How to set a Default Kubernetes Service account globally or for different Teams/Organisation for pods made by the woodpecker agent

[Lite5h4dow]

i have a large amount of pipelines that all need the same access. i do not want to have to add the access to the default role (if i absolutely dont have to) and would prefer to set the service account to use for individual orgs.

is this or setting the global service account used for all pods made by woodpecker agents possible? if so, how do?

[zc-devs]

Currently Woodpecker can set service account per step/pod only.

global service account used for all pods

You can change default service account in namespace.

for different Teams/Organisation

Make Agent and namespace per Team/Org, change default service account (see previous answer). The tricky part is how to assign pipelines to Agents. If you manage it somehow by labels, then done.

[Lite5h4dow]

So, for teams and organisation that doesn't solve the problem like at all. How on earth does that apply to the forges organizations? (It doesn't) And I don't want to put it in every single step, A it's insecure as if anyone can see the git repo, they know exactly which service account to target in the k8s cluster for privilege elevation. B. I don't think you understand how many pipelines I have. Adding them to every single step would genuinely be a nightmare.

[qwerty287]

closing as no new response