Migration to 1.27+
service_account_roles configuration was cleaned-up in MACMA’s helmchart definition.
The only role required to be assigned to MACMA is Web Portal Registration. Any other roles should be unassigned from MACMA, unless there are other known reasons to keep the assignments.
Keycloak
If you are updating from a version before 1.26, keep in mind that in 1.26 the name of the stateful-set in the helmchart was changed from keycloak to keycloak-22 (and consequently the name of the generated kubernetes stateful-set is now keycloak-22-statefulset).
This is important in case there are any helm configurations overridden for Keycloak for a specific installation.