Flux CD
Medium
Security
How can a Kustomization apply resources with a tenant's limited permissions instead of kustomize-controller's own?
Select your answer:
Show answer and explanation
Answer: Set spec.serviceAccountName, which the controller then impersonates
Explanation
kustomize-controller impersonates the named ServiceAccount when applying, so the tenant can only create what that account's RBAC allows. Platform admins can set --default-service-account so Kustomizations without the field still get a restricted account.
More medium Flux CD questions
- What does 'flux diff kustomization my-app --path ./apps/my-app' show?
- How can a HelmRelease take its Helm values from a ConfigMap or Secret?
- Which HelmRelease setting makes helm-controller retry a failed first install?
- What does driftDetection.mode: enabled do on a HelmRelease?
- Which Flux objects work together to update an image tag in Git when a new version is pushed to a registry?
- How does image-automation-controller know which field in a YAML file to update?