IAM: Create Service Account API and legacy store impl (#110411)

* wip * IAM: Create Service Account * Add dual writer * Update openapi_test.go * Add integration tests * Add sql tests * Add Role to SA spec, add validation, add DBTime, add tests * Format, update test * Fixes * Add check for External * Address feedback * Update tests * Address feedback * make gen-go * Simplify a bit * Fixes * make update-workspace * Update pkg/registry/apis/iam/serviceaccount/store.go Co-authored-by: Ryan McKinley <ryantxu@gmail.com> * Address feedback, add test for generateName --------- Co-authored-by: Ryan McKinley <ryantxu@gmail.com>
2025-09-08 14:31:32 +02:00
parent 8a28381278
commit badea8bc37
46 changed files with 1961 additions and 198 deletions
@@ -1,6 +1,10 @@
 package v0alpha1

 ServiceAccountSpec: {
+    disabled: bool |* false
+    plugin: string
+    role: OrgRole
    title: string
-	disabled: bool
 }
+
+OrgRole: "None" | "Viewer" | "Editor" | "Admin" @cuetsy(kind="enum")
@@ -2,13 +2,27 @@

 package v0alpha1

+// +k8s:openapi-gen=true
+type ServiceAccountOrgRole string
+
+const (
+	ServiceAccountOrgRoleNone   ServiceAccountOrgRole = "None"
+	ServiceAccountOrgRoleViewer ServiceAccountOrgRole = "Viewer"
+	ServiceAccountOrgRoleEditor ServiceAccountOrgRole = "Editor"
+	ServiceAccountOrgRoleAdmin  ServiceAccountOrgRole = "Admin"
+)
+
 // +k8s:openapi-gen=true
 type ServiceAccountSpec struct {
-	Title    string `json:"title"`
-	Disabled bool   `json:"disabled"`
+	Disabled bool                  `json:"disabled"`
+	Plugin   string                `json:"plugin"`
+	Role     ServiceAccountOrgRole `json:"role"`
+	Title    string                `json:"title"`
 }

 // NewServiceAccountSpec creates a new ServiceAccountSpec object.
 func NewServiceAccountSpec() *ServiceAccountSpec {
-	return &ServiceAccountSpec{}
+	return &ServiceAccountSpec{
+		Disabled: false,
+	}
 }
@@ -1877,13 +1877,6 @@ func schema_pkg_apis_iam_v0alpha1_ServiceAccountSpec(ref common.ReferenceCallbac
 			SchemaProps: spec.SchemaProps{
 				Type: []string{"object"},
 				Properties: map[string]spec.Schema{
-					"title": {
-						SchemaProps: spec.SchemaProps{
-							Default: "",
-							Type:    []string{"string"},
-							Format:  "",
-						},
-					},
 					"disabled": {
 						SchemaProps: spec.SchemaProps{
 							Default: false,
@@ -1891,8 +1884,29 @@ func schema_pkg_apis_iam_v0alpha1_ServiceAccountSpec(ref common.ReferenceCallbac
 							Format:  "",
 						},
 					},
+					"plugin": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"role": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
+					"title": {
+						SchemaProps: spec.SchemaProps{
+							Default: "",
+							Type:    []string{"string"},
+							Format:  "",
+						},
+					},
 				},
-				Required: []string{"title", "disabled"},
+				Required: []string{"disabled", "plugin", "role", "title"},
 			},
 		},
 	}
@@ -232,7 +232,6 @@ require (

 require (
 	github.com/grafana/grafana/apps/advisor v0.0.0 // @grafana/plugins-platform-backend
-	github.com/grafana/grafana/apps/alerting/alertenrichment v0.0.0 // @grafana/alerting-backend
 	github.com/grafana/grafana/apps/alerting/notifications v0.0.0 // @grafana/alerting-backend
 	github.com/grafana/grafana/apps/dashboard v0.0.0 // @grafana/grafana-app-platform-squad @grafana/dashboards-squad
 	github.com/grafana/grafana/apps/folder v0.0.0 // @grafana/grafana-search-and-storage
@@ -53,6 +53,5 @@ import (
 	_ "github.com/grafana/e2e"
 	_ "github.com/grafana/gofpdf"
 	_ "github.com/grafana/gomemcache/memcache"
-	_ "github.com/grafana/grafana/apps/alerting/alertenrichment/pkg/apis/alertenrichment/v1beta1"
 	_ "github.com/grafana/tempo/pkg/traceql"
 )
@@ -0,0 +1,7 @@
+INSERT INTO {{ .Ident .UserTable }}
+  (uid, version, login, email, name, org_id, is_admin, is_disabled, email_verified,
+   is_provisioned, is_service_account, salt, rands, created, updated, last_seen_at)
+VALUES
+  ({{ .Arg .Command.UID }}, 0, {{ .Arg .Command.Login }}, {{ .Arg .Command.Email }}, {{ .Arg .Command.Name }},
+   {{ .Arg .Command.OrgID }}, false, {{ .Arg .Command.IsDisabled }}, false,
+   false, true, '', '', {{ .Arg .Command.Created }}, {{ .Arg .Command.Updated }}, {{ .Arg .Command.LastSeenAt }})
@@ -9,6 +9,7 @@ import (
 	claims "github.com/grafana/authlib/types"

 	"github.com/grafana/grafana/pkg/registry/apis/iam/common"
+	"github.com/grafana/grafana/pkg/services/sqlstore/session"
 	"github.com/grafana/grafana/pkg/storage/legacysql"
 	"github.com/grafana/grafana/pkg/storage/unified/sql/sqltemplate"
 )
@@ -107,10 +108,28 @@ type ServiceAccount struct {
 	UID      string
 	Name     string
 	Disabled bool
+	Role     string
 	Created  time.Time
 	Updated  time.Time
 }

