quarkusio/quarkus · error · RuntimeException

No effective service account found for application

Error message

No effective service account found for application 

What it means

BaseKubeProcessor.createRbacDecorators resolves the effective service account for the current Kubernetes target (dev/test/prod) before generating RBAC decorators (RoleBinding/ClusterRoleBinding etc.). It filters the effective service accounts by target; if none match, it throws this RuntimeException because it cannot determine which service account to bind roles to for the application 'name'.

Source

Thrown at extensions/kubernetes/vanilla/deployment/src/main/java/io/quarkus/kubernetes/deployment/BaseKubeProcessor.java:405

                    clusterRole.labels(),
                    toPolicyRulesList(clusterRole.policyRules())));
            clusterRoles.add(clusterRoleName);
        }

        // Add cluster roles from extensions
        Targetable.filteredByTarget(clusterRolesFromExtensions, target)
                .map(role -> new AddClusterRoleResourceDecorator(name,
                        role.getName(),
                        Collections.emptyMap(),
                        role.getRules().stream()
                                .map(RBACUtil::from)
                                .toList()))
                .forEach(context::add);

        // Retrieve SA for current target
        final var potentialSAs = Targetable.filteredByTarget(effectiveServiceAccounts, target).toList();
        if (potentialSAs.isEmpty()) {
            throw new RuntimeException("No effective service account found for application " + name);
        }
        if (potentialSAs.size() > 1) {
            throw new RuntimeException("More than one effective service account found for application " + name);
        }
        final var effectiveServiceAccount = potentialSAs.get(0);
        final var effectiveServiceAccountNamespace = effectiveServiceAccount.getNamespace();
        final var effectiveServiceAccountName = effectiveServiceAccount.getServiceAccountName();

        // Prepare default configuration
        String defaultRoleName = null;
        boolean defaultClusterWide = false;
        boolean requiresServiceAccount = false;
        if (!roles.isEmpty()) {
            // generate a role binding using this first role.
            defaultRoleName = roles.iterator().next();
        } else if (!clusterRoles.isEmpty()) {
            // generate a role binding using this first cluster role.
            defaultClusterWide = true;

View on GitHub (pinned to e1c734241f)

Solutions

1. Configure a service account: quarkus.kubernetes.service-account.use-default-service-account=false and quarkus.kubernetes.service-account.name=my-sa
2. Ensure the service account config applies to the target you build for (check target qualifiers like %prod) or run the prod target build
3. Verify quarkus.kubernetes.rbac settings are not enabled without an SA
4. Check Targetable scoping of your service account entries so at least one matches the current target

Example fix

# before
quarkus.kubernetes.rbac.roles.reader.policy=views
# after
quarkus.kubernetes.service-account.use-default-service-account=false
quarkus.kubernetes.service-account.name=my-app-sa
quarkus.kubernetes.rbac.roles.reader.policy=views

// before enabling rbac, confirm an SA is configured
if (rbacEnabled && (serviceAccountName == null && useDefaultServiceAccount)) { fail("configure quarkus.kubernetes.service-account"); }

When it happens

Trigger: Building with RBAC config (quarkus.kubernetes.rbac.*) enabled while no effective service account exists for the active target — e.g. quarkus.kubernetes.service-account not set and no other source produces an SA for that target.

Common situations: Enabling quarkus.kubernetes.rbac.roles/role-bindings without configuring a service account; targeting 'test' or 'dev' while service-account config is scoped only to 'prod'; migrating configs where the SA block was dropped.

Related errors

• More than one effective service account found for applicatio
• No role has been set in the RoleBinding resource!
• No subjects have been set in the ClusterRoleBinding resource
• More than one ApplyServiceAccountNameDecorator found
• Unable to obtain configuration for Secret objects from Kuber

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9f96d613c3a336ab. Report an issue: GitHub.