{{- if and .Values.ingress .Values.ingress.marketplace .Values.ingress.marketplace.enabled -}}
# Dedicated ServiceAccount per SME microservice.
#
# The `default` SA was being used by everything (see issue #76), which means
# a token compromise on any single pod would grant the same default-SA
# permissions to the attacker everywhere. By giving each service its own SA
# we get (a) isolated identities for audit, (b) a per-service blast radius
# for any future RoleBinding, and (c) a clear invariant: only the
# provisioning SA may talk to the Kubernetes API.
#
# All SAs below set automountServiceAccountToken: false at the SA level.
# None of these services (except provisioning — handled in provisioning.yaml)
# talk to the Kubernetes API, so they don't need a mounted SA token and the
# `default` SA's token was pure blast-radius expansion.
#
# Note: `automountServiceAccountToken: false` on the SA is overridden at the
# pod spec level if the pod sets it to true. For defence in depth the pod
# spec is also being set to false in each deployment manifest. SA-level flag
# protects against a future deployment that forgets to set it.
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: auth
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: catalog
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: gateway
  namespace: sme
automountServiceAccountToken: false
---
# tenant SA — TBD-D35a: tenant service hosts the SandboxOrchestrator
# (core/services/tenant/handlers/sandbox_consumer.go) which materialises
# Sandbox.sandbox.openova.io CRs in `catalyst-system` on every
# `tenant.sandbox_requested` event. The orchestrator builds an in-cluster
# dynamic client via rest.InClusterConfig() (main.go buildDynamicClient)
# and silently disables itself with a WARN log when no SA token is
# mounted — the exact symptom Wave 32 D35a verifier caught
# (`kubernetes client unavailable — orchestrator disabled`). Flip
# automountServiceAccountToken=true here (mirrored at pod spec in
# tenant.yaml) so the in-cluster config path succeeds. The
# tenant-sandbox-orchestrator Role + RoleBinding below grants the
# narrow get+create verbs the orchestrator actually uses (issue #1775).
apiVersion: v1
kind: ServiceAccount
metadata:
  name: tenant
  namespace: sme
automountServiceAccountToken: true
---
# TBD-D35a — narrow RBAC for the SandboxOrchestrator in the tenant
# service. Only verbs the orchestrator actually exercises against the
# dynamic.Interface in core/services/tenant/main.go: Get (idempotency
# pre-check, ignored on NotFound) + Create (Sandbox CR materialisation).
# Scoped to the `catalyst-system` namespace where every Sandbox CR
# lands (handlers.DefaultSandboxNamespace) — a leaked tenant SA token
# can NOT touch Sandbox CRs in other namespaces or any other CRD group.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: tenant-sandbox-orchestrator
  namespace: catalyst-system
rules:
  - apiGroups: ["sandbox.openova.io"]
    resources: ["sandboxes"]
    verbs: ["get", "create"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: tenant-sandbox-orchestrator
  namespace: catalyst-system
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: tenant-sandbox-orchestrator
subjects:
  - kind: ServiceAccount
    name: tenant
    namespace: sme
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: domain
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: billing
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: notification
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: marketplace
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: console
  namespace: sme
automountServiceAccountToken: false
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: admin
  namespace: sme
automountServiceAccountToken: false
{{- end }}
