From c50901f68dc0403e9c81f8db8f55251abe383c2d Mon Sep 17 00:00:00 2001
From: Oliver Baehler <oliver@sudo-i.net>
Date: Tue, 14 Jul 2026 12:08:25 +0200
Subject: [PATCH] sec: use default serviceaccount for tenantresources by
 default

Signed-off-by: Oliver Baehler <oliver@sudo-i.net>
---
 charts/capsule/README.md          | 2 +-
 charts/capsule/values.schema.json | 8 +++++++-
 charts/capsule/values.yaml        | 9 ++++++++-
 3 files changed, 16 insertions(+), 3 deletions(-)

diff --git a/charts/capsule/README.md b/charts/capsule/README.md
index 6a705a580..e89b8325d 100644
--- a/charts/capsule/README.md
+++ b/charts/capsule/README.md
@@ -135,7 +135,7 @@ The following Values have changed key or Value:
 | manager.options.forceTenantPrefix | bool | `false` | Boolean, enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix, separated by a dash |
 | manager.options.generateCertificates | bool | `true` | Specifies whether capsule webhooks certificates should be generated by capsule operator |
 | manager.options.ignoreUserWithGroups | list | `[]` | Define groups which when found in the request of a user will be ignored by the Capsule this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups. |
-| manager.options.impersonation | object | `{}` | Impersonation |
+| manager.options.impersonation | object | `{"tenantDefaultServiceAccount":"default"}` | Impersonation |
 | manager.options.labels | object | `{}` | Additional labels to add to the CapsuleConfiguration resource |
 | manager.options.logLevel | string | `"info"` | Set the log verbosity of the capsule with a value from 1 to 5 |
 | manager.options.nodeMetadata | object | `{"forbiddenAnnotations":{"denied":[],"deniedRegex":""},"forbiddenLabels":{"denied":[],"deniedRegex":""}}` | Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant |
diff --git a/charts/capsule/values.schema.json b/charts/capsule/values.schema.json
index c8bfb1241..f93d19677 100644
--- a/charts/capsule/values.schema.json
+++ b/charts/capsule/values.schema.json
@@ -474,7 +474,13 @@
                         },
                         "impersonation": {
                             "description": "Impersonation",
-                            "type": "object"
+                            "type": "object",
+                            "properties": {
+                                "tenantDefaultServiceAccount": {
+                                    "type": "string"
+                                }
+                            },
+                            "additionalProperties": true
                         },
                         "labels": {
                             "description": "Additional labels to add to the CapsuleConfiguration resource",
diff --git a/charts/capsule/values.yaml b/charts/capsule/values.yaml
index 0eb842b4f..6f0579ed6 100644
--- a/charts/capsule/values.yaml
+++ b/charts/capsule/values.yaml
@@ -293,8 +293,15 @@ manager:
       # -- Name for the ClusterRole required to grant Namespace Provision permissions.
       provisioner: capsule-namespace-provisioner
 
+    # @schema type: object
+    # @schema additionalProperties: true
     # -- Impersonation
-    impersonation: {}
+    impersonation:
+      # Default ServiceAccount for tenant resources (TenantResource) [Namespaced Scope]
+      # When defined, users are required to use this ServiceAccount anywhere in the cluster
+      # unless they explicitly provide their own. Once this is set, Capsule will add this ServiceAccount
+      # for all GlobalTenantResources, if they don't already have a ServiceAccount defined.
+      tenantDefaultServiceAccount: "default"
 
     # -- DEPRECATED: use users properties.
     # Names of the users considered as Capsule users.