Is there an existing issue already for this bug?

• I have searched for an existing issue, and could not find anything. I believe this is a new bug.

I have read the troubleshooting guide

• I have read the troubleshooting guide and I think this is a new bug.

I am running a supported version of CloudNativePG

• I have read the troubleshooting guide and I think this is a new bug.

Contact Details

No response

Version

1.28 (latest patch)

What version of Kubernetes are you using?

1.34

What is your Kubernetes environment?

Self-managed: kind (evaluation)

How did you install the operator?

YAML manifest

What happened?

When creating a new Pooler resource, the ServiceAccount is created without the default imagePullSecret, causing pooler pod failures when pulling images from private registries.

Root Cause

In internal/controller/pooler_update.go at line 238, when creating a new ServiceAccount, the code incorrectly passes resources.ServiceAccount (which is nil) instead of the local serviceAccount variable to ensureServiceAccountHaveImagePullSecret():

if resources.ServiceAccount == nil {
    serviceAccount := pgbouncer.ServiceAccount(pooler)
    ensureServiceAccountHaveImagePullSecret(resources.ServiceAccount, pullSecretName)  // BUG: passing nil
    contextLog.Info("Creating service account")
    // ...
}

Since ensureServiceAccountHaveImagePullSecret has a nil check that returns early:

func ensureServiceAccountHaveImagePullSecret(serviceAccount *corev1.ServiceAccount, pullSecretName string) {
    if serviceAccount == nil || pullSecretName == "" {
        return  // Returns immediately when serviceAccount is nil
    }
    // ... never reached
}

The pull secret is never added to the ServiceAccount.

Cluster resource

Relevant log output

Code of Conduct

• I agree to follow this project's Code of Conduct