bugfix/3364/add-annotations-to-webapp-sa

[LeeheAlkalyDarrow]

Closes #

✅ Checklist

• I have followed every step in the contributing guide
• The PR title follows the convention.
• I ran and tested the code works

---

Testing

[Describe the steps you took to test this change]

---

Changelog

[Short description of what has changed]

---

Screenshots

[Screenshots]

💯

[changeset-bot]

⚠️ No Changeset found

Latest commit: e899f9a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

Hi @LeeheAlkalyDarrow, thanks for your interest in contributing!

This project requires that pull request authors are vouched, and you are not in the list of vouched users.

This PR will be closed automatically. See https://github.com/triggerdotdev/trigger.dev/blob/main/CONTRIBUTING.md for more details.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: 07865770-330b-44bf-af06-a03fc217bb57

📥 Commits

Reviewing files that changed from the base of the PR and between bd41bb2 and e899f9a.

📒 Files selected for processing (2)

• hosting/k8s/helm/templates/_helpers.tpl
• hosting/k8s/helm/templates/webapp.yaml

---

Walkthrough

This pull request adds a new Helm helper template trigger-v4.webappServiceAccountName to compute the webapp service account name based on configuration values. The helper defaults to <release-fullname>-webapp when service account creation is enabled, or "default" otherwise, with support for explicit name overrides. The webapp.yaml template is updated to use this helper across ServiceAccount creation, RoleBinding subject references, and Deployment pod specifications. ServiceAccount creation is now conditionally gated, and ServiceAccount annotations support is added.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[devin-ai-integration]

Devin Review found 1 potential issue.

View 1 additional finding in Devin Review.

[devin-ai-integration]

🔴 Copy-paste error: webappServiceAccountName checks supervisor.serviceAccount.create instead of webapp.serviceAccount.create

The new trigger-v4.webappServiceAccountName helper at hosting/k8s/helm/templates/_helpers.tpl:566 checks .Values.supervisor.serviceAccount.create instead of .Values.webapp.serviceAccount.create. This was clearly copied from the supervisor helper at hosting/k8s/helm/templates/_helpers.tpl:526-532 without updating the condition.

With default values, supervisor.serviceAccount.create is true, so this helper always returns the auto-generated name <fullname>-webapp. However, webapp.yaml:1 correctly checks .Values.webapp.serviceAccount.create (which has no default in values.yaml and evaluates to nil/false), so the ServiceAccount resource is not created. This results in the Deployment (line 65) and RoleBinding (line 36) referencing a ServiceAccount that doesn't exist, causing pod scheduling failures.

Suggested change

	{{- if .Values.supervisor.serviceAccount.create }}
	{{- if .Values.webapp.serviceAccount.create }}

---

Was this helpful? React with 👍 or 👎 to provide feedback.