tbot helm chart does not create role and rolebinding

[maximumG]

Expected behavior:

We are deploying a tbot agent using the official helm with the following values to avoid the serviceAccount creation.

  clusterName: "teleport.example.com"
  teleportProxyAddress: "teleport.example.com:443"
  joinMethod: gcp
  token: teleport.example.com
  serviceAccount:
    create: false # the SA is already created by some other chart that enables GCP workloadIdentity
    name: "teleport.example.com"

Even if the serviceAccount.create is set to false we would expect that the Role and RoleBinding objects are still created by the chart. I believe the SA creation switch should not be linked to the Role and RoleBinding creation.

Current behavior:

If we set serviceAccount.create: false in the tbot chart, the Role and RoleBinding are not created. Thus the SA cannot update Kubernetes Secrets.

Bug details:

Teleport version:

16.4.3

Recreation steps

Use the following helm values in a file named myvalues.yaml

  clusterName: "teleport.example.com"
  teleportProxyAddress: "teleport.example.com:443"
  joinMethod: gcp
  token: teleport.example.com
  serviceAccount:
    create: false # the SA is already created by some other chart that enables GCP workloadIdentity
    name: "teleport-bot"

Install the helm chart using the following command

helm install tbot teleport/tbot --version 116.4.3 --values myvalues.yaml

if the GCP authentication is successful again Teleport, tbot will complain that its missing permission to update K8S secret.

Debug logs

ERROR: secrets "teleport-example-tbot" is forbidden: User "system:serviceaccount:teleport-example:teleport-bot" cannot get resource "secrets" in API group "" in the namespace "teleport-example