{"record":{"id":"83a607a9fbffc60b","repo":"quarkusio/quarkus","slug":"more-than-one-effective-service-account-found-for","errorCode":null,"errorMessage":"More than one effective service account found for application ","messagePattern":"More than one effective service account found for application ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java","lineNumber":408,"sourceCode":"        }\n\n        // Add cluster roles from extensions\n        Targetable.filteredByTarget(clusterRolesFromExtensions, target)\n                .map(role -> new AddClusterRoleResourceDecorator(name,\n                        role.getName(),\n                        Collections.emptyMap(),\n                        role.getRules().stream()\n                                .map(RBACUtil::from)\n                                .toList()))\n                .forEach(context::add);\n\n        // Retrieve SA for current target\n        final var potentialSAs = Targetable.filteredByTarget(effectiveServiceAccounts, target).toList();\n        if (potentialSAs.isEmpty()) {\n            throw new RuntimeException(\"No effective service account found for application \" + name);\n        }\n        if (potentialSAs.size() > 1) {\n            throw new RuntimeException(\"More than one effective service account found for application \" + name);\n        }\n        final var effectiveServiceAccount = potentialSAs.get(0);\n        final var effectiveServiceAccountNamespace = effectiveServiceAccount.getNamespace();\n        final var effectiveServiceAccountName = effectiveServiceAccount.getServiceAccountName();\n\n        // Prepare default configuration\n        String defaultRoleName = null;\n        boolean defaultClusterWide = false;\n        boolean requiresServiceAccount = false;\n        if (!roles.isEmpty()) {\n            // generate a role binding using this first role.\n            defaultRoleName = roles.iterator().next();\n        } else if (!clusterRoles.isEmpty()) {\n            // generate a role binding using this first cluster role.\n            defaultClusterWide = true;\n            defaultRoleName = clusterRoles.iterator().next();\n        }\n","sourceCodeStart":390,"sourceCodeEnd":426,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java#L390-L426","documentation":"In the same RBAC path of BaseKubeProcessor.createRbacDecorators, after filtering effective service accounts by target, more than one match is ambiguous: Quarkus refuses to guess which service account to use for the RBAC decorators and throws this RuntimeException naming the application.","triggerScenarios":"Multiple effective service accounts resolve for the same target — e.g. a default SA plus a named one both matching 'prod', or service-account config duplicated across scopes that all apply to the active target.","commonSituations":"Setting both quarkus.kubernetes.service-account.name and another SA-contributing extension/config (e.g. an extension adding its own SA) without exclusions; duplicate keys in service account config with different targets that overlap; combining quarkus.kubernetes with a variant (openshift/minikube) config each providing an SA for the same target key.","solutions":["Ensure exactly one effective service account matches the current target; remove or scope the duplicates","Use %prod/%test style qualifiers so only one SA entry applies per target","Check extensions contributing service accounts and disable the redundant one","Build for a single target (e.g. -Dquarkus.kubernetes.deployment-target=kubernetes) to avoid cross-variant SA duplication"],"exampleFix":"# before\nquarkus.kubernetes.service-account.name=sa-a\nquarkus.openshift.service-account.name=sa-b\n# after\nquarkus.kubernetes.service-account.name=sa-a","handlingStrategy":"validation","validationCode":"// ensure exactly one SA matches target\nlong matches = serviceAccounts.stream().filter(sa -> sa.matchesTarget(target)).count();\nif (matches != 1) fail(\"expected exactly 1 effective service account for \" + target);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Scope service-account config per target with %prod/%test qualifiers","Don't combine kubernetes and openshift SA configs when building a single target","Audit extensions that auto-configure service accounts"],"tags":["kubernetes","rbac","service-account"],"backgroundTag":"ambiguous-service-account","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}