how does service accwork in flyte, so you create anew namespace and a new SA on every project we create and then how does th trust identity is supposed to workas the oidc sub is based on namespace no?

hey Vikas So the

default

KSA comes with every K8s namespace and Flyte pods use it for executions (unless you indicate something different) So the IRSA Trust Relationship maps to

project-domain:default

yeah but i changed that in my helm to craete a new one with proper irsa

ah that works too

yeah its just that it was not using that so once i added default in my trust it worked

just for reference we also maintain Terraform that automates all the IRSA wiring https://github.com/unionai-oss/deploy-flyte/tree/main/environments/aws/flyte-core