#Triggers Default ServiceAccount

On Kubernetes, omitting spec.serviceAccountName or setting it to an empty string on a new EventListener selects triggers-default-sa. The enhancement RBAC controller provisions this account in eligible namespaces. On OpenShift, the existing platform default remains pipeline.

#Override or Restore the Default

Configure the existing TektonConfig field rather than editing the managed config-defaults-triggers ConfigMap directly:

apiVersion: operator.tekton.dev/v1alpha1
kind: TektonConfig
metadata:
  name: config
spec:
  trigger:
    default-service-account: custom-trigger-sa

The operator propagates the effective value to config-defaults-triggers, which both Triggers and the enhancement RBAC controller read. Explicit nonempty values, including default, are preserved. Additional options for the same ConfigMap continue to take precedence over this field, including an explicit empty option value. Remove that override as well when restoring the platform default.

Removing spec.trigger.default-service-account, or setting it to an empty string, restores the platform default. On Kubernetes, the effective ConfigMap key remains present with the value triggers-default-sa; deletion of that key is not the definition of a successful reset.

#Upgrade Compatibility

• Existing EventListeners keep their stored, nonempty ServiceAccount names. The operator does not migrate all listeners that currently use default.
• For a confirmed listener failure caused by the old implicit default account, review its intended permissions before explicitly changing its account.
• If the old default is required, explicitly set spec.trigger.default-service-account: default and ensure that account has the necessary permissions. This setting does not grant permissions by itself when automatic RBAC provisioning is disabled or the namespace is excluded.
• Before upgrading, review ConfigMap-only customizations and express intentional values in TektonConfig or its additional options. Do not automatically adopt unexplained old values: they may be stale configuration.
• When automatic RBAC provisioning is disabled, or in an excluded namespace, explicitly select an existing account with the required permissions.
• EventListener account defaulting does not change PipelineRun or TaskRun account selection.

#Configuration Withdrawal

Overrides in spec.trigger.options.configMaps are removed from the installed ConfigMap when withdrawn, including overrides present at first installation. For a packaged ConfigMap such as config-defaults-triggers, removing the options data, leaving an empty ConfigMap options entry, or removing that entry restores the current declared settings. Explicit empty option values remain overrides until removed. For an additional ConfigMap created only by options, keep its entry and withdraw individual data keys to remove those managed values. Removing that additional object's entire entry retains the existing InstallerSet resource lifecycle behavior; it does not guarantee deletion of the previously installed ConfigMap or its data.

For older installations, the operator uses the previous InstallerSet declarations to identify managed data keys. Other keys added directly by an administrator are preserved. If an older version has already lost both the prior declaration and its application history, an unexplained ConfigMap-only value cannot be identified as a withdrawn override automatically. Review such values against the intended configuration and remove only confirmed obsolete entries.