# How can a Kustomization apply resources with a tenant's limited permissions instead of kustomize-controller's own?

Flux CD, Medium (Advanced), Security. https://k8wiz.com/uquiz/how-can-a-kustomization-apply-resources-with-a-tenants-limited-permissions-instead-of-kustomize-controllers-own

- A. Set spec.serviceAccountName, which the controller then impersonates
- B. Set spec.targetNamespace, which limits the controller to that namespace
- C. Add an RBAC Role to the GitRepository the Kustomization reads
- D. Run a separate kustomize-controller in every tenant namespace

**Answer:** Set spec.serviceAccountName, which the controller then impersonates

**Explanation:** kustomize-controller impersonates the named ServiceAccount when applying, so the tenant can only create what that account's RBAC allows. Platform admins can set --default-service-account so Kustomizations without the field still get a restricted account.