ROSAENG-64532: remove CDO ServiceAccount SSS (fixes OHSS-58441)

[aliceh]

Summary

Delete the osd-serviceaccounts/aws SSS that creates a ServiceAccount in namespace: openshift-custom-domains-operator.

Same class of failure as the rebalancer RoleBinding (PR #2878): Hive tries to create a resource in a namespace that no longer exists after CDO Phase 1 removal, causing ClusterSync failure and blocking LS auto-clear on hibernation resume.

The file contains only the CDO ServiceAccount — no other resources are affected.

Companion to PR #2878 (RoleBinding removal). Together these are the only two MCC SSS resources that create objects inside the CDO namespace.

Test plan

• CI passes
• Verify ClusterSync no longer fails on AWS clusters where CDO namespace is absent

Made with Cursor

Summary by CodeRabbit

• Chores
  • Removed the custom domains operator service account from the AWS service-account manifest.
  • Removed the AWS-specific synchronization configuration.
  • Updated documentation to no longer describe selected operators as AWS-specific.

[openshift-ci-robot]

@aliceh: This pull request references ROSAENG-64532 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

Summary

Delete the osd-serviceaccounts/aws SSS that creates a ServiceAccount in namespace: openshift-custom-domains-operator.

Same class of failure as the rebalancer RoleBinding (PR #2878): Hive tries to create a resource in a namespace that no longer exists after CDO Phase 1 removal, causing ClusterSync failure and blocking LS auto-clear on hibernation resume.

The file contains only the CDO ServiceAccount — no other resources are affected.

Companion to PR #2878 (RoleBinding removal). Together these are the only two MCC SSS resources that create objects inside the CDO namespace.

Test plan

• CI passes
• Verify ClusterSync no longer fails on AWS clusters where CDO namespace is absent

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 107d5d15-767c-4e97-b3a7-220d94a2874c

📥 Commits

Reviewing files that changed from the base of the PR and between 0599983 and 2fb5400.

⛔ Files ignored due to path filters (3)

• hack/00-osd-managed-cluster-config-integration.yaml.tmpl is excluded by !hack/**
• hack/00-osd-managed-cluster-config-production.yaml.tmpl is excluded by !hack/**
• hack/00-osd-managed-cluster-config-stage.yaml.tmpl is excluded by !hack/**

📒 Files selected for processing (3)

• deploy/osd-serviceaccounts/aws/00-serviceaccounts.yaml
• deploy/osd-serviceaccounts/aws/README.md
• deploy/osd-serviceaccounts/aws/config.yaml

💤 Files with no reviewable changes (3)

• deploy/osd-serviceaccounts/aws/README.md
• deploy/osd-serviceaccounts/aws/00-serviceaccounts.yaml
• deploy/osd-serviceaccounts/aws/config.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The AWS service account sync configuration was deleted. The custom-domains-operator ServiceAccount was removed from the AWS manifest. The README no longer describes the strategy as AWS-specific for selected operators.

Changes

AWS service account strategy cleanup

Layer / File(s)	Summary
Remove AWS service account strategy deploy/osd-serviceaccounts/aws/...	The AWS SelectorSyncSet configuration and custom-domains-operator ServiceAccount were removed. The README no longer states that the strategy is AWS-specific for some operators.

Priority: ➖ Normal

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 2fb54

The obsolete AWS service-account sync configuration and its generated templates were removed without leaving deployment references behind. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the main change: removal of the CDO ServiceAccount SelectorSyncSet. It also references the related issue.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request changes only YAML deployment manifests and templates. The authoritative diff contains no Ginkgo test declarations or test-title expressions, and no test files changed. Therefore…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only YAML/README/template configuration files. The authoritative diff contains no Ginkgo test files or test constructs such as It, BeforeEach, AfterEach, Eventually, Con…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The authoritative diff only deletes the AWS ServiceAccount SSS files and removes the corresponding SelectorSyncSet blocks from three YAML templates. No…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The pull request adds no Ginkgo e2e tests. The authoritative diff contains only deletions from YAML, Markdown, and template configuration files. No added It(), Describe(), Context(), or When() declara…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS. The authoritative diff contains only deletions across the AWS ServiceAccount SSS and its three generated templates. It adds no scheduling fields or workload-placement constraints. The removed re…
Ote Binary Stdout Contract	✅ Passed	The pull request changes only YAML/README deployment content. The diff removes the CDO ServiceAccount and its AWS SelectorSyncSet from three generated templates and deletes the related deployment file…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request adds no Ginkgo e2e tests or other test code. The authoritative diff contains only deletions of the AWS ServiceAccount SSS and its generated template entries. Therefore, the IPv4 and e…
No-Weak-Crypto	✅ Passed	The pull request only deletes the AWS ServiceAccount SSS, its README/configuration, and matching generated template blocks. The deleted resources contain no cryptographic algorithms, comparisons, secr…
Container-Privileges	✅ Passed	PASS: The pull request only deletes the AWS CDO ServiceAccount and its SelectorSyncSet, plus the matching generated template entries. The changed lines add no privileged, host namespace, SYS_ADMIN…
No-Sensitive-Data-In-Logs	✅ Passed	The pull request adds no lines. It deletes the AWS ServiceAccount SSS, its README and config, and the matching embedded SelectorSyncSet from three templates. The diff introduces no logging code or sen…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@aliceh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[dustman9000]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: aliceh, dustman9000

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [dustman9000]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment