<p>I have a helm chart that I use to add a list of users to my cluster, but I would like to modify my <code>default</code> service account to include an image pull secret. There doesn't seem to be any patch functionality in helm.</p>

<p>Is a post-install hook the best I can do?</p>

<p>I had the same issue. What I did is:</p>

<pre><code>apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: default
  namespace: YOUR_NAMESPACE
rules:
- apiGroups:
  - ""
  resources:
  - serviceaccounts
  verbs:
  - get
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: default
  namespace: YOUR_NAMESPACE
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: default
subjects:
- kind: ServiceAccount
  name: default
  namespace: YOUR_NAMESPACE
</code></pre>

<p>and then:</p>

<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  name: create-image-pull-secret
  annotations:
    "helm.sh/hook": pre-install
    "helm.sh/hook-delete-policy": hook-succeeded
spec:
  template:
    spec:
      restartPolicy: Never
      containers:
      - name: k8s
        image: google/cloud-sdk
        imagePullPolicy: IfNotPresent
        command: ["/bin/sh","-c", "kubectl patch serviceaccount default -p '{\"imagePullSecrets\": [{\"name\": \"YOUR_SECRET_NAME\"}]}'"]
</code></pre>

<p>Note that I use a <code>pre-install</code> hook. I did that because I needed the imagePullSecret working for my child dependencies. Also, the patch command allowed to use a secret name that doesn't exist yet.</p>
