service-account-ref.yaml

apiVersion: kubevious.io/v1alpha1
kind: ClusterRule
metadata:
  name: pod-spec-service-account-ref
spec:
  summary: |
    Validate PodSpec to ServiceAccount reference.
  categories:
    - k8s
    - pod-spec
    - service-account
    - reference
  target: |
    Shortcut("PodSpec")
  rule: |
    const serviceAccountName = config.spec?.serviceAccountName ?? "default";
    const serviceAccount = ApiVersion('v1')
                              .Kind('ServiceAccount')
                              .name(serviceAccountName)
                              .single();

    if (!serviceAccount)
    {
      if (serviceAccountName !== "default")
      {
        error(`Could not find ServiceAccount ${serviceAccountName}`);
      }
    }