From f96db79ea580e0230387210c0638b54ccdda2890 Mon Sep 17 00:00:00 2001
From: Brett Chien <brettchien@users.noreply.github.com>
Date: Thu, 27 Aug 2026 21:42:14 +0800
Subject: [PATCH] feat(console): wire list_service_accounts into New Fleet's
 k8s field group (studio#104)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fifth sub-item of #104, stacked on #108. Service account (optional) becomes
a <select> (was plain text) populated from list_service_accounts(context,
namespace) — unlike namespace, a service account must already exist for k8s
to accept it as a pod's serviceAccountName, so (unlike namespace's <input>+
<datalist>) a plain select with no free-text escape hatch is the right shape
here, matching context's treatment.

Reload triggers: context change (cascades into namespace + service-account
reload) and namespace field's "change" event (fires on blur/commit, not per
keystroke — avoids a tool call per character typed).

Per #104's design this tool's failures are deliberately silent — unlike
list_k8s_contexts/list_namespaces (which show a status message on failure),
any error here, including an RBAC-denied list (common against a scoped-down
cluster identity), just falls back to the "namespace default" option with no
status shown. The field is optional and the whole point of default-SA
fallback is that it's fine not to have a definitive answer here.

Verified locally: npm run typecheck clean, npm test 102/102, npm run build
succeeds.

Ref: studio#104.
---
 console/index.html    |  4 +++-
 console/src/deploy.ts | 45 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/console/index.html b/console/index.html
index ca357aa..6329d00 100644
--- a/console/index.html
+++ b/console/index.html
@@ -124,7 +124,9 @@
                 </label>
                 <label
                   >Service account (optional)
-                  <input id="deploy-k8s-service-account" class="compose-input" type="text" placeholder="defaults to the namespace's default SA" spellcheck="false" />
+                  <select id="deploy-k8s-service-account" class="compose-select">
+                    <option value="">— namespace default —</option>
+                  </select>
                 </label>
               </div>
               <div class="compose-actions">
diff --git a/console/src/deploy.ts b/console/src/deploy.ts
index e190f3b..5f3dc0d 100644
--- a/console/src/deploy.ts
+++ b/console/src/deploy.ts
@@ -46,6 +46,9 @@ interface K8sContextsResponse {
 interface K8sNamespacesResponse {
   namespaces: string[];
 }
+interface K8sServiceAccountsResponse {
+  service_accounts: string[];
+}
 
 export type DeployMode = { kind: "new-fleet" } | { kind: "add-instance"; fleetName: string };
 
@@ -97,6 +100,10 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
   // choice and a plain select can't express "not in this list yet".
   const k8sNamespaceInput = document.getElementById("deploy-k8s-namespace") as HTMLInputElement | null;
   const k8sNamespaceOptions = document.getElementById("deploy-k8s-namespace-options") as HTMLDataListElement | null;
+  // Service account, unlike namespace, must already exist for k8s to accept
+  // it as a pod's serviceAccountName — so (unlike namespace) a plain <select>
+  // is the right shape here, no free-text escape hatch needed.
+  const k8sServiceAccountSel = document.getElementById("deploy-k8s-service-account") as HTMLSelectElement | null;
   const identityStatusEl = document.getElementById("deploy-identity-status");
   const composeSection = document.getElementById("deploy-compose");
   const composeHeading = document.getElementById("deploy-compose-heading");
@@ -125,6 +132,7 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     !k8sContextSel ||
     !k8sNamespaceInput ||
     !k8sNamespaceOptions ||
+    !k8sServiceAccountSel ||
     !composeSection ||
     !tmplSel ||
     !ovlSel ||
@@ -189,6 +197,35 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     }
   };
 
+  // Service account is scoped to (context, namespace) and per #104's design
+  // fails *silently* — unlike context/namespace, any error here (including an
+  // RBAC-denied list, which is common against a scoped-down cluster identity)
+  // means "leave it unset" (the namespace's default service account applies),
+  // not something worth surfacing a status message for.
+  const loadK8sServiceAccounts = async (): Promise<void> => {
+    const defaultOption = '<option value="">— namespace default —</option>';
+    const invoke = tauriInvoke();
+    const namespace = k8sNamespaceInput.value.trim();
+    if (!invoke || !namespace) {
+      k8sServiceAccountSel.innerHTML = defaultOption;
+      return;
+    }
+    const context = k8sContextSel.value || undefined;
+    try {
+      const res = await invoke<K8sServiceAccountsResponse>(
+        "list_service_accounts",
+        context ? { context, namespace } : { namespace },
+      );
+      k8sServiceAccountSel.innerHTML =
+        defaultOption +
+        res.service_accounts
+          .map((sa) => `<option value="${escapeHtml(sa)}">${escapeHtml(sa)}</option>`)
+          .join("");
+    } catch {
+      k8sServiceAccountSel.innerHTML = defaultOption;
+    }
+  };
+
   const loadK8sContexts = async (): Promise<void> => {
     const invoke = tauriInvoke();
     if (!invoke) return;
@@ -210,7 +247,13 @@ export function initDeployPanel(deps: DeployPanelDeps): DeployPanelHandle | null
     showProviderFields(providerSel.value);
     if (providerSel.value === "k8s") void loadK8sContexts();
   });
-  k8sContextSel.addEventListener("change", () => void loadK8sNamespaces());
+  k8sContextSel.addEventListener("change", () => {
+    void loadK8sNamespaces();
+    void loadK8sServiceAccounts();
+  });
+  // "change" (fires on commit/blur), not "input" (every keystroke) — avoids a
+  // tool call per character typed into the namespace field.
+  k8sNamespaceInput.addEventListener("change", () => void loadK8sServiceAccounts());
 
   const loadLibraryAndPickers = async (): Promise<void> => {
     const invoke = tauriInvoke();