fix: specify serviceAccountName on all the controlplane jobs

[wmuizelaar]

Summary by CodeRabbit

• Enhancements
  • Control-plane background jobs and scheduled tasks now consistently run under the chart-configured service account.
  • Organization activation, deactivation, seeding, cleanup, migration, and user-management operations receive the appropriate workload identity.
  • Improved deployment consistency and compatibility with environments requiring explicit service-account assignment.

Checklist

• I have discussed my proposed changes in an issue and have received approval to proceed.
• I have followed the coding standards of the project.
• Tests or benchmarks have been added or updated.
• If applicable, I have provided instructions for reviewers for manually validating my changes.
• Documentation has been updated on https://github.com/wundergraph/docs-website.
• I have read the Contributors Guide.

Open Source AI Manifesto

This project follows the principles of the Open Source AI Manifesto. Please ensure your contribution aligns with its principles.

When using the helm-charts to deploy cosmo in our environment, I noticed that the serviceAccountName was not used on the jobs. That made me run into various permission errors, so I figured to add this to the various job templates. I hope it's ok I did not create an issue upfront, I will do so for the rest of the fixes / issues I will try to contribute.

[claude]

Claude Code Review

This pull request is from a fork — automated review is disabled. A repository maintainer can comment @claude review to run a one-time review.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 1ad66192-2934-4fcb-8ea1-94b2626981c1

📥 Commits

Reviewing files that changed from the base of the PR and between 6e0a147 and 7c1a394.

📒 Files selected for processing (8)

• helm/cosmo/charts/controlplane/templates/activate-organization.yaml
• helm/cosmo/charts/controlplane/templates/cleanup-old-data-cronjob.yaml
• helm/cosmo/charts/controlplane/templates/clickhouse-migration.yaml
• helm/cosmo/charts/controlplane/templates/database-migration.yaml
• helm/cosmo/charts/controlplane/templates/deactivate-organization.yaml
• helm/cosmo/charts/controlplane/templates/delete-inactive-orgs.yaml
• helm/cosmo/charts/controlplane/templates/delete-user.yaml
• helm/cosmo/charts/controlplane/templates/organization-seed.yaml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

Walkthrough

The Helm templates for control plane Jobs and CronJobs now set serviceAccountName from the configured chart service account. Existing commands and conditional directives remain functionally unchanged.

Changes

Control plane service account wiring

Layer / File(s)	Summary
Job service account wiring helm/cosmo/charts/controlplane/templates/activate-organization.yaml, helm/cosmo/charts/controlplane/templates/clickhouse-migration.yaml, helm/cosmo/charts/controlplane/templates/database-migration.yaml, helm/cosmo/charts/controlplane/templates/deactivate-organization.yaml, helm/cosmo/charts/controlplane/templates/delete-user.yaml, helm/cosmo/charts/controlplane/templates/organization-seed.yaml	The Jobs now set serviceAccountName from the chart-managed service account. Existing migration commands and Helm conditionals remain unchanged.
CronJob service account wiring helm/cosmo/charts/controlplane/templates/cleanup-old-data-cronjob.yaml, helm/cosmo/charts/controlplane/templates/delete-inactive-orgs.yaml	The CronJobs now set serviceAccountName from the configured control plane service account. Their closing conditionals remain intact.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 7c1a3

This localized chart change assigns the configured service account to control-plane jobs, addressing permission behavior without introducing an actionable merge-blocking risk; it is merge-ready after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding serviceAccountName to all control-plane jobs.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (8 skipped: 8 unsupported.)
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}