feat(teams): enable token request for team service account by Zaggy21 · Pull Request #2046 · cloudoperators/greenhouse

Zaggy21 · 2026-06-01T15:06:39Z

Description

Support-group teams can now request tokens for their ServiceAccount, enabling CI/CD pipelines to authenticate against the Greenhouse API using the team's identity
Greenhouse automatically creates the necessary RBAC (Role + RoleBinding) alongside the existing ServiceAccount when a team is marked as a support-group
A mutating webhook caps all token requests for Greenhouse-managed ServiceAccounts at 90 days

What type of PR is this? (check all applicable)

Related Tickets & Documents

Closes [FEAT] - Enable token request for Team Service account #1965

Added tests?

👍 yes
🙅 no, because they aren't needed
🙋 no, because I need help
Separate ticket for tests # (issue/pr)

Added unit tests.

Added to documentation?

📜 README.md
🤝 Documentation pages updated
🙅 no documentation needed
(if applicable) generated OpenAPI docs for CRD changes

Checklist

My code follows the style guidelines of this project
I have performed a self-review of my code
I have commented my code, particularly in hard-to-understand areas
My changes generate no new warnings
New and existing unit tests pass locally with my changes

…equests On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

…ccount On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Copilot

Pull request overview

This PR enables support-group Teams to request Kubernetes ServiceAccount tokens for their auto-created team ServiceAccount, allowing CI/CD pipelines to authenticate to the Greenhouse API as the team identity. It extends the Team controller to create and clean up the necessary namespace-scoped RBAC (Role + RoleBinding) alongside the existing support-group ServiceAccount.

Changes:

Team controller now creates a Role permitting create on serviceaccounts/token for the team ServiceAccount, plus a RoleBinding binding that role to both the support-group:<team> group and the team ServiceAccount.
Cleanup logic updated to delete the ServiceAccount, Role, and RoleBinding when the support-group label is removed.
Added unit tests for RBAC creation/deletion, and updated user documentation with token request guidance.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
`internal/controller/team/team_controller.go`	Creates/deletes support-group token-request RBAC (Role/RoleBinding) along with the team ServiceAccount.
`internal/controller/team/team_controller_test.go`	Adds tests asserting RBAC resources are created and deleted appropriately.
`docs/user-guides/team/authorization.md`	Documents how to request a token via `kubectl create token` and notes expiration capping.
`charts/manager/templates/rbac/manager-role.yaml`	Updates manager ClusterRole permissions related to RBAC resources.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

…s for role, rolebinding and sa removal On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Copilot

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

…ccount On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

…deletion helper On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

…tion at 90 days, add tests On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

…ccount On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Copilot

Pull request overview

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

…bhook On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

…amespaceSelector On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Copilot

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

… TokenRequest webhook On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

…ccount

Zaggy21 · 2026-06-11T08:41:57Z

I've checked that Helm templating works and that token expiration capping works correctly in local env. Also I considered setting an admission warning message about shortened token expiration (which would require validating webhook for create), but, as agreed with Abhi, the documentation and log message in webhook pod is enough.

…ccount

Zaggy21 added 2 commits June 1, 2026 15:51

feat(teams): create Role and RoleBinding for support-group SA token r…

0b479c7

…equests On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Merge branch 'main' into feat/enable-token-request-for-team-service-a…

a5f7b99

…ccount On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Zaggy21 linked an issue Jun 1, 2026 that may be closed by this pull request

[FEAT] - Enable token request for Team Service account #1965

Open

4 tasks

github-actions Bot added size/L feature helm-charts and removed size/L labels Jun 1, 2026

docs: add section about requesting a token for team sa

a4e425c

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

github-actions Bot added size/L documentation Improvements or additions to documentation labels Jun 1, 2026

Zaggy21 marked this pull request as ready for review June 1, 2026 16:30

Copilot AI review requested due to automatic review settings June 1, 2026 16:30

Zaggy21 requested review from a team as code owners June 1, 2026 16:30

Copilot started reviewing on behalf of Zaggy21 June 1, 2026 16:30 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

