From b33b8004c04e567dbd25449b95485c7c5672cf6f Mon Sep 17 00:00:00 2001
From: Mateusz <m4itee@bularz.net>
Date: Fri, 3 Jul 2026 13:55:58 +0200
Subject: [PATCH] feat(serviceAccount): support custom annotations on the
 service account

Add a serviceAccount.annotations value and render it onto the ServiceAccount
metadata. Enables setting annotations natively (e.g. an AWS IRSA
eks.amazonaws.com/role-arn) instead of patching the chart-created SA after
install. Defaults to {} so existing releases are unaffected.
---
 charts/netdata/README.md                     | 9 +++++++++
 charts/netdata/templates/serviceaccount.yaml | 4 ++++
 charts/netdata/values.yaml                   | 3 +++
 3 files changed, 16 insertions(+)

diff --git a/charts/netdata/README.md b/charts/netdata/README.md
index 5e3c807d..ca7a524b 100644
--- a/charts/netdata/README.md
+++ b/charts/netdata/README.md
@@ -458,6 +458,15 @@ true
 </td>
 			<td>The name of the service account to use. If not set and create is true, a name is generated using the fullname template</td>
 		</tr>
+		<tr>
+			<td>serviceAccount.annotations</td>
+			<td>object</td>
+			<td><pre lang="json">
+{}
+</pre>
+</td>
+			<td>Annotations to add to the service account (e.g. an AWS IRSA `eks.amazonaws.com/role-arn`)</td>
+		</tr>
 		<tr>
 			<td>restarter.enabled</td>
 			<td>bool</td>
diff --git a/charts/netdata/templates/serviceaccount.yaml b/charts/netdata/templates/serviceaccount.yaml
index 5543c985..34f94554 100644
--- a/charts/netdata/templates/serviceaccount.yaml
+++ b/charts/netdata/templates/serviceaccount.yaml
@@ -10,4 +10,8 @@ metadata:
     heritage: {{ .Release.Service }}
   name: {{ .Values.serviceAccount.name }}
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 {{- end -}}
diff --git a/charts/netdata/values.yaml b/charts/netdata/values.yaml
index 1bf9777c..6482c07b 100644
--- a/charts/netdata/values.yaml
+++ b/charts/netdata/values.yaml
@@ -174,6 +174,9 @@ serviceAccount:
   # -- The name of the service account to use. If not set and create is true, a name is generated using the fullname template
   # @section -- General settings
   name: netdata
+  # -- Annotations to add to the service account (e.g. an AWS IRSA `eks.amazonaws.com/role-arn`)
+  # @section -- General settings
+  annotations: {}
 
 restarter:
   # -- Install CronJob to update Netdata Pods