+type CreateServiceAccountCommand struct {
+	UID        string
+	Name       string
+	Email      string
+	Login      string
+	Role       string
+	IsDisabled bool
+	OrgID      int64
+	Created    DBTime
+	Updated    DBTime
+	LastSeenAt time.Time
+}
+
+type CreateServiceAccountResult struct {
+	ServiceAccount ServiceAccount
+}
+
 var sqlQueryServiceAccountsTemplate = mustTemplate("service_accounts_query.sql")

 func newListServiceAccounts(sql *legacysql.LegacyDatabaseHelper, q *ListServiceAccountsQuery) listServiceAccountsQuery {
@@ -167,7 +186,7 @@ func (s *legacySQLStore) ListServiceAccounts(ctx context.Context, ns claims.Name
 	var lastID int64
 	for rows.Next() {
 		var s ServiceAccount
-		err := rows.Scan(&s.ID, &s.UID, &s.Name, &s.Disabled, &s.Created, &s.Updated)
+		err := rows.Scan(&s.ID, &s.UID, &s.Name, &s.Disabled, &s.Role, &s.Created, &s.Updated)
 		if err != nil {
 			return res, err
 		}
@@ -286,3 +305,98 @@ func (s *legacySQLStore) ListServiceAccountTokens(ctx context.Context, ns claims

 	return res, err
 }
+
+var sqlCreateServiceAccountTemplate = mustTemplate("create_service_account.sql")
+
+func newCreateServiceAccount(sql *legacysql.LegacyDatabaseHelper, cmd *CreateServiceAccountCommand) createServiceAccountQuery {
+	return createServiceAccountQuery{
+		SQLTemplate:  sqltemplate.New(sql.DialectForDriver()),
+		UserTable:    sql.Table("user"),
+		OrgUserTable: sql.Table("org_user"),
+		Command:      cmd,
+	}
+}
+
+type createServiceAccountQuery struct {
+	sqltemplate.SQLTemplate
+	UserTable    string
+	OrgUserTable string
+	Command      *CreateServiceAccountCommand
+}
+
+func (r createServiceAccountQuery) Validate() error {
+	return nil
+}
+
+func (s *legacySQLStore) CreateServiceAccount(ctx context.Context, ns claims.NamespaceInfo, cmd CreateServiceAccountCommand) (*CreateServiceAccountResult, error) {
+	cmd.OrgID = ns.OrgID
+	cmd.Email = cmd.Login
+
+	now := time.Now().UTC().Truncate(time.Second)
+	lastSeenAt := now.AddDate(-10, 0, 0) // Set last seen 10 years ago like in user service
+
+	cmd.Created = NewDBTime(now)
+	cmd.Updated = NewDBTime(now)
+	cmd.LastSeenAt = lastSeenAt
+
+	if ns.OrgID == 0 {
+		return nil, fmt.Errorf("expected non zero org id")
+	}
+
+	sql, err := s.sql(ctx)
+	if err != nil {
+		return nil, err
+	}
+
+	req := newCreateServiceAccount(sql, &cmd)
+
+	var createdSA ServiceAccount
+	err = sql.DB.GetSqlxSession().WithTransaction(ctx, func(st *session.SessionTx) error {
+		userQuery, err := sqltemplate.Execute(sqlCreateServiceAccountTemplate, req)
+		if err != nil {
+			return fmt.Errorf("execute service account template %q: %w", sqlCreateServiceAccountTemplate.Name(), err)
+		}
+
+		serviceAccountID, err := st.ExecWithReturningId(ctx, userQuery, req.GetArgs()...)
+		if err != nil {
+			return fmt.Errorf("failed to create service account: %w", err)
+		}
+
+		orgUserCmd := &CreateOrgUserCommand{
+			OrgID:   ns.OrgID,
+			UserID:  serviceAccountID,
+			Role:    cmd.Role,
+			Created: cmd.Created,
+			Updated: cmd.Updated,
+		}
+		orgUserReq := newCreateOrgUser(sql, orgUserCmd)
+
+		orgUserQuery, err := sqltemplate.Execute(sqlCreateOrgUserTemplate, orgUserReq)
+		if err != nil {
+			return fmt.Errorf("execute org_user template %q: %w", sqlCreateOrgUserTemplate.Name(), err)
+		}
+
+		_, err = st.Exec(ctx, orgUserQuery, orgUserReq.GetArgs()...)
+		if err != nil {
+			return fmt.Errorf("failed to create org_user relationship: %w", err)
+		}
+
+		createdSA = ServiceAccount{
+			ID:       serviceAccountID,
+			UID:      cmd.UID,
+			Name:     cmd.Name,
+			Role:     cmd.Role,
+			Disabled: cmd.IsDisabled,
+			Created:  cmd.Created.Time,
+			Updated:  cmd.Updated.Time,
+		}
+
+		return nil
+	})
+
+	if err != nil {
+		return nil, err
+	}
+
+	return &CreateServiceAccountResult{ServiceAccount: createdSA}, nil
+}
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM {{ .Ident .UserTable }} as u JOIN {{ .Ident .OrgUserTable }} as o ON u.id = o.user_id
@@ -2,9 +2,11 @@ package legacy

 import (
 	"context"
+	"database/sql/driver"
 	"embed"
 	"fmt"
 	"text/template"
+	"time"

 	claims "github.com/grafana/authlib/types"
 	"github.com/grafana/grafana/pkg/storage/legacysql"
@@ -22,6 +24,8 @@ type LegacyIdentityStore interface {

 	GetServiceAccountInternalID(ctx context.Context, ns claims.NamespaceInfo, query GetServiceAccountInternalIDQuery) (*GetServiceAccountInternalIDResult, error)
 	ListServiceAccounts(ctx context.Context, ns claims.NamespaceInfo, query ListServiceAccountsQuery) (*ListServiceAccountResult, error)
+	CreateServiceAccount(ctx context.Context, ns claims.NamespaceInfo, cmd CreateServiceAccountCommand) (*CreateServiceAccountResult, error)
+
 	ListServiceAccountTokens(ctx context.Context, ns claims.NamespaceInfo, query ListServiceAccountTokenQuery) (*ListServiceAccountTokenResult, error)

 	GetTeamInternalID(ctx context.Context, ns claims.NamespaceInfo, query GetTeamInternalIDQuery) (*GetTeamInternalIDResult, error)
@@ -30,9 +34,7 @@ type LegacyIdentityStore interface {
 	ListTeamMembers(ctx context.Context, ns claims.NamespaceInfo, query ListTeamMembersQuery) (*ListTeamMembersResult, error)
 }

-var (
-	_ LegacyIdentityStore = (*legacySQLStore)(nil)
-)
+var _ LegacyIdentityStore = (*legacySQLStore)(nil)

 func NewLegacySQLStores(sql legacysql.LegacyDatabaseProvider) LegacyIdentityStore {
 	return &legacySQLStore{
@@ -58,3 +60,47 @@ func mustTemplate(filename string) *template.Template {
 	}
 	panic(fmt.Sprintf("template file not found: %s", filename))
 }
+
+type DBTime struct {
+	time.Time
+}
+
+func NewDBTime(t time.Time) DBTime {
+	return DBTime{Time: t}
+}
+
+func (t DBTime) Value() (driver.Value, error) {
+	if t.IsZero() {
+		return nil, nil
+	}
+
+	return t.Format(time.DateTime), nil
+}
+
+func (t *DBTime) Scan(value interface{}) error {
+	if value == nil {
+		t.Time = time.Time{}
+		return nil
+	}
+
+	var parsedTime time.Time
+	var err error
+
+	switch v := value.(type) {
+	case []byte:
+		parsedTime, err = time.Parse(time.DateTime, string(v))
+	case string:
+		parsedTime, err = time.Parse(time.DateTime, v)
+	case time.Time:
+		parsedTime = v
+	default:
+		return fmt.Errorf("could not scan type %T into DBTime", value)
+	}
+
+	if err != nil {
+		return fmt.Errorf("could not parse time: %w", err)
+	}
+
+	t.Time = parsedTime
+	return nil
+}
@@ -88,6 +88,12 @@ func TestIdentityQueries(t *testing.T) {
 		return &v
 	}

