From dd93db40bc244301edd7d002c94b4e77a385a559 Mon Sep 17 00:00:00 2001
From: Jesse Bye <8467862+jessebye@users.noreply.github.com>
Date: Fri, 12 Sep 2025 14:37:29 -0700
Subject: [PATCH] =?UTF-8?q?=E2=9B=91=EF=B8=8F=20feat:=20Helm=20`serviceAcc?=
 =?UTF-8?q?ount`=20Config=20(#9606)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 helm/librechat/templates/deployment.yaml     |  1 +
 helm/librechat/templates/serviceaccount.yaml | 13 +++++++++++++
 helm/librechat/values.yaml                   | 11 +++++++++++
 3 files changed, 25 insertions(+)
 create mode 100644 helm/librechat/templates/serviceaccount.yaml

diff --git a/helm/librechat/templates/deployment.yaml b/helm/librechat/templates/deployment.yaml
index 9f6e4f624f..492edafdb9 100755
--- a/helm/librechat/templates/deployment.yaml
+++ b/helm/librechat/templates/deployment.yaml
@@ -30,6 +30,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      serviceAccountName: {{ include "librechat.serviceAccountName" . }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:
diff --git a/helm/librechat/templates/serviceaccount.yaml b/helm/librechat/templates/serviceaccount.yaml
new file mode 100644
index 0000000000..983f9069f9
--- /dev/null
+++ b/helm/librechat/templates/serviceaccount.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "librechat.serviceAccountName" . }}
+  labels:
+    {{- include "librechat.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+{{- end }}
diff --git a/helm/librechat/values.yaml b/helm/librechat/values.yaml
index f14b5e2272..f290766d1b 100755
--- a/helm/librechat/values.yaml
+++ b/helm/librechat/values.yaml
@@ -115,6 +115,17 @@ imagePullSecrets: []
 nameOverride: ""
 fullnameOverride: ""
 
+# This section builds out the service account more information can be found here: https://kubernetes.io/docs/concepts/security/service-accounts/
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Automatically mount a ServiceAccount's API credentials?
+  automount: true
+  # Annotations to add to the service account
+  annotations: {}
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
 
 lifecycle: {}
 # # base for adding a custom banner // see https://github.com/danny-avila/LibreChat/pull/3952 for an example