Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.

Prefect Community

Has anyone ever attached a service account to their agent with helm? I’m getting 403s after attaching a service account - including error message in thread

```"Failure","message":"jobs.batch is forbidden: User \"system:serviceaccount:default:prefect-agent\" cannot create resource \"jobs\" in API group \"batch\" in the namespace \"default\"","reason":"Forbidden","details":{"group":"batch","kind":"jobs"},"code":403}```


Did you set the env variable to define the service account?
```- name: SERVICE_ACCOUNT_NAME
  value: ''```

for the agent. You can get the full template this way:
```prefect agent kubernetes install &gt;&gt; k8s.yaml```

I’m thinking this is more on the k8s side because of this:
```kubectl auth can-i --as=system:serviceaccount:default:prefect-agent create jobs -n default```
this yields `no`

does that env var just override this:
```subjects:
  - kind: ServiceAccount
    name: default```
in the <https://docs.prefect.io/orchestration/agents/kubernetes.html#rbac|RoleBinding>?

In my `rolebinding.yaml`
```subjects:
  - kind: ServiceAccount
    name: {{ include "&lt;CHART_NAME&gt;.fullname" . }}```
Removed the 403 error I was getting

My flow is noop-ing but I’m not exactly sure if its related to this

Also - the service account is defined in a `serviceaccount.yaml` - so it inherits from the chart fullname