+	createServiceAccounts := func(cmd *CreateServiceAccountCommand) sqltemplate.SQLTemplate {
+		v := newCreateServiceAccount(nodb, cmd)
+		v.SQLTemplate = mocks.NewTestingSQLTemplate()
+		return &v
+	}
+
 	listServiceAccountTokens := func(q *ListServiceAccountTokenQuery) sqltemplate.SQLTemplate {
 		v := newListServiceAccountTokens(nodb, q)
 		v.SQLTemplate = mocks.NewTestingSQLTemplate()
@@ -361,8 +367,8 @@ func TestIdentityQueries(t *testing.T) {
 						OrgID:   1,
 						UserID:  123,
 						Role:    "Viewer",
-						Created: time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC),
-						Updated: time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC),
+						Created: NewDBTime(time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC)),
+						Updated: NewDBTime(time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC)),
 					}),
 				},
 				{
@@ -371,8 +377,8 @@ func TestIdentityQueries(t *testing.T) {
 						OrgID:   2,
 						UserID:  456,
 						Role:    "Admin",
-						Created: time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC),
-						Updated: time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC),
+						Created: NewDBTime(time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC)),
+						Updated: NewDBTime(time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC)),
 					}),
 				},
 			},
@@ -391,9 +397,9 @@ func TestIdentityQueries(t *testing.T) {
 						IsProvisioned: false,
 						Salt:          "randomsalt",
 						Rands:         "randomrands",
-						Created:       time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC),
-						Updated:       time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC),
-						LastSeenAt:    time.Date(2013, 1, 1, 12, 0, 0, 0, time.UTC),
+						Created:       NewDBTime(time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC)),
+						Updated:       NewDBTime(time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC)),
+						LastSeenAt:    NewDBTime(time.Date(2013, 1, 1, 12, 0, 0, 0, time.UTC)),
 						Role:          "Viewer",
 					}),
 				},
@@ -411,13 +417,43 @@ func TestIdentityQueries(t *testing.T) {
 						IsProvisioned: true,
 						Salt:          "adminsalt",
 						Rands:         "adminrands",
-						Created:       time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC),
-						Updated:       time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC),
-						LastSeenAt:    time.Date(2013, 2, 1, 10, 30, 0, 0, time.UTC),
+						Created:       NewDBTime(time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC)),
+						Updated:       NewDBTime(time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC)),
+						LastSeenAt:    NewDBTime(time.Date(2013, 2, 1, 10, 30, 0, 0, time.UTC)),
 						Role:          "Admin",
 					}),
 				},
 			},
+			sqlCreateServiceAccountTemplate: {
+				{
+					Name: "create_service_account_basic",
+					Data: createServiceAccounts(&CreateServiceAccountCommand{
+						UID:        "abcdef",
+						Name:       "Service Account 1",
+						Email:      "sa-1-service-account-1",
+						Login:      "sa-1-service-account-1",
+						IsDisabled: false,
+						OrgID:      1,
+						Created:    NewDBTime(time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC)),
+						Updated:    NewDBTime(time.Date(2023, 1, 1, 12, 0, 0, 0, time.UTC)),
+						LastSeenAt: time.Date(2013, 1, 1, 12, 0, 0, 0, time.UTC),
+					}),
+				},
+				{
+					Name: "create_service_account_disabled",
+					Data: createServiceAccounts(&CreateServiceAccountCommand{
+						UID:        "abcdef",
+						Name:       "Disabled Service Account",
+						Email:      "sa-2-disabled-service-account",
+						Login:      "sa-2-disabled-service-account",
+						IsDisabled: true,
+						OrgID:      2,
+						Created:    NewDBTime(time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC)),
+						Updated:    NewDBTime(time.Date(2023, 2, 1, 10, 30, 0, 0, time.UTC)),
+						LastSeenAt: time.Date(2013, 2, 1, 10, 30, 0, 0, time.UTC),
+					}),
+				},
+			},
 		},
 	})
 }
@@ -0,0 +1,7 @@
+INSERT INTO `grafana`.`user`
+  (uid, version, login, email, name, org_id, is_admin, is_disabled, email_verified,
+   is_provisioned, is_service_account, salt, rands, created, updated, last_seen_at)
+VALUES
+  ('abcdef', 0, 'sa-1-service-account-1', 'sa-1-service-account-1', 'Service Account 1',
+   1, false, FALSE, false,
+   false, true, '', '', '2023-01-01 12:00:00 +0000 UTC', '2023-01-01 12:00:00 +0000 UTC', '2013-01-01 12:00:00 +0000 UTC')
@@ -0,0 +1,7 @@
+INSERT INTO `grafana`.`user`
+  (uid, version, login, email, name, org_id, is_admin, is_disabled, email_verified,
+   is_provisioned, is_service_account, salt, rands, created, updated, last_seen_at)
+VALUES
+  ('abcdef', 0, 'sa-2-disabled-service-account', 'sa-2-disabled-service-account', 'Disabled Service Account',
+   2, false, TRUE, false,
+   false, true, '', '', '2023-02-01 10:30:00 +0000 UTC', '2023-02-01 10:30:00 +0000 UTC', '2013-02-01 10:30:00 +0000 UTC')
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM `grafana`.`user` as u JOIN `grafana`.`org_user` as o ON u.id = o.user_id
@@ -0,0 +1,7 @@
+INSERT INTO "grafana"."user"
+  (uid, version, login, email, name, org_id, is_admin, is_disabled, email_verified,
+   is_provisioned, is_service_account, salt, rands, created, updated, last_seen_at)
+VALUES
+  ('abcdef', 0, 'sa-1-service-account-1', 'sa-1-service-account-1', 'Service Account 1',
+   1, false, FALSE, false,
+   false, true, '', '', '2023-01-01 12:00:00 +0000 UTC', '2023-01-01 12:00:00 +0000 UTC', '2013-01-01 12:00:00 +0000 UTC')
@@ -0,0 +1,7 @@
+INSERT INTO "grafana"."user"
+  (uid, version, login, email, name, org_id, is_admin, is_disabled, email_verified,
+   is_provisioned, is_service_account, salt, rands, created, updated, last_seen_at)
+VALUES
+  ('abcdef', 0, 'sa-2-disabled-service-account', 'sa-2-disabled-service-account', 'Disabled Service Account',
+   2, false, TRUE, false,
+   false, true, '', '', '2023-02-01 10:30:00 +0000 UTC', '2023-02-01 10:30:00 +0000 UTC', '2013-02-01 10:30:00 +0000 UTC')
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
@@ -0,0 +1,7 @@
+INSERT INTO "grafana"."user"
+  (uid, version, login, email, name, org_id, is_admin, is_disabled, email_verified,
+   is_provisioned, is_service_account, salt, rands, created, updated, last_seen_at)
+VALUES
+  ('abcdef', 0, 'sa-1-service-account-1', 'sa-1-service-account-1', 'Service Account 1',
+   1, false, FALSE, false,
+   false, true, '', '', '2023-01-01 12:00:00 +0000 UTC', '2023-01-01 12:00:00 +0000 UTC', '2013-01-01 12:00:00 +0000 UTC')
@@ -0,0 +1,7 @@
+INSERT INTO "grafana"."user"
+  (uid, version, login, email, name, org_id, is_admin, is_disabled, email_verified,
+   is_provisioned, is_service_account, salt, rands, created, updated, last_seen_at)
+VALUES
+  ('abcdef', 0, 'sa-2-disabled-service-account', 'sa-2-disabled-service-account', 'Disabled Service Account',
+   2, false, TRUE, false,
+   false, true, '', '', '2023-02-01 10:30:00 +0000 UTC', '2023-02-01 10:30:00 +0000 UTC', '2013-02-01 10:30:00 +0000 UTC')
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
@@ -3,6 +3,7 @@ SELECT
  u.uid,
  u.name,
  u.is_disabled,
+  o.role,
  u.created,
  u.updated
  FROM "grafana"."user" as u JOIN "grafana"."org_user" as o ON u.id = o.user_id
@@ -303,9 +303,9 @@ type CreateUserCommand struct {
 	IsProvisioned bool
 	Salt          string
 	Rands         string
-	Created       time.Time
-	Updated       time.Time
-	LastSeenAt    time.Time
+	Created       DBTime
+	Updated       DBTime
+	LastSeenAt    DBTime
 	Role          string
 }

@@ -317,8 +317,8 @@ type CreateOrgUserCommand struct {
 	OrgID   int64
 	UserID  int64
 	Role    string
-	Created time.Time
-	Updated time.Time
+	Created DBTime
+	Updated DBTime
 }

 type DeleteUserCommand struct {
@@ -395,9 +395,9 @@ func (s *legacySQLStore) CreateUser(ctx context.Context, ns claims.NamespaceInfo

 	cmd.Salt = salt
 	cmd.Rands = rands
-	cmd.Created = now
-	cmd.Updated = now
-	cmd.LastSeenAt = lastSeenAt
+	cmd.Created = NewDBTime(now)
+	cmd.Updated = NewDBTime(now)
+	cmd.LastSeenAt = NewDBTime(lastSeenAt)
 	cmd.Role = "Viewer" // TODO: https://github.com/grafana/identity-access-team/issues/1552

 	sql, err := s.sql(ctx)
@@ -451,9 +451,9 @@ func (s *legacySQLStore) CreateUser(ctx context.Context, ns claims.NamespaceInfo
 			IsProvisioned:    cmd.IsProvisioned,
 			Salt:             cmd.Salt,
 			Rands:            cmd.Rands,
-			Created:          cmd.Created,
-			Updated:          cmd.Updated,
-			LastSeenAt:       cmd.LastSeenAt,
+			Created:          cmd.Created.Time,
+			Updated:          cmd.Updated.Time,
+			LastSeenAt:       cmd.LastSeenAt.Time,
 			IsServiceAccount: false,
 		}

@@ -138,6 +138,7 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 	teamBindingResource := iamv0.TeamBindingResourceInfo
 	storage[teamBindingResource.StoragePath()] = team.NewLegacyBindingStore(b.store)

+	// User store registration
 	userResource := iamv0.UserResourceInfo
 	legacyStore := user.NewLegacyStore(b.store, b.legacyAccessClient, b.enableAuthnMutation)
 	storage[userResource.StoragePath()] = legacyStore
@@ -157,8 +158,26 @@ func (b *IdentityAccessManagementAPIBuilder) UpdateAPIGroupInfo(apiGroupInfo *ge
 	}

 	storage[userResource.StoragePath("teams")] = user.NewLegacyTeamMemberREST(b.store)
+
+	// Service Accounts store registration
 	serviceAccountResource := iamv0.ServiceAccountResourceInfo
-	storage[serviceAccountResource.StoragePath()] = serviceaccount.NewLegacyStore(b.store, b.legacyAccessClient)
+	saLegacyStore := serviceaccount.NewLegacyStore(b.store, b.legacyAccessClient, b.enableAuthnMutation)
+	storage[serviceAccountResource.StoragePath()] = saLegacyStore
+
+	if b.enableDualWriter {
+		store, err := grafanaregistry.NewRegistryStore(opts.Scheme, serviceAccountResource, opts.OptsGetter)
+		if err != nil {
+			return err
+		}
+
+		dw, err := opts.DualWriteBuilder(serviceAccountResource.GroupResource(), saLegacyStore, store)
+		if err != nil {
+			return err
+		}
+
+		storage[serviceAccountResource.StoragePath()] = dw
+	}
+
 	storage[serviceAccountResource.StoragePath("tokens")] = serviceaccount.NewLegacyTokenREST(b.store)

 	if b.sso != nil {
@@ -269,15 +288,21 @@ func (b *IdentityAccessManagementAPIBuilder) GetAuthorizer() authorizer.Authoriz
 func (b *IdentityAccessManagementAPIBuilder) Validate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	switch a.GetOperation() {
 	case admission.Create:
-		if a.GetKind() == iamv0.UserResourceInfo.GroupVersionKind() {
+		switch typedObj := a.GetObject().(type) {
+		case *iamv0.User:
 			return b.validateCreateUser(ctx, a, o)
+		case *iamv0.ServiceAccount:
+			return serviceaccount.ValidateOnCreate(ctx, typedObj)
 		}
 		return nil
-	case admission.Connect:
-	case admission.Delete:
 	case admission.Update:
 		return nil
+	case admission.Delete:
+		return nil
+	case admission.Connect:
+		return nil
 	}
+
 	return nil
 }

@@ -289,7 +314,7 @@ func (b *IdentityAccessManagementAPIBuilder) validateCreateUser(ctx context.Cont

 	requester, err := identity.GetRequester(ctx)
 	if err != nil {
-		return apierrors.NewBadRequest("no identity found")
+		return apierrors.NewUnauthorized("no identity found")
 	}

 	// Temporary validation that the user is not trying to create a Grafana Admin without being a Grafana Admin.
@@ -312,8 +337,11 @@ func (b *IdentityAccessManagementAPIBuilder) validateCreateUser(ctx context.Cont
 func (b *IdentityAccessManagementAPIBuilder) Mutate(ctx context.Context, a admission.Attributes, o admission.ObjectInterfaces) (err error) {
 	switch a.GetOperation() {
 	case admission.Create:
-		if a.GetKind() == iamv0.UserResourceInfo.GroupVersionKind() {
-			return b.mutateUser(ctx, a, o)
+		switch typedObj := a.GetObject().(type) {
+		case *iamv0.User:
+			return user.MutateOnCreate(ctx, typedObj)
+		case *iamv0.ServiceAccount:
+			return serviceaccount.MutateOnCreate(ctx, typedObj)
 		}
 		return nil
 	case admission.Update:
@@ -327,25 +355,6 @@ func (b *IdentityAccessManagementAPIBuilder) Mutate(ctx context.Context, a admis
 	return nil
 }

-func (b *IdentityAccessManagementAPIBuilder) mutateUser(_ context.Context, a admission.Attributes, o admission.ObjectInterfaces) error {
-	userObj, ok := a.GetObject().(*iamv0.User)
-	if !ok {
-		return nil
-	}
-
-	userObj.Spec.Email = strings.ToLower(userObj.Spec.Email)
-	userObj.Spec.Login = strings.ToLower(userObj.Spec.Login)
-
-	if userObj.Spec.Login == "" {
-		userObj.Spec.Login = userObj.Spec.Email
-	}
-	if userObj.Spec.Email == "" {
-		userObj.Spec.Email = userObj.Spec.Login
-	}
-
-	return nil
-}
-
 func NewLocalStore(resourceInfo utils.ResourceInfo, scheme *runtime.Scheme, defaultOptsGetter generic.RESTOptionsGetter,
 	reg prometheus.Registerer, ac types.AccessClient, storageBackend resource.StorageBackend) (grafanarest.Storage, error) {
 	server, err := resource.NewResourceServer(resource.ResourceServerOptions{
@@ -0,0 +1,16 @@
+package serviceaccount
+
+import (
+	"context"
+
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+)
+
+func MutateOnCreate(ctx context.Context, obj *iamv0alpha1.ServiceAccount) error {
+	// External service accounts have None org role by default
+	if obj.Spec.Plugin != "" && obj.Spec.Role == "" {
+		obj.Spec.Role = iamv0alpha1.ServiceAccountOrgRoleNone
+	}
+
+	return nil
+}
@@ -0,0 +1,69 @@
+package serviceaccount
+
+import (
+	"context"
+	"testing"
+
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	"github.com/stretchr/testify/require"
+	"k8s.io/apiserver/pkg/endpoints/request"
+)
+
+func TestMutateOnCreate(t *testing.T) {
+	ctx := request.WithNamespace(context.Background(), "default")
+
+	testCases := []struct {
+		name         string
+		inputSA      *iamv0alpha1.ServiceAccount
+		expectedRole iamv0alpha1.ServiceAccountOrgRole
+	}{
+		{
+			name: "non-external sa with editor role",
+			inputSA: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title: "My Test SA",
+					Role:  iamv0alpha1.ServiceAccountOrgRoleEditor,
+				},
+			},
+			expectedRole: iamv0alpha1.ServiceAccountOrgRoleEditor,
+		},
+		{
+			name: "external sa with admin role is not overridden",
+			inputSA: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title:  "grafana-plugin-name",
+					Plugin: "grafana-plugin-name",
+					Role:   iamv0alpha1.ServiceAccountOrgRoleAdmin,
+				},
+			},
+			expectedRole: iamv0alpha1.ServiceAccountOrgRoleAdmin,
+		},
+		{
+			name: "external sa with no role specified gets none",
+			inputSA: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title:  "sa-1-extsvc-grafana-plugin-name",
+					Plugin: "grafana-plugin-name",
+				},
+			},
+			expectedRole: iamv0alpha1.ServiceAccountOrgRoleNone,
+		},
+		{
+			name: "non-external sa with no role specified",
+			inputSA: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title: "Another SA",
+				},
+			},
+			expectedRole: "", // Role is not mutated if not present and not external
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := MutateOnCreate(ctx, tc.inputSA)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedRole, tc.inputSA.Spec.Role)
+		})
+	}
+}
@@ -3,7 +3,9 @@ package serviceaccount
 import (
 	"context"
 	"fmt"
+	"strings"

+	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	"k8s.io/apimachinery/pkg/apis/meta/internalversion"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -12,9 +14,12 @@ import (
 	claims "github.com/grafana/authlib/types"
 	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
 	"github.com/grafana/grafana/pkg/apimachinery/utils"
+	"github.com/grafana/grafana/pkg/infra/slugify"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/common"
 	"github.com/grafana/grafana/pkg/registry/apis/iam/legacy"
 	"github.com/grafana/grafana/pkg/services/apiserver/endpoints/request"
+	"github.com/grafana/grafana/pkg/services/serviceaccounts"
+	"github.com/grafana/grafana/pkg/util"
 )

 var (
@@ -23,17 +28,85 @@ var (
 	_ rest.Getter               = (*LegacyStore)(nil)
 	_ rest.Lister               = (*LegacyStore)(nil)
 	_ rest.Storage              = (*LegacyStore)(nil)
+	_ rest.CreaterUpdater       = (*LegacyStore)(nil)
+	_ rest.GracefulDeleter      = (*LegacyStore)(nil)
+	_ rest.CollectionDeleter    = (*LegacyStore)(nil)
 )

 var resource = iamv0alpha1.ServiceAccountResourceInfo

-func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient) *LegacyStore {
-	return &LegacyStore{store, ac}
+func NewLegacyStore(store legacy.LegacyIdentityStore, ac claims.AccessClient, enableAuthnMutation bool) *LegacyStore {
+	return &LegacyStore{store, ac, enableAuthnMutation}
 }

