---
id: serviceaccount-annotations-on
name: "Capability: ServiceAccount cloud-identity annotations settable (ON)"
description: >-
  Renders the product chart with serviceAccount.annotations configured for AWS IRSA (eks.amazonaws.com/role-arn) and asserts the rendered ServiceAccount carries the exact annotation key/value. The sample chart does NOT include a serviceaccount.yaml template — no ServiceAccount is rendered. Setting serviceAccount.annotations has no effect because the chart lacks both a ServiceAccount template and a serviceAccount.annotations knob. This scenario is EXPECTED to FAIL (honest red gap) documenting that the chart lacks ServiceAccount cloud-identity annotation support.
labels: {customer: enterprise, profile: compliance}
cluster:
  provider: kind
  k8s_version: v1.30.0
product:
  chart: ./chart
  release: sample
  namespace: sample
  set:
    serviceAccount.create: true
    serviceAccount.annotations.eks\\.amazonaws\\.com/role-arn: arn:aws:iam::123456789012:role/demo
asserts:
  - type: serviceaccount-annotations
    namespace: sample
    source: rendered
    expect_present: true
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/demo
tags: [capability, compliance]
category: capability
capability: serviceaccount-identity
tier: capability
mechanisms: ["capability:serviceaccount-annotations"]