Bootstrap Pods needs Humio ServiceAccount

internal/controller/humiobootstraptoken_controller.go

@@ -442,9 +442,10 @@ func (r *HumioBootstrapTokenReconciler) constructBootstrapPod(ctx context.Contex
 			Namespace: bootstrapConfig.Namespace(),
 		},
 		Spec: corev1.PodSpec{
-			ImagePullSecrets: bootstrapConfig.imagePullSecrets(),
-			Affinity:         bootstrapConfig.affinity(),
-			Tolerations:      bootstrapConfig.tolerations(),
+			ServiceAccountName: bootstrapConfig.humioServiceAccountName(),
+			ImagePullSecrets:   bootstrapConfig.imagePullSecrets(),
+			Affinity:           bootstrapConfig.affinity(),
+			Tolerations:        bootstrapConfig.tolerations(),
 			Containers: []corev1.Container{
 				{
 					Name:    HumioContainerName,

internal/controller/humiobootstraptoken_defaults.go

@@ -148,6 +148,16 @@ func (b *HumioBootstrapTokenConfig) resources() corev1.ResourceRequirements {
 	}
 }
 
+func (b *HumioBootstrapTokenConfig) humioServiceAccountName() string {
+	// If the HumioCluster spec has a service account name set, use that
+	if b.ManagedHumioCluster.Spec.HumioServiceAccountName != "" {
+		return b.ManagedHumioCluster.Spec.HumioServiceAccountName
+	}
+	// Otherwise, generate the default service account name based on cluster name
+	// This matches the default behavior when no node pool name is specified
+	return fmt.Sprintf("%s-%s", b.ManagedHumioCluster.Name, HumioServiceAccountNameSuffix)
+}
+
 func (b *HumioBootstrapTokenConfig) PodName() string {
 	return fmt.Sprintf("%s-%s", b.BootstrapToken.Name, bootstrapTokenPodNameSuffix)
 }

internal/controller/humiocluster_controller.go

@@ -166,6 +166,15 @@ func (r *HumioClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request
 		}
 	}
 
+	// ensure service accounts exist for all node pools before creating bootstrap token
+	// the bootstrap pod needs to reference the service account, so it must exist first
+	for _, pool := range humioNodePools.Items {
+		if err := r.ensureHumioPodPermissions(ctx, hc, pool); err != nil {
+			return r.updateStatus(ctx, r.Status(), hc, statusOptions().
+				withMessage(err.Error()))
+		}
+	}
+
 	// create HumioBootstrapToken and block until we have a hashed bootstrap token
 	if result, err := r.ensureHumioClusterBootstrapToken(ctx, hc); result != emptyResult || err != nil {
 		if err != nil {

internal/controller/suite/bootstraptokens/humiobootstraptoken_controller_test.go

@@ -128,6 +128,10 @@ var _ = Describe("HumioBootstrapToken Controller", func() {
 
 			Expect(bootstrapTokenOneTimePod.Name).To(Equal(bootstrapTokenConfig.PodName()))
 
+			// Verify service account matches the Humio service account
+			expectedServiceAccountName := toCreateHumioCluster.Name + "-humio"
+			Expect(bootstrapTokenOneTimePod.Spec.ServiceAccountName).To(Equal(expectedServiceAccountName))
+
 			// Verify node affinity matches
 			Expect(bootstrapTokenOneTimePod.Spec.Affinity).ToNot(BeNil())
 			Expect(bootstrapTokenOneTimePod.Spec.Affinity.NodeAffinity).ToNot(BeNil())