Comment thread charts/manager/templates/rbac/manager-role.yaml

fix: correct invalid rbac apiGroup marker in cluster controller

b35faa1

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Zaggy21 requested a review from Copilot June 1, 2026 16:53

Copilot started reviewing on behalf of Zaggy21 June 1, 2026 16:53 View session

Copilot AI reviewed Jun 1, 2026

View reviewed changes

Comment thread internal/controller/team/team_controller.go Outdated

Comment thread internal/controller/team/team_controller.go

Comment thread internal/controller/team/team_controller.go

Comment thread internal/controller/team/team_controller.go

fix: move support group resources deletion before scim check, fix log…

4975d10

…s for role, rolebinding and sa removal On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Zaggy21 requested a review from Copilot June 2, 2026 14:36

Copilot started reviewing on behalf of Zaggy21 June 2, 2026 14:36 View session

Copilot AI reviewed Jun 2, 2026

View reviewed changes

Comment thread internal/controller/team/team_controller.go

Comment thread internal/controller/team/team_controller.go Outdated

fix function name typo

044e346

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

abhijith-darshan requested changes Jun 8, 2026

View reviewed changes

Comment thread internal/controller/team/team_controller.go Outdated

Comment thread internal/controller/team/team_controller.go Outdated

Comment thread internal/controller/team/team_controller.go

Comment thread docs/user-guides/team/authorization.md Outdated

Zaggy21 added 4 commits June 10, 2026 11:41

Merge branch 'main' into feat/enable-token-request-for-team-service-a…

cbf50e4

…ccount On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

fix(teams): watch owned Role, RoleBinding, ServiceAccount and rename …

b98827e

…deletion helper On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

feat(teams): add TokenRequest mutating webhook to cap SA token expira…

65f8887

…tion at 90 days, add tests On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

docs(teams): clarify token lifetime is capped at 90 days by Greenhouse

6bd6a3f

On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Merge branch 'main' into feat/enable-token-request-for-team-service-a…

9cc7f55

…ccount On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Zaggy21 requested a review from Copilot June 10, 2026 13:09

Copilot started reviewing on behalf of Zaggy21 June 10, 2026 13:10 View session

Copilot AI reviewed Jun 10, 2026

View reviewed changes

Comment thread internal/webhook/v1alpha1/tokenrequest_webhook.go

Zaggy21 added 2 commits June 10, 2026 15:21

fix(teams): preserve original error from SA lookup in TokenRequest we…

b935141

…bhook On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

fix(teams): exclude system namespaces from TokenRequest webhook via n…

606da84

…amespaceSelector On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Zaggy21 requested a review from Copilot June 10, 2026 14:53

Copilot started reviewing on behalf of Zaggy21 June 10, 2026 14:53 View session

Copilot AI reviewed Jun 10, 2026

View reviewed changes

Comment thread internal/webhook/v1alpha1/tokenrequest_webhook.go

Zaggy21 added 2 commits June 10, 2026 17:40

fix(teams): log actual expiration value instead of pointer address in…

6c48697

… TokenRequest webhook On-behalf-of: @SAP krzysztof.zagorski@sap.com Signed-off-by: Zaggy21 <k.zaggy@gmail.com>

Merge branch 'main' into feat/enable-token-request-for-team-service-a…

53e972a

…ccount

Merge branch 'main' into feat/enable-token-request-for-team-service-a…

d5d3c4e

…ccount

Zaggy21 requested a review from abhijith-darshan June 11, 2026 11:33

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(teams): enable token request for team service account#2046

feat(teams): enable token request for team service account#2046
Zaggy21 wants to merge 16 commits into
mainfrom
feat/enable-token-request-for-team-service-account

Zaggy21 commented Jun 1, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Zaggy21 commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Zaggy21 commented Jun 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

What type of PR is this? (check all applicable)

Related Tickets & Documents

Added tests?

Added to documentation?

Checklist

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Zaggy21 commented Jun 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Zaggy21 commented Jun 1, 2026 •

edited

Loading