chore: service account migration

konflux-configs/README.md

@@ -86,7 +86,7 @@ oc get applications -n $NAMESPACE
 oc get components -n $NAMESPACE
 
 # Check service accounts
-oc get sa -n $NAMESPACE konflux-configuration-as-code-deployer
+oc get sa -n $NAMESPACE konflux-bot-1
 ```
 
 ### Step 4: Upgrade to Custom Build Pipeline
@@ -223,8 +223,8 @@ environment-specific overlays (dev/prod).
 - **Trigger**: ReleasePlan with `auto-release: true` in
   `base/release-plan/konflux-manifests/base/releaseplan.yaml`
 - **Pipeline**: `pipelines/konflux/deploy-config.yaml`
-- **Service Account**: `konflux-configuration-as-code-deployer`
-  (defined in `base/release-plan/konflux-manifests/base/rbac.yaml`)
+- **Service Account**: `konflux-bot-1`
+  (defined in `base/release-plan/konflux-manifests/base/konflux-bot-1.yaml`)
 - **Process**:
   - Task `extract-and-apply-manifests` extracts `/manifests.yaml`
     from built image
@@ -252,8 +252,7 @@ konflux-configs/
 │   ├── release-plan/           # Release automation
 │   │   └── konflux-manifests/  # CAC deployment release plan
 │   └── service-account/        # RBAC for automation
-│       ├── promote-to-candidate-sa.yaml
-│       └── release-sa.yaml
+│       └── konflux-bot-0.yaml
 ├── overlay/                    # Environment-specific configs
 │   ├── dev/                    # Development environment
 │   │   └── kustomization.yaml  # namespace: rhtas-dev-tenant

konflux-configs/base/application/base/promote-to-candidate/releaseplan.yaml

@@ -14,7 +14,7 @@ spec:
       value: "false"
     - name: type
       value: "component"
-    serviceAccountName: rhtas-build-bot
+    serviceAccountName: konflux-bot-0
     pipelineRef:
       resolver: git
       params:

konflux-configs/base/project/base/release-plan/patch/component.yaml

@@ -20,7 +20,7 @@
           value: "false"
         - name: type
           value: "component"
-        serviceAccountName: rhtas-build-bot
+        serviceAccountName: konflux-bot-0
         pipelineRef:
           resolver: git
           params:

konflux-configs/base/project/base/release-plan/patch/fbc.yaml

@@ -20,7 +20,7 @@
           value: "fbc"
         - name: file-name
           value: "{{.operator}}-fbc.json"
-        serviceAccountName: rhtas-build-bot
+        serviceAccountName: konflux-bot-0
         pipelineRef:
           resolver: git
           params:

konflux-configs/base/project/base/release-plan/patch/operator.yaml

@@ -20,7 +20,7 @@
           value: "false"
         - name: type
           value: "operator"
-        serviceAccountName: rhtas-build-bot
+        serviceAccountName: konflux-bot-0
         pipelineRef:
           resolver: git
           params:

konflux-configs/base/release-plan/konflux-manifests/base/rbac.yaml → konflux-configs/base/release-plan/konflux-manifests/base/konflux-bot-1.yaml

@@ -2,12 +2,14 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: konflux-configuration-as-code-deployer
+  name: konflux-bot-1
+  labels:
+    rhtas.redhat.com/sa-group: konflux-configuration-as-code-deployer
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: konflux-configuration-as-code-role
+  name: konflux-bot-1-role
 rules:
   - apiGroups: ["appstudio.redhat.com"]
     resources: ["applications", "components", "integrationtestscenarios", "releaseplans", "snapshots", "imagerepositories"]
@@ -25,12 +27,12 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: konflux-configuration-as-code-deployer-rolebinding
+  name: konflux-bot-1-rolebinding
 subjects:
   - kind: ServiceAccount
-    name: konflux-configuration-as-code-deployer
+    name: konflux-bot-1
 roleRef:
   kind: Role
-  name: konflux-configuration-as-code-role
+  name: konflux-bot-1-role
   apiGroup: rbac.authorization.k8s.io
 ---

konflux-configs/base/release-plan/konflux-manifests/base/kustomization.yaml

@@ -1,3 +1,3 @@
 resources:
   - releaseplan.yaml
-  - rbac.yaml
+  - konflux-bot-1.yaml

konflux-configs/base/release-plan/konflux-manifests/base/releaseplan.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   application: konflux
   tenantPipeline:
-    serviceAccountName: konflux-configuration-as-code-deployer
+    serviceAccountName: konflux-bot-1
     pipelineRef:
       resolver: git
       params:

konflux-configs/base/service-account/promote-to-candidate-sa.yaml → konflux-configs/base/service-account/konflux-bot-0.yaml

@@ -2,13 +2,17 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
-  name: rhtas-build-bot
+  name: konflux-bot-0
   namespace: rhtas-tenant
+  labels:
+    rhtas.redhat.com/sa-group: build-ci-release
+imagePullSecrets:
+  - name: registry-redhat-io-pull-secret
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
-  name: rhtas-build-bot-role
+  name: konflux-bot-0-role
   namespace: rhtas-tenant
 rules:
   - apiGroups: ["appstudio.redhat.com"]
@@ -21,14 +25,14 @@ rules:
 apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
-  name: rhtas-build-bot-rolebinding
+  name: konflux-bot-0-rolebinding
   namespace: rhtas-tenant
 subjects:
   - kind: ServiceAccount
-    name: rhtas-build-bot
+    name: konflux-bot-0
     namespace: rhtas-tenant
 roleRef:
   kind: Role
-  name: rhtas-build-bot-role
+  name: konflux-bot-0-role
   apiGroup: rbac.authorization.k8s.io
 ---

konflux-configs/base/service-account/kustomization.yaml

@@ -2,5 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - promote-to-candidate-sa.yaml
-  - release-sa.yaml
+  - konflux-bot-0.yaml