{"record":{"id":"9f96d613c3a336ab","repo":"quarkusio/quarkus","slug":"no-effective-service-account-found-for-application","errorCode":null,"errorMessage":"No effective service account found for application ","messagePattern":"No effective service account found for application ","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java","lineNumber":405,"sourceCode":"                    clusterRole.labels(),\n                    toPolicyRulesList(clusterRole.policyRules())));\n            clusterRoles.add(clusterRoleName);\n        }\n\n        // Add cluster roles from extensions\n        Targetable.filteredByTarget(clusterRolesFromExtensions, target)\n                .map(role -> new AddClusterRoleResourceDecorator(name,\n                        role.getName(),\n                        Collections.emptyMap(),\n                        role.getRules().stream()\n                                .map(RBACUtil::from)\n                                .toList()))\n                .forEach(context::add);\n\n        // Retrieve SA for current target\n        final var potentialSAs = Targetable.filteredByTarget(effectiveServiceAccounts, target).toList();\n        if (potentialSAs.isEmpty()) {\n            throw new RuntimeException(\"No effective service account found for application \" + name);\n        }\n        if (potentialSAs.size() > 1) {\n            throw new RuntimeException(\"More than one effective service account found for application \" + name);\n        }\n        final var effectiveServiceAccount = potentialSAs.get(0);\n        final var effectiveServiceAccountNamespace = effectiveServiceAccount.getNamespace();\n        final var effectiveServiceAccountName = effectiveServiceAccount.getServiceAccountName();\n\n        // Prepare default configuration\n        String defaultRoleName = null;\n        boolean defaultClusterWide = false;\n        boolean requiresServiceAccount = false;\n        if (!roles.isEmpty()) {\n            // generate a role binding using this first role.\n            defaultRoleName = roles.iterator().next();\n        } else if (!clusterRoles.isEmpty()) {\n            // generate a role binding using this first cluster role.\n            defaultClusterWide = true;","sourceCodeStart":387,"sourceCodeEnd":423,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java#L387-L423","documentation":"BaseKubeProcessor.createRbacDecorators resolves the effective service account for the current Kubernetes target (dev/test/prod) before generating RBAC decorators (RoleBinding/ClusterRoleBinding etc.). It filters the effective service accounts by target; if none match, it throws this RuntimeException because it cannot determine which service account to bind roles to for the application 'name'.","triggerScenarios":"Building with RBAC config (quarkus.kubernetes.rbac.*) enabled while no effective service account exists for the active target — e.g. quarkus.kubernetes.service-account not set and no other source produces an SA for that target.","commonSituations":"Enabling quarkus.kubernetes.rbac.roles/role-bindings without configuring a service account; targeting 'test' or 'dev' while service-account config is scoped only to 'prod'; migrating configs where the SA block was dropped.","solutions":["Configure a service account: quarkus.kubernetes.service-account.use-default-service-account=false and quarkus.kubernetes.service-account.name=my-sa","Ensure the service account config applies to the target you build for (check target qualifiers like %prod) or run the prod target build","Verify quarkus.kubernetes.rbac settings are not enabled without an SA","Check Targetable scoping of your service account entries so at least one matches the current target"],"exampleFix":"# before\nquarkus.kubernetes.rbac.roles.reader.policy=views\n# after\nquarkus.kubernetes.service-account.use-default-service-account=false\nquarkus.kubernetes.service-account.name=my-app-sa\nquarkus.kubernetes.rbac.roles.reader.policy=views","handlingStrategy":"validation","validationCode":"// before enabling rbac, confirm an SA is configured\nif (rbacEnabled && (serviceAccountName == null && useDefaultServiceAccount)) { fail(\"configure quarkus.kubernetes.service-account\"); }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Configure quarkus.kubernetes.service-account.name when using RBAC","Ensure SA config targets the build target you run (e.g. %prod)","Avoid enabling quarkus.kubernetes.rbac.* without an SA"],"tags":["kubernetes","rbac","service-account"],"backgroundTag":"missing-service-account","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}