<p>As part of my applications helm chart I have a Job which runs database migrations. I’ve annotated the job with the hook <code>&quot;helm.sh/hook&quot;: pre-install,pre-upgrade</code> to ensure migrations are ran before the application is deployed. I want to use the same service account and config-map that my application deployment uses, however these resources have not been created at the time the job is executed resulting in the following error:</p>
<p><code>Warning  FailedCreate  8s    job-controller  Error creating: pods &quot;db-migrate-&quot; is forbidden: error looking up service account dev-platform/platform: serviceaccount &quot;platform&quot; not found</code></p>
<p>According to the helm installation <a href="https://github.com/helm/helm/blob/9ad53aac42165a5fadc6c87be0dea6b115f93090/pkg/tiller/kind_sorter.go#L29" rel="nofollow noreferrer">order</a> the service account and config map should be created before the job. Is the behaviour nullified when running the job as <code>pre-install</code>?:</p>
<pre><code>apiVersion: batch/v1
kind: Job
metadata:
  namespace: dev-platform
  name: db-migrate
  annotations:
    &quot;helm.sh/hook&quot;: pre-install,pre-upgrade
    &quot;helm.sh/hook-delete-policy&quot;: hook-succeeded
spec:
  activeDeadlineSeconds: 300
  backoffLimit: 1
  template:
    spec:
      # Share platform service account IAM role.
      serviceAccountName: {{ .Release.Name }}
      securityContext:
        fsGroup: 65534 #  Allow read permissions of AWS token files for IAM service account token.
      restartPolicy: Never
      containers:
        - name: db-migrate
          image: &quot;{{ .Values.image.repository }}:{{ .Values.image.tag }}&quot;
          imagePullPolicy: {{ .Values.image.pullPolicy }}
          envFrom:
            - configMapRef:
                name: platform-config
            - secretRef:
                name: platform-secrets
          # Overwrite APP_COMMAND variable.
          env:
            - name: APP_COMMAND
              value: migrate
            - name: APP_ENVIRONMENT
              value: {{ .Values.image.appEnvironment | quote }}
</code></pre>

James Downing
<p>Helm hooks are not limited to Jobs.</p>
<p>You can create the serviceaccount and configmap in the pre-install phase itself using the same helm-hook annotation as the Job.</p>
<p>Note: If you need the serviceaccount and configmap available after the pre-install phase, do not set the 'helm.sh/hook-delete-policy' to 'hook-succeeded'.</p>
<p>Example:</p>
<pre><code>apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: my-sa    
    annotations:
      helm.sh/hook: pre-install
      helm.sh/hook-delete-policy: before-hook-creation
      helm.sh/hook-weight: &quot;-10&quot;
</code></pre>
