Velero Fails to Retrieve Annotation Values for Service Account Creation when Deployed with Helm

[felipesierrae]

Installed and configured Helm on my local machine. Added the Velero Helm repository. Deployed Velero using Helm with a values.yaml

However, upon deployment, Velero created the service account successfully but did not apply the annotations specified in the Helm values.yaml file.

image:
  repository: velero/velero
  tag: v1.11.0
  pullPolicy: IfNotPresent
  imagePullSecrets: []
annotations: {}
labels: {}
podAnnotations:
podLabels: {}
resources:
  requests:
    cpu: 500m
    memory: 128Mi
  limits:
    cpu: 1000m
    memory: 512Mi
dnsPolicy: ClusterFirst
initContainers:
  - name: velero-plugin-for-aws
    image: velero/velero-plugin-for-aws:v1.7.0
    imagePullPolicy: IfNotPresent
    volumeMounts:
      - mountPath: /target
        name: plugins
podSecurityContext: {}
containerSecurityContext: {}
lifecycle: {}
priorityClassName: ""
terminationGracePeriodSeconds: 3600
tolerations: []
affinity: {}
nodeSelector: {}
dnsConfig: {}
extraVolumes: []
extraVolumeMounts: []
extraObjects: []
metrics:
  enabled: true
  scrapeInterval: 30s
  scrapeTimeout: 10s
  service:
    annotations: {}
    labels: {}
  podAnnotations:
    prometheus.io/scrape: "true"
    prometheus.io/port: "8085"
    prometheus.io/path: "/metrics"

  serviceMonitor:
    autodetect: true
    enabled: false
    annotations: {}
    additionalLabels: {}
  nodeAgentPodMonitor:
    autodetect: true
    enabled: false
    annotations: {}
    additionalLabels: {}
  prometheusRule:
    enabled: false
    additionalLabels: {}
    spec: []
kubectl:
  image:
    repository: docker.io/bitnami/kubectl
  containerSecurityContext: {}
  resources: {}
  annotations: {}
  labels: {}
upgradeCRDs: true
cleanUpCRDs: false
configuration:
  backupStorageLocation:
  - name: aws
    provider: aws
    bucket: velero-xxxxxxxxxx
    caCert:
    prefix:
    default: true
    accessMode: ReadWrite
    credential:
      name:
      key:
    config:
      region: us-east-1
  volumeSnapshotLocation:
  - name: aws
    provider: aws
    config:
      region: us-east-1
  uploaderType:
  backupSyncPeriod:
  fsBackupTimeout:
  clientBurst:
  clientPageSize:
  clientQPS:
  defaultBackupStorageLocation:
  defaultBackupTTL:
  defaultVolumeSnapshotLocations:
  disableControllers:
  garbageCollectionFrequency:
  logFormat:
  logLevel:
  metricsAddress:
  pluginDir:
  profilerAddress:
  restoreOnlyMode:
  restoreResourcePriorities:
  storeValidationFrequency:
  terminatingResourceTimeout:
  features:
  namespace:
  extraEnvVars: {}
  defaultVolumesToFsBackup:
  defaultRepoMaintainFrequency:
rbac:
  create: true
  clusterAdministrator: true
  clusterAdministratorName: cluster-admin
serviceAccount:
  server:
    create: true
    name: velero-server
    annotations:
      eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxx:role/velero-role
    labels:
credentials:
  useSecret: false
  name:
  existingSecret:
  secretContents: {}
  extraEnvVars: {}
  extraSecretRef: ""
backupsEnabled: true
snapshotsEnabled: true
deployNodeAgent: false
nodeAgent:
  podVolumePath: /var/lib/kubelet/pods
  privileged: false
  priorityClassName: ""
  resources:
    requests:
      cpu: 500m
      memory: 512Mi
    limits:
      cpu: 1000m
      memory: 1024Mi
  tolerations: []
  annotations: {}
  labels: {}
  useScratchEmptyDir: true
  extraVolumes: []
  extraVolumeMounts: []
  extraEnvVars: {}
  dnsPolicy: ClusterFirst
  podSecurityContext:
    runAsUser: 0
  containerSecurityContext: {}
  lifecycle: {}
  nodeSelector: {}
  affinity: {}
  dnsConfig: {}
schedules: {}
configMaps: {}

Anything else you would like to add: I would like to mention that I have confirmed the issue on my local machine and it persists across different environments. Additionally, I have verified that the annotations section in the values.yaml file is correctly formatted and follows the recommended syntax.

[jenting]

@felipesierrae Interested, we did handling the service account annotations.

Also, I copy your values.yaml and run helm template locally, the service account velero-server and velero-server-upgrade-crds both contain the annotations eks.amazonaws.com/role-arn: arn:aws:iam::xxxxxxxx:role/velero-role.