sec: use default serviceaccount for tenantresources by default (#2029)

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>

charts/capsule/README.md

@@ -135,7 +135,7 @@ The following Values have changed key or Value:
 | manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
 | manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
 | manager.options.ignoreUserWithGroups | list | `[]` | Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups. |
-| manager.options.impersonation | object | `{}` | Impersonation |
+| manager.options.impersonation | object | `{"tenantDefaultServiceAccount":"default"}` | Impersonation |
 | manager.options.labels | object | `{}` | Additional labels to add to the CapsuleConfiguration resource |
 | manager.options.leaderElection.enabled | bool | `true` | Enable Leader Election for capsule controller |
 | manager.options.leaderElection.leaseDuration | string | `""` | Leader election lease duration. Empty uses controller-runtime's default. |

charts/capsule/values.schema.json

@@ -471,7 +471,13 @@
                         },
                         "impersonation": {
                             "description": "Impersonation",
-                            "type": "object"
+                            "type": "object",
+                            "properties": {
+                                "tenantDefaultServiceAccount": {
+                                    "type": "string"
+                                }
+                            },
+                            "additionalProperties": true
                         },
                         "labels": {
                             "description": "Additional labels to add to the CapsuleConfiguration resource",

charts/capsule/values.yaml

@@ -300,8 +300,17 @@ manager:
       deleter: capsule-namespace-deleter
       # -- Name for the ClusterRole required to grant Namespace Provision permissions.
       provisioner: capsule-namespace-provisioner
+
+    # @schema type: object
+    # @schema additionalProperties: true
     # -- Impersonation
-    impersonation: {}
+    impersonation:
+      # Default ServiceAccount for tenant resources (TenantResource) [Namespaced Scope]
+      # When defined, users are required to use this ServiceAccount anywhere in the cluster
+      # unless they explicitly provide their own. Once this is set, Capsule will add this ServiceAccount
+      # for all GlobalTenantResources, if they don't already have a ServiceAccount defined.
+      tenantDefaultServiceAccount: "default"
+
     # Tracing Configuration
     tracing:
       # -- Enable OpenTelemetry tracing for admission webhook requests.