Skip to content

sec: use default serviceaccount for tenantresources by default#2029

Open
oliverbaehler wants to merge 2 commits into
projectcapsule:mainfrom
oliverbaehler:sec/impersonation-default
Open

sec: use default serviceaccount for tenantresources by default#2029
oliverbaehler wants to merge 2 commits into
projectcapsule:mainfrom
oliverbaehler:sec/impersonation-default

Conversation

@oliverbaehler

Copy link
Copy Markdown
Collaborator
c

This is a breaking change and will be disclosed via docs. However we are flooded with Advisories (irrelevant) and this change invalidates all of them.

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
Copilot AI review requested due to automatic review settings July 14, 2026 10:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR updates the Capsule Helm chart defaults to enable TenantResource impersonation via a default ServiceAccount (default) out of the box, and aligns the chart schema/docs with that breaking default change.

Changes:

  • Sets manager.options.impersonation.tenantDefaultServiceAccount default to "default" in values.yaml.
  • Extends values.schema.json to recognize tenantDefaultServiceAccount under manager.options.impersonation.
  • Updates the chart README’s “changed values” table to reflect the new default impersonation object.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File Description
charts/capsule/values.yaml Enables a default TenantResource ServiceAccount under manager.options.impersonation.
charts/capsule/values.schema.json Adds the new tenantDefaultServiceAccount value to the Helm values schema.
charts/capsule/README.md Updates the documented default for the manager.options.impersonation value.

Comment on lines +308 to +312
# Default ServiceAccount for tenant resources (TenantResource) [Namespaced Scope]
# When defined, users are required to use this ServiceAccount anywhere in the cluster
# unless they explicitly provide their own. Once this is set, Capsule will add this ServiceAccount
# for all GlobalTenantResources, if they don't already have a ServiceAccount defined.
tenantDefaultServiceAccount: "default"
Comment on lines +476 to +478
"tenantDefaultServiceAccount": {
"type": "string"
}
Comment thread charts/capsule/README.md
| manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
| manager.options.ignoreUserWithGroups | list | `[]` | Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups. |
| manager.options.impersonation | object | `{}` | Impersonation |
| manager.options.impersonation | object | `{"tenantDefaultServiceAccount":"default"}` | Impersonation |
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants