ServiceAccount

A credential for CI that is not a person. Fields, YAML, HCL and CLI samples, and how apply treats it.

A credential for CI that is not a person. It is named after the organisation, as :<metadata.name>, has no email address and cannot sign in. It always holds the member role, so it cannot invite people or mint further credentials. Applying a new ServiceAccount creates it and returns its API key and secret once, in the apply result’s status (status.apiKey and status.secret): they are never shown again, by plan, export or the console, so store them as the apply returns them. Applying needs an owner or admin. Deleting the document deactivates the service account, so its key stops working; it is kept for the audit trail, and its name cannot be used again.


`apiVersion`	`vulnetix.com/v1`
`kind`	`ServiceAccount`
Group	Org
Status	Served. The config engine plans and applies it.
Objects per tenant	many, keyed by `metadata.name`
Token and role	An owner or admin session, or a `vmt_` config management token that lists `ServiceAccount` in its kinds and has the owner role. An admin or member token cannot carry this kind.
Terraform resource	`vulnetix_service_account`, imported by name (see Terraform and OpenTofu)
CLI	`vulnetix config apply`, CLI v3.168.0 and later.
Pinned schema	`v1.15.0/ServiceAccount.schema.json`
Newest schema	`latest/ServiceAccount.schema.json`
First released in	`v1.5.0`
Print the built-in copy	`vulnetix config schema ServiceAccount`

Minimal

Only the fields the kind requires. From examples/ServiceAccount/minimal.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ServiceAccount.schema.json
apiVersion: vulnetix.com/v1
kind: ServiceAccount
metadata:
  name: ci-scanner
spec: {}

HCL (resource vulnetix_service_account)

# Only the arguments the kind requires. From config-schemas examples/ServiceAccount/minimal.yaml.

resource "vulnetix_service_account" "ci_scanner" {
  name = "ci-scanner"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ServiceAccount.schema.json
apiVersion: vulnetix.com/v1
kind: ServiceAccount
metadata:
  name: ci-scanner
spec: {}
EOF

Advanced

Every field the kind supports, with a when expression where it takes one. From examples/ServiceAccount/advanced.yaml.

YAML

# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ServiceAccount.schema.json
apiVersion: vulnetix.com/v1
kind: ServiceAccount
metadata:
  name: ci-scanner
  labels:
    pipeline: github-actions
  annotations:
    owner: platform-team
spec: {}
---
apiVersion: vulnetix.com/v1
kind: ServiceAccount
metadata:
  name: release-signer
spec: {}

HCL (resource vulnetix_service_account)

# Every argument the kind supports. From config-schemas examples/ServiceAccount/advanced.yaml.

resource "vulnetix_service_account" "ci_scanner" {
  name = "ci-scanner"
  labels = {
    pipeline = "github-actions"
  }
  annotations = {
    owner = "platform-team"
  }
}

resource "vulnetix_service_account" "release_signer" {
  name = "release-signer"
}

CLI (applies it)

export VULNETIX_CONFIG_TOKEN=vmt_...   # a config management token
vulnetix config apply -f - --manager gitops:acme/platform --auto-approve <<'EOF'
# yaml-language-server: $schema=https://github.com/Vulnetix/config-schemas/releases/latest/download/ServiceAccount.schema.json
apiVersion: vulnetix.com/v1
kind: ServiceAccount
metadata:
  name: ci-scanner
  labels:
    pipeline: github-actions
  annotations:
    owner: platform-team
spec: {}
---
apiVersion: vulnetix.com/v1
kind: ServiceAccount
metadata:
  name: release-signer
spec: {}
EOF

Fields

Paths use dots for nesting and [] for the items of a list. Required means required whenever the parent object is present. A default is what the server uses when the field is left out.

Field	Type	Required	Allowed values	Description
`apiVersion`	string	yes	exactly `vulnetix.com/v1`	The document format version. Every kind in this release is vulnetix.com/v1.
`kind`	string	yes	exactly `ServiceAccount`	Always ServiceAccount.
`metadata`	object	yes	no other keys	The name is 3 to 40 lowercase letters, digits and hyphens, such as ci-scanner.
`metadata.name`	string	yes	pattern `^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$`	The object’s name, unique per kind within a tenant. It is the natural key: plan, apply, export and the Terraform provider all address an object by kind and name.
`metadata.org`	string	no	format `uuid`	The tenant (organization UUID) the document belongs to. When set, plan and apply refuse to run against any other tenant.
`metadata.labels`	object	no	map of string to string (length 0 to 256); keys match `^[a-z0-9]([a-z0-9._/-]{0,61}[a-z0-9])?$`	Free key/value labels. Stored with the object, never interpreted by the server.
`metadata.annotations`	object	no	map of string to string (length 0 to 4096)	Free key/value notes for people and tools, such as a ticket link.
`spec`	object	yes	no other keys	A service account has nothing to declare beyond its name.

Applying this kind

Command. vulnetix config apply -f <file>; the CLI line above says from which release. Plan first with vulnetix config plan: it shows each object as create, update, delete or no change, with a planHash that apply then holds to. Apply writes in one transaction.
Manager. Each object records the manager that applied it (terraform, console or gitops:<repo>). --prune deletes only objects its own manager owns. See The manager and the config engine.
Status. status.principal, status.apiKey and status.secret, in the apply that creates it and never again. The phases the engine reports are explained under status phases.

How apply treats it

The spec is empty. The account is always a member.
Apply returns status.principal, status.apiKey and status.secret once. Plan, export and later applies never show them. Store them as the apply returns them.
A name that belonged to a deleted account is refused, active or not.
A create that rolls back deletes the Authentik user it made. A deactivation that rolls back reactivates it.
Delete deactivates. Secret rotation is not declarable yet: the console’s rotate endpoint stays the way to rotate.
Owner or admin only. A token for this kind needs the owner role.

Terraform and OpenTofu

The resource is vulnetix_service_account in the vulnetix/resolve provider. Its arguments are the spec in snake case, beside name, labels and annotations from metadata. The Minimal and Advanced HCL are above. The provider’s own reference is vulnetix_service_account.

Import an object that already exists by its name:

# Import an existing ServiceAccount by its name (metadata.name).
terraform import vulnetix_service_account.ci_scanner ci-scanner

Install, authentication and how state is read: Terraform and OpenTofu.

Check a file with vulnetix config validate -f <file>. See Validate documents. In an editor, start the file with the schema comment.