Hey folks 👋 quick one on Flyte 2 (OSS backend, SDK 2.11.4) - is this a bug or expected? Setting the service account per run doesn't change the SA of the task pods. Neither of these works: - CLI:

flyte run --copy-style all --service-account my-sa workflow.py main --n 48

- SDK:

flyte.with_runcontext(service_account="my-sa").run(main)

In both cases: - the run spec stores it:

security_context.run_as.k8s_service_account: "my-sa"

- but the pod (and children) run as

default

, so no IRSA and S3 access fails From the source it looks like the executor only reads the SA from the task template (

extractSecurityContextFromTaskTemplate

in

executor/pkg/plugin/task_exec_metadata.go

), and nothing copies the run-level security context into actions. Same story with the

security.service_account

project setting:

flyte get settings

shows it, but

runs/service/settings_apply.go

only applies queue, max concurrency and pod template (RFC has it as Phase 3.2).

TaskEnvironment(service_account="my-sa")

works fine, so we're unblocked. Just want to know if the run-level/settings path is meant to work yet, or if I should open an issue. Thanks!

Could be a bug

mind opening a ticket, we will address it