 type LegacyStore struct {
-	store legacy.LegacyIdentityStore
-	ac    claims.AccessClient
+	store               legacy.LegacyIdentityStore
+	ac                  claims.AccessClient
+	enableAuthnMutation bool
+}
+
+// DeleteCollection implements rest.CollectionDeleter.
+func (s *LegacyStore) DeleteCollection(ctx context.Context, deleteValidation rest.ValidateObjectFunc, options *metav1.DeleteOptions, listOptions *internalversion.ListOptions) (runtime.Object, error) {
+	return nil, apierrors.NewMethodNotSupported(resource.GroupResource(), "delete")
+}
+
+// Delete implements rest.GracefulDeleter.
+func (s *LegacyStore) Delete(ctx context.Context, name string, deleteValidation rest.ValidateObjectFunc, options *metav1.DeleteOptions) (runtime.Object, bool, error) {
+	return nil, false, apierrors.NewMethodNotSupported(resource.GroupResource(), "delete")
+}
+
+// Update implements rest.Updater.
+func (s *LegacyStore) Update(ctx context.Context, name string, objInfo rest.UpdatedObjectInfo, createValidation rest.ValidateObjectFunc, updateValidation rest.ValidateObjectUpdateFunc, forceAllowCreate bool, options *metav1.UpdateOptions) (runtime.Object, bool, error) {
+	return nil, false, apierrors.NewMethodNotSupported(resource.GroupResource(), "update")
+}
+
+// Create implements rest.Creater.
+func (s *LegacyStore) Create(ctx context.Context, obj runtime.Object, createValidation rest.ValidateObjectFunc, options *metav1.CreateOptions) (runtime.Object, error) {
+	if !s.enableAuthnMutation {
+		return nil, apierrors.NewMethodNotSupported(resource.GroupResource(), "create")
+	}
+
+	ns, err := request.NamespaceInfoFrom(ctx, true)
+	if err != nil {
+		return nil, err
+	}
+
+	saObj, ok := obj.(*iamv0alpha1.ServiceAccount)
+	if !ok {
+		return nil, fmt.Errorf("expected ServiceAccount object, got %T", obj)
+	}
+
+	if saObj.GenerateName != "" {
+		saObj.Name = saObj.GenerateName + util.GenerateShortUID()
+		saObj.GenerateName = ""
+	}
+
+	if createValidation != nil {
+		if err := createValidation(ctx, obj); err != nil {
+			return nil, err
+		}
+	}
+
+	login := serviceaccounts.GenerateLogin(serviceaccounts.ServiceAccountPrefix, ns.OrgID, saObj.Spec.Title)
+	if saObj.Spec.Plugin != "" {
+		login = serviceaccounts.ExtSvcLoginPrefix(ns.OrgID) + slugify.Slugify(saObj.Spec.Title)
+	}
+
+	createCmd := legacy.CreateServiceAccountCommand{
+		IsDisabled: saObj.Spec.Disabled,
+		Name:       saObj.Spec.Title,
+		UID:        saObj.Name,
+		Login:      strings.ToLower(login),
+		Role:       string(saObj.Spec.Role),
+	}
+
+	result, err := s.store.CreateServiceAccount(ctx, ns, createCmd)
+	if err != nil {
+		return nil, err
+	}
+
+	iamSA := s.toSAItem(result.ServiceAccount, ns.Value)
+	return &iamSA, nil
 }

 func (s *LegacyStore) New() runtime.Object {
@@ -72,7 +145,7 @@ func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOpt

 			items := make([]iamv0alpha1.ServiceAccount, 0, len(found.Items))
 			for _, sa := range found.Items {
-				items = append(items, toSAItem(sa, ns.Value))
+				items = append(items, s.toSAItem(sa, ns.Value))
 			}

 			return &common.ListResponse[iamv0alpha1.ServiceAccount]{
@@ -93,7 +166,7 @@ func (s *LegacyStore) List(ctx context.Context, options *internalversion.ListOpt
 	return obj, nil
 }

-func toSAItem(sa legacy.ServiceAccount, ns string) iamv0alpha1.ServiceAccount {
+func (s *LegacyStore) toSAItem(sa legacy.ServiceAccount, ns string) iamv0alpha1.ServiceAccount {
 	item := iamv0alpha1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
 			Name:              sa.UID,
@@ -102,8 +175,10 @@ func toSAItem(sa legacy.ServiceAccount, ns string) iamv0alpha1.ServiceAccount {
 			CreationTimestamp: metav1.NewTime(sa.Created),
 		},
 		Spec: iamv0alpha1.ServiceAccountSpec{
+			Plugin:   extractPluginNameFromTitle(sa.Name),
 			Title:    sa.Name,
 			Disabled: sa.Disabled,
+			Role:     iamv0alpha1.ServiceAccountOrgRole(sa.Role),
 		},
 	}
 	obj, _ := utils.MetaAccessor(&item)
@@ -112,6 +187,13 @@ func toSAItem(sa legacy.ServiceAccount, ns string) iamv0alpha1.ServiceAccount {
 	return item
 }

+func extractPluginNameFromTitle(title string) string {
+	if strings.HasPrefix(title, serviceaccounts.ExtSvcPrefix) {
+		return strings.TrimLeft(title, serviceaccounts.ExtSvcPrefix)
+	}
+	return ""
+}
+
 func (s *LegacyStore) Get(ctx context.Context, name string, options *metav1.GetOptions) (runtime.Object, error) {
 	ns, err := request.NamespaceInfoFrom(ctx, true)
 	if err != nil {
@@ -130,6 +212,6 @@ func (s *LegacyStore) Get(ctx context.Context, name string, options *metav1.GetO
 		return nil, resource.NewNotFound(name)
 	}

