From 199d78539a9298325ed21d4e2133068521943e9f Mon Sep 17 00:00:00 2001
From: jonasoo98 <69985308+jonasoo98@users.noreply.github.com>
Date: Tue, 6 Oct 2026 12:07:09 +0200
Subject: [PATCH] =?UTF-8?q?fix(cosi):=20add=20get/list/watch=20on=20bucket?=
 =?UTF-8?q?classes=20to=20enable=20static=20provi=E2=80=A6=20(#11620)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix(cosi): add get/list/watch on bucketclasses to enable static provisioning

* fix(cosi): bind provisioner deployment to the chart-created service account

The deployment referenced a release-prefixed service account name while the
chart creates and binds "seaweedfs-objectstorage-provisioner", so the RBAC
grants never reached the provisioner pod.

---------

Co-authored-by: Jonas Onshuus <jons@dips.no>
Co-authored-by: Chris Lu <chris.lu@gmail.com>
---
 .../seaweedfs/templates/cosi/cosi-cluster-role.yaml      | 9 ++++++++-
 k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml | 2 +-
 .../seaweedfs/templates/cosi/cosi-service-account.yaml   | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
index b5c103575..bf4127992 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-cluster-role.yaml
@@ -28,6 +28,13 @@ rules:
     - "update"
     - "create"
     - "delete"
+- apiGroups: ["objectstorage.k8s.io"]
+  resources:
+    - "bucketclasses"
+  verbs:
+    - "get"
+    - "list"
+    - "watch"
 - apiGroups: ["coordination.k8s.io"]
   resources: ["leases"]
   verbs:
@@ -61,7 +68,7 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
 subjects:
   - kind: ServiceAccount
-    name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
+    name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
     namespace: {{ .Release.Namespace }}
 roleRef:
   kind: ClusterRole
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
index 09d79da0a..a3cb650ce 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-deployment.yaml
@@ -61,7 +61,7 @@ spec:
       schedulerName: {{ .Values.cosi.schedulerName | quote }}
       {{- end }}
       enableServiceLinks: false
-      serviceAccountName: {{ include "seaweedfs.componentName" (list . "objectstorage-provisioner") }}
+      serviceAccountName: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
       {{- if .Values.cosi.initContainers }}
       initContainers:
         {{ tpl .Values.cosi.initContainers . | nindent 8 | trim }}
diff --git a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
index 6d0a4bc38..5df150469 100644
--- a/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
+++ b/k8s/charts/seaweedfs/templates/cosi/cosi-service-account.yaml
@@ -3,7 +3,7 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: {{ .Values.global.seaweedfs.serviceAccountName }}-objectstorage-provisioner
+  name: {{ include "seaweedfs.serviceAccountName" . }}-objectstorage-provisioner
   namespace: {{ .Release.Namespace }}
   labels:
     app.kubernetes.io/name: {{ template "seaweedfs.name" . }}