matheuscscp · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026
diff --git a/README.md b/README.md
@@ -2,7 +2,6 @@
 
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4787/badge)](https://bestpractices.coreinfrastructure.org/projects/4787)
 [![e2e](https://github.com/fluxcd/kustomize-controller/workflows/e2e/badge.svg)](https://github.com/fluxcd/kustomize-controller/actions)
-[![report](https://goreportcard.com/badge/github.com/fluxcd/kustomize-controller)](https://goreportcard.com/report/github.com/fluxcd/kustomize-controller)
 [![license](https://img.shields.io/github/license/fluxcd/kustomize-controller.svg)](https://github.com/fluxcd/kustomize-controller/blob/main/LICENSE)
 [![release](https://img.shields.io/github/release/fluxcd/kustomize-controller/all.svg)](https://github.com/fluxcd/kustomize-controller/releases)
 

diff --git a/api/v1/kustomization_types.go b/api/v1/kustomization_types.go
@@ -80,8 +80,7 @@ type KustomizationSpec struct {
 	// forces the controller to act on behalf of that Service Account at the
 	// target cluster.
 	// If the --default-service-account flag is set, its value will be used as
-	// a controller level fallback for when KustomizationSpec.ServiceAccountName
-	// is empty.
+	// the default for KustomizationSpec.ServiceAccountName when it is empty.
 	// +optional
 	KubeConfig *meta.KubeConfigReference `json:"kubeConfig,omitempty"`
 

diff --git a/config/crd/bases/kustomize.toolkit.fluxcd.io_kustomizations.yaml b/config/crd/bases/kustomize.toolkit.fluxcd.io_kustomizations.yaml
@@ -352,8 +352,7 @@ spec:
                   forces the controller to act on behalf of that Service Account at the
                   target cluster.
                   If the --default-service-account flag is set, its value will be used as
-                  a controller level fallback for when KustomizationSpec.ServiceAccountName
-                  is empty.
+                  the default for KustomizationSpec.ServiceAccountName when it is empty.
                 properties:
                   configMapRef:
                     description: |-

diff --git a/docs/README.md b/docs/README.md
@@ -81,8 +81,8 @@ kustomize-controller acquires an X.509-SVID from the SPIFFE Workload API and use
 authenticate to the SPIFFE Broker API. The `SPIFFE_ENDPOINT_SOCKET` environment
 variable must point to the Workload API socket.
 
-The Broker is used to acquire JWT-SVIDs for object-level workload identity when
-a ServiceAccount sets `credential.auth.fluxcd.io/provider` to `spiffe`. The
+The Broker is used to acquire JWT-SVIDs for object identity when a
+ServiceAccount sets `credential.auth.fluxcd.io/provider` to `spiffe`. The
 Broker endpoint is a TCP gRPC target, e.g.
 `dns:///spire-server.spire.svc.cluster.local:8443`.
 

diff --git a/docs/api/v1/kustomize.md b/docs/api/v1/kustomize.md
@@ -162,8 +162,7 @@ When used in combination with KustomizationSpec.ServiceAccountName,
 forces the controller to act on behalf of that Service Account at the
 target cluster.
 If the &ndash;default-service-account flag is set, its value will be used as
-a controller level fallback for when KustomizationSpec.ServiceAccountName
-is empty.</p>
+the default for KustomizationSpec.ServiceAccountName when it is empty.</p>
 </td>
 </tr>
 <tr>
@@ -838,8 +837,7 @@ When used in combination with KustomizationSpec.ServiceAccountName,
 forces the controller to act on behalf of that Service Account at the
 target cluster.
 If the &ndash;default-service-account flag is set, its value will be used as
-a controller level fallback for when KustomizationSpec.ServiceAccountName
-is empty.</p>
+the default for KustomizationSpec.ServiceAccountName when it is empty.</p>
 </td>
 </tr>
 <tr>

diff --git a/docs/spec/v1/kustomizations.md b/docs/spec/v1/kustomizations.md
@@ -1128,10 +1128,9 @@ this feature, see the following docs:
 - [GKE](/flux/integrations/gcp/#for-google-kubernetes-engine)
 - [Generic](https://kubernetes.io/docs/reference/access-authn-authz/authentication/#configuring-the-api-server)
 
-For a complete guide to the ServiceAccount annotations used for object-level
-workload identity, including the `spiffe` credential provider, see the
-[ServiceAccount annotations](/flux/integrations/serviceaccount-annotations)
-docs.
+For a complete guide to the ServiceAccount annotations used for object
+identity, including the `spiffe` credential provider, see the
+[Object Identity](/flux/integrations/object-identity/) docs.
 