-	res := toSAItem(found.Items[0], ns.Value)
+	res := s.toSAItem(found.Items[0], ns.Value)
 	return &res, nil
 }
@@ -0,0 +1,58 @@
+package serviceaccount
+
+import (
+	"context"
+	"fmt"
+	"strings"
+
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+
+	"github.com/grafana/authlib/types"
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/services/serviceaccounts"
+)
+
+func ValidateOnCreate(ctx context.Context, obj *iamv0alpha1.ServiceAccount) error {
+	if obj.Spec.Title == "" {
+		return apierrors.NewBadRequest("service account must have a title")
+	}
+
+	requester, err := identity.GetRequester(ctx)
+	if err != nil {
+		return apierrors.NewUnauthorized("no identity found")
+	}
+
+	requestedRole := identity.RoleType(obj.Spec.Role)
+	if !requestedRole.IsValid() {
+		return apierrors.NewBadRequest(fmt.Sprintf("invalid role: %s", requestedRole))
+	}
+
+	if obj.Spec.Plugin != "" {
+		if !strings.HasPrefix(obj.Spec.Title, serviceaccounts.ExtSvcPrefix) {
+			return apierrors.NewBadRequest("title of external service accounts must start with " + serviceaccounts.ExtSvcPrefix)
+		}
+
+		if !strings.HasSuffix(obj.Spec.Title, strings.ToLower(obj.Spec.Plugin)) {
+			return apierrors.NewBadRequest("title of external service accounts must end with " + strings.ToLower(obj.Spec.Plugin))
+		}
+
+		if !requester.IsIdentityType(types.TypeAccessPolicy) {
+			return apierrors.NewForbidden(iamv0alpha1.ServiceAccountResourceInfo.GroupResource(),
+				obj.Name,
+				fmt.Errorf("only service identities can create external service accounts"))
+		}
+
+		if obj.Spec.Role != iamv0alpha1.ServiceAccountOrgRoleNone {
+			return apierrors.NewBadRequest("external service accounts must have role None")
+		}
+	}
+
+	if !requester.HasRole(requestedRole) {
+		return apierrors.NewForbidden(iamv0alpha1.ServiceAccountResourceInfo.GroupResource(),
+			obj.Name,
+			fmt.Errorf("can not assign a role higher than user's role"))
+	}
+
+	return nil
+}
@@ -0,0 +1,195 @@
+package serviceaccount
+
+import (
+	"context"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/grafana/authlib/types"
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	"github.com/grafana/grafana/pkg/apimachinery/identity"
+	"github.com/grafana/grafana/pkg/services/serviceaccounts"
+)
+
+func TestValidateOnCreate(t *testing.T) {
+	tests := []struct {
+		name           string
+		serviceAccount *iamv0alpha1.ServiceAccount
+		requester      *identity.StaticRequester
+		expectError    bool
+		errorContains  string
+	}{
+		{
+			name: "valid service account with user requester",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title: "Test Service Account",
+					Role:  iamv0alpha1.ServiceAccountOrgRoleViewer,
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError: false,
+		},
+		{
+			name: "empty title",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title: "",
+					Role:  iamv0alpha1.ServiceAccountOrgRoleViewer,
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError:   true,
+			errorContains: "service account must have a title",
+		},
+		{
+			name: "invalid role",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title: "Test Service Account",
+					Role:  "InvalidRole",
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError:   true,
+			errorContains: "invalid role",
+		},
+		{
+			name: "role higher than requester's role",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title: "Test Service Account",
+					Role:  iamv0alpha1.ServiceAccountOrgRoleAdmin,
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleViewer,
+			},
+			expectError:   true,
+			errorContains: "can not assign a role higher than user's role",
+		},
+		{
+			name: "external service account - valid",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title:  serviceaccounts.ExtSvcPrefix + "test-plugin",
+					Role:   iamv0alpha1.ServiceAccountOrgRoleNone,
+					Plugin: "test-plugin",
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeAccessPolicy,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError: false,
+		},
+		{
+			name: "external service account - invalid title prefix",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title:  "invalid-prefix-test",
+					Role:   iamv0alpha1.ServiceAccountOrgRoleNone,
+					Plugin: "test",
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeAccessPolicy,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError:   true,
+			errorContains: "title of external service accounts must start with " + serviceaccounts.ExtSvcPrefix,
+		},
+		{
+			name: "external service account - invalid title suffix",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title:  serviceaccounts.ExtSvcPrefix + "wrong-suffix",
+					Role:   iamv0alpha1.ServiceAccountOrgRoleNone,
+					Plugin: "test",
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeAccessPolicy,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError:   true,
+			errorContains: "title of external service accounts must end with test",
+		},
+		{
+			name: "external service account - non-access-policy requester",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title:  serviceaccounts.ExtSvcPrefix + "test-test",
+					Role:   iamv0alpha1.ServiceAccountOrgRoleNone,
+					Plugin: "test",
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeUser,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError:   true,
+			errorContains: "only service identities can create external service accounts",
+		},
+		{
+			name: "external service account - role not None",
+			serviceAccount: &iamv0alpha1.ServiceAccount{
+				Spec: iamv0alpha1.ServiceAccountSpec{
+					Title:  serviceaccounts.ExtSvcPrefix + "test-test",
+					Role:   iamv0alpha1.ServiceAccountOrgRoleViewer,
+					Plugin: "test",
+				},
+			},
+			requester: &identity.StaticRequester{
+				Type:    types.TypeAccessPolicy,
+				OrgRole: identity.RoleAdmin,
+			},
+			expectError:   true,
+			errorContains: "external service accounts must have role None",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			ctx := identity.WithRequester(
+				context.Background(),
+				tt.requester,
+			)
+
+			err := ValidateOnCreate(ctx, tt.serviceAccount)
+
+			if tt.expectError {
+				require.Error(t, err)
+				if tt.errorContains != "" {
+					require.Contains(t, err.Error(), tt.errorContains)
+				}
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
+func TestValidateOnCreate_NoRequester(t *testing.T) {
+	serviceAccount := &iamv0alpha1.ServiceAccount{
+		Spec: iamv0alpha1.ServiceAccountSpec{
+			Title: "Test Service Account",
+			Role:  iamv0alpha1.ServiceAccountOrgRoleViewer,
+		},
+	}
+
+	err := ValidateOnCreate(context.Background(), serviceAccount)
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "no identity found")
+}
@@ -0,0 +1,22 @@
+package user
+
+import (
+	"context"
+	"strings"
+
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+)
+
+func MutateOnCreate(ctx context.Context, obj *iamv0alpha1.User) error {
+	obj.Spec.Email = strings.ToLower(obj.Spec.Email)
+	obj.Spec.Login = strings.ToLower(obj.Spec.Login)
+
+	if obj.Spec.Login == "" {
+		obj.Spec.Login = obj.Spec.Email
+	}
+	if obj.Spec.Email == "" {
+		obj.Spec.Email = obj.Spec.Login
+	}
+
+	return nil
+}
@@ -0,0 +1,78 @@
+package user
+
+import (
+	"context"
+	"testing"
+
+	iamv0alpha1 "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMutateOnCreate_LoginEmail(t *testing.T) {
+	testCases := []struct {
+		name          string
+		inputUser     *iamv0alpha1.User
+		expectedLogin string
+		expectedEmail string
+	}{
+		{
+			name: "login and email provided with mixed case",
+			inputUser: &iamv0alpha1.User{
+				Spec: iamv0alpha1.UserSpec{
+					Login: "Test.User",
+					Email: "Test.User@example.com",
+				},
+			},
+			expectedLogin: "test.user",
+			expectedEmail: "test.user@example.com",
+		},
+		{
+			name: "only email provided",
+			inputUser: &iamv0alpha1.User{
+				Spec: iamv0alpha1.UserSpec{
+					Email: "Only.Email@example.com",
+				},
+			},
+			expectedLogin: "only.email@example.com",
+			expectedEmail: "only.email@example.com",
+		},
+		{
+			name: "only login provided",
+			inputUser: &iamv0alpha1.User{
+				Spec: iamv0alpha1.UserSpec{
+					Login: "Only.Login",
+				},
+			},
+			expectedLogin: "only.login",
+			expectedEmail: "only.login",
+		},
+		{
+			name: "login and email already lowercase",
+			inputUser: &iamv0alpha1.User{
+				Spec: iamv0alpha1.UserSpec{
+					Login: "already.lower",
+					Email: "already.lower@example.com",
+				},
+			},
+			expectedLogin: "already.lower",
+			expectedEmail: "already.lower@example.com",
+		},
+		{
+			name: "both login and email are empty",
+			inputUser: &iamv0alpha1.User{
+				Spec: iamv0alpha1.UserSpec{},
+			},
+			expectedLogin: "",
+			expectedEmail: "",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			err := MutateOnCreate(context.Background(), tc.inputUser)
+			require.NoError(t, err)
+			require.Equal(t, tc.expectedLogin, tc.inputUser.Spec.Login)
+			require.Equal(t, tc.expectedEmail, tc.inputUser.Spec.Email)
+		})
+	}
+}
@@ -43,22 +43,9 @@ func ProvideServiceAccountsStore(cfg *setting.Cfg, store db.DB, apiKeyService ap
 	}
 }

