quarkusio/quarkus · error · IllegalStateException

More than one ApplyServiceAccountNameDecorator found

Error message

More than one ApplyServiceAccountNameDecorator found

What it means

BaseKubeProcessor's constructor inspects the resource context for existing ApplyServiceAccountNameDecorator instances added by other processors/extensions. Because at most one service account name decorator may exist (a second would conflict/overwrite), finding more than one throws IllegalStateException. This is a build-pipeline invariant violation rather than a user config error per se.

Source

Thrown at extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java:906

                            .build()));
                });
    }

    private static final String DEFAULT_RESTART_POLICY = JobRestartPolicy.OnFailure.name();
    private static final String DEFAULT_COMPLETION_MODE = JobCompletionMode.NonIndexed.name();

    private void createInitJobDecorators(DecoratorsContext context, List<KubernetesJobBuildItem> items) {
        List<AddEnvVarDecorator> envVarDecorators = context.decoratorsOfType(AddEnvVarDecorator.class);

        List<AddMountDecorator> mountDecorators = context.decoratorsOfType(AddMountDecorator.class);

        final Optional<ApplyServiceAccountNameDecorator> serviceAccount;
        List<ApplyServiceAccountNameDecorator> serviceAccountDecorators = context
                .decoratorsOfType(ApplyServiceAccountNameDecorator.class);
        final var size = serviceAccountDecorators.size();
        if (size > 0) {
            if (size > 1) {
                throw new IllegalStateException("More than one ApplyServiceAccountNameDecorator found");
            }
            serviceAccount = Optional.of(serviceAccountDecorators.get(0));
        } else {
            serviceAccount = Optional.empty();
        }

        Targetable.filteredByTarget(items, context.target).forEach(item -> {

            final var name = item.getName();
            final var serviceAccountName = serviceAccount.map(sa -> sa.getServiceAccountNameOrDefault(name)).orElse(name);
            // specialized Job resource creator, overriding defaults and adding extra configuration
            // this is needed as we've removed decorators that were previously applied to the simple job resource created here
            // with this specialized job creator, we inherit the behavior that directly sets values instead of using decorators but add specialized behavior as well
            final var job = new AddJobResourceDecorator(name, config(), null) {
                @Override
                protected void initBuilderWithDefaults(JobBuilder builder) {
                    super.initBuilderWithDefaults(builder);

View on GitHub (pinned to e1c734241f)

Solutions

1. Check for custom code or extensions adding ApplyServiceAccountNameDecorator and remove the duplicate
2. Build one deployment target per invocation (quarkus.kubernetes.deployment-target=kubernetes only) to isolate variants
3. Upgrade/downgrade Quarkus if this occurs with stock extensions only (processor conflict regression)
4. File/debug in the contributing extension: only one SA decorator must be added per context

Example fix

// before (custom processor adds another)
context.add(new ApplyServiceAccountNameDecorator(name, saName));
// after: reuse/replace instead of adding
customizer.customizeExistingDecorator(ApplyServiceAccountNameDecorator.class, d -> d.setName(saName));

long count = context.decoratorsOfType(ApplyServiceAccountNameDecorator.class).size();
if (count > 1) fail("duplicate ApplyServiceAccountNameDecorator detected");

try { new BaseKubeProcessor(serviceAccount); } catch (IllegalStateException e) { /* another extension added a duplicate SA decorator */ }

When it happens

Trigger: More than one processor added an ApplyServiceAccountNameDecorator to the deployment context before BaseKubeProcessor runs — e.g. two deployment-target variants (kubernetes + openshift) both generating SA decorators into the same context, or a custom extension contributing a duplicate decorator.

Common situations: Building multiple deployment targets simultaneously where each variant's processor adds its own SA decorator; custom extensions adding ApplyServiceAccountNameDecorator on top of the vanilla processor; upgrades where processor ordering/exclusivity changed.

Related errors

• Build:%s is no longer present!
• Build:%s has no status!
• Build:%s cancelled!
• No effective service account found for application
• More than one effective service account found for applicatio

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/91b3b6bd37de17c6. Report an issue: GitHub.