 Example for an EKS cluster:
 
@@ -1191,20 +1190,19 @@ The `.spec.decryption` field has the following subfields:
 - `.serviceAccountName`: The name of the service account used for
   secret-less authentication with KMS services from cloud providers, and
   with OpenBao/Vault via the
-  [Kubernetes auth method](#openbaovault-kubernetes-auth) (object-level workload
+  [Kubernetes auth method](#openbaovault-kubernetes-auth) (object
   identity). When unset, the controller falls back to its own ServiceAccount
-  ([controller-level workload identity](#controller-global-decryption)).
+  ([workload identity](#controller-global-decryption)).
 
 To make a Kustomization react immediately to changes in the referenced Secret
 see [this](#reacting-immediately-to-configuration-dependencies) section.
 
 For a complete guide on how to set up authentication for KMS services from
 cloud providers, see the integration [docs](/flux/integrations/).
 
-For a complete guide to the ServiceAccount annotations used for object-level
-workload identity, including the `spiffe` credential provider, see the
-[ServiceAccount annotations](/flux/integrations/serviceaccount-annotations)
-docs.
+For a complete guide to the ServiceAccount annotations used for object
+identity, including the `spiffe` credential provider, see the
+[Object Identity](/flux/integrations/object-identity/) docs.
 
 If a static credential for a given cloud provider is defined inside the secret
 referenced by `.secretRef`, that static credential takes priority over secret-less
@@ -1507,9 +1505,9 @@ When enabled, a Kustomization whose decryption Secret does **not** contain a
 of each encrypted data key as follows:
 
 - The Kubernetes ServiceAccount token is issued for
-  [`.spec.decryption.serviceAccountName`](#decryption) when set (object-level
-  workload identity), otherwise for the controller's own ServiceAccount
-  ([controller-level workload identity](#controller-global-decryption)).
+  [`.spec.decryption.serviceAccountName`](#decryption) when set (object
+  identity), otherwise for the controller's own ServiceAccount
+  ([workload identity](#controller-global-decryption)).
 - The token audience is set to the Vault address.
 - The Vault role is derived from the ServiceAccount as `{namespace}_{name}`
   (e.g. a ServiceAccount `sops` in namespace `apps` maps to the role `apps_sops`).
@@ -1883,18 +1881,18 @@ Service-specific configuration:
 - [Azure Key Vault](https://fluxcd.io/flux/integrations/azure/#for-azure-key-vault)
 - [GCP KMS](https://fluxcd.io/flux/integrations/gcp/#for-google-cloud-key-management-service)
 
-Controller-level configuration:
+Workload identity configuration:
 
-- [AWS](https://fluxcd.io/flux/integrations/aws/#at-the-controller-level)
-- [Azure](https://fluxcd.io/flux/integrations/azure/#at-the-controller-level)
-- [GCP](https://fluxcd.io/flux/integrations/gcp/#at-the-controller-level)
+- [AWS](https://fluxcd.io/flux/integrations/aws/#workload-identity)
+- [Azure](https://fluxcd.io/flux/integrations/azure/#workload-identity)
+- [GCP](https://fluxcd.io/flux/integrations/gcp/#workload-identity)
 
 These guides provide detailed instructions for setting up authentication,
 permissions, and controller configuration for each cloud provider.
 
 #### OpenBao/Vault
 
-There are two ways to configure controller-level authentication to OpenBao/Vault
+There are two ways to configure controller-global authentication to OpenBao/Vault
 for SOPS decryption: a static token, or the Kubernetes auth method.
 
 ##### Static token
@@ -1925,10 +1923,10 @@ When SOPS decryption uses OpenBao/Vault with the
 [Kubernetes auth method](#openbaovault-kubernetes-auth), the controller-global
 identity is simply kustomize-controller's own ServiceAccount: a Kustomization
 that sets no [`.spec.decryption.serviceAccountName`](#decryption) authenticates
-to Vault as the controller's ServiceAccount (controller-level workload identity).
+to Vault as the controller's ServiceAccount (workload identity).
 
 Setting `.spec.decryption.serviceAccountName` makes the authentication
-object-level rather than global.
+use object identity rather than workload identity.
 
 See [OpenBao/Vault Kubernetes auth](#openbaovault-kubernetes-auth) for enabling
 the method (the `--sops-vault-configmap` flag and ConfigMap) and the Vault server