
  values: chart-test/fixtures/capability/serviceaccount-annotations-on-values.yaml
asserts:
  - type: serviceaccount-annotations
    namespace: sample
    source: rendered
    expect_present: true
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/demo
tags: [capability, compliance]
category: capability
capability: serviceaccount-identity
tier: capability
mechanisms: ["capability:serviceaccount-annotations"]