Upgrading HAProxy Ingress Controller to v1.49.0 fails with pre-upgrade hook timeout:

[itsikbar]

Root Cause

The CRD pre-upgrade hook job runs before main resources are created. When upgrading with --reset-values, the chart expects ServiceAccount name ingress-kubernetes-ingress (default), but the existing ServiceAccount is ingress-haproxy-ingress-controller from the previous installation. The hook job fails because it cannot find the expected ServiceAccount.

Error: UPGRADE FAILED: pre-upgrade hooks failed: 1 error occurred:
* timed out waiting for the condition

Error creating: pods "ingress-kubernetes-ingress-crdjob-6-" is forbidden: 
error looking up service account mi-ingress-controller/ingress-kubernetes-ingress: 
serviceaccount "ingress-kubernetes-ingress" not found

[dkorunic]

This belongs to a Helm Chart project page. I'll draft a fix -- root cause is a deadlock caused by upgrade with --reset-values from a Chart whose fullname produced a different SA. Pre-upgrade job however points to a SA name that doesn't exist yet as the new SA only gets created during the upgrade process which is gated on hook success.

[dkorunic]

Implemented a fix in haproxytech/helm-charts@aa936d3. Still needs further testing and full CI pipeline run.