-// generateLogin makes a generated string to have a ID for the service account across orgs and it's name
-// this causes you to create a service account with the same name in different orgs
-// not the same name in the same org
-// -- WARNING:
-// -- if you change this function you need to change the ExtSvcLoginPrefix as well
-// -- to make sure they are not considered as regular service accounts
-func generateLogin(prefix string, orgId int64, name string) string {
-	generatedLogin := fmt.Sprintf("%v-%v-%v", prefix, orgId, strings.ToLower(name))
-	// in case the name has multiple spaces or dashes in the prefix or otherwise, replace them with a single dash
-	generatedLogin = strings.Replace(generatedLogin, "--", "-", 1)
-	return strings.ReplaceAll(generatedLogin, " ", "-")
-}
-
 // CreateServiceAccount creates service account
 func (s *ServiceAccountsStoreImpl) CreateServiceAccount(ctx context.Context, orgId int64, saForm *serviceaccounts.CreateServiceAccountForm) (*serviceaccounts.ServiceAccountDTO, error) {
-	login := generateLogin(serviceaccounts.ServiceAccountPrefix, orgId, saForm.Name)
+	login := serviceaccounts.GenerateLogin(serviceaccounts.ServiceAccountPrefix, orgId, saForm.Name)
 	isDisabled := false
 	role := org.RoleViewer
 	if saForm.IsDisabled != nil {
@@ -483,7 +470,7 @@ func (s *ServiceAccountsStoreImpl) MigrateApiKeysToServiceAccounts(ctx context.C
 func (s *ServiceAccountsStoreImpl) CreateServiceAccountFromApikey(ctx context.Context, key *apikey.APIKey) error {
 	prefix := "sa-autogen"
 	cmd := user.CreateUserCommand{
-		Login:            generateLogin(prefix, key.OrgID, key.Name),
+		Login:            serviceaccounts.GenerateLogin(prefix, key.OrgID, key.Name),
 		Name:             fmt.Sprintf("%v-%v", prefix, key.Name),
 		OrgID:            key.OrgID,
 		DefaultOrgRole:   string(key.Role),
@@ -501,7 +488,7 @@ func (s *ServiceAccountsStoreImpl) CreateServiceAccountFromApikey(ctx context.Co
 				// a unique service account by adding suffixes to the initial login name (e.g. -001, -002, ... , -010).
 				for i := 1; errCreateSA != nil && i <= attempts; i++ {
 					serviceAccountName := fmt.Sprintf("%s-%03d", key.Name, i)
-					cmd.Login = generateLogin(prefix, key.OrgID, serviceAccountName)
+					cmd.Login = serviceaccounts.GenerateLogin(prefix, key.OrgID, serviceAccountName)
 					newSA, errCreateSA = s.userService.CreateServiceAccount(tctx, &cmd)
 					if errCreateSA != nil && !errors.Is(errCreateSA, serviceaccounts.ErrServiceAccountAlreadyExists) {
 						break
@@ -1,8 +1,6 @@
 package serviceaccounts

 import (
-	"fmt"
-	"strings"
 	"time"

 	"github.com/grafana/grafana/pkg/apimachinery/errutil"
@@ -217,16 +215,3 @@ var AccessEvaluator = accesscontrol.EvalAny(
 	accesscontrol.EvalPermission(ActionRead),
 	accesscontrol.EvalPermission(ActionCreate),
 )
-
-func ExtSvcLoginPrefix(orgID int64) string {
-	return fmt.Sprintf("%s%d-%s", ServiceAccountPrefix, orgID, ExtSvcPrefix)
-}
-
-func IsExternalServiceAccount(login string) bool {
-	parts := strings.SplitAfter(login, "-")
-	if len(parts) < 4 {
-		return false
-	}
-
-	return parts[0] == ServiceAccountPrefix && parts[2] == ExtSvcPrefix
-}
@@ -0,0 +1,32 @@
+package serviceaccounts
+
+import (
+	"fmt"
+	"strings"
+)
+
+// generateLogin makes a generated string to have a ID for the service account across orgs and it's name
+// this causes you to create a service account with the same name in different orgs
+// not the same name in the same org
+// -- WARNING:
+// -- if you change this function you need to change the ExtSvcLoginPrefix as well
+// -- to make sure they are not considered as regular service accounts
+func GenerateLogin(prefix string, orgId int64, name string) string {
+	generatedLogin := fmt.Sprintf("%v-%v-%v", prefix, orgId, strings.ToLower(name))
+	// in case the name has multiple spaces or dashes in the prefix or otherwise, replace them with a single dash
+	generatedLogin = strings.Replace(generatedLogin, "--", "-", 1)
+	return strings.ReplaceAll(generatedLogin, " ", "-")
+}
+
+func ExtSvcLoginPrefix(orgID int64) string {
+	return fmt.Sprintf("%s%d-%s", ServiceAccountPrefix, orgID, ExtSvcPrefix)
+}
+
+func IsExternalServiceAccount(login string) bool {
+	parts := strings.SplitAfter(login, "-")
+	if len(parts) < 4 {
+		return false
+	}
+
+	return parts[0] == ServiceAccountPrefix && parts[2] == ExtSvcPrefix
+}
@@ -0,0 +1,274 @@
+package identity
+
+import (
+	"context"
+	"fmt"
+	"testing"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+
+	"github.com/grafana/grafana/pkg/apiserver/rest"
+	"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
+	"github.com/grafana/grafana/pkg/services/featuremgmt"
+	"github.com/grafana/grafana/pkg/services/org"
+	"github.com/grafana/grafana/pkg/services/serviceaccounts"
+	"github.com/grafana/grafana/pkg/setting"
+	"github.com/grafana/grafana/pkg/tests/apis"
+	"github.com/grafana/grafana/pkg/tests/testinfra"
+	"github.com/stretchr/testify/require"
+	"k8s.io/apimachinery/pkg/api/errors"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+)
+
+var gvrServiceAccounts = schema.GroupVersionResource{
+	Group:    "iam.grafana.app",
+	Version:  "v0alpha1",
+	Resource: "serviceaccounts",
+}
+
+func TestIntegrationServiceAccounts(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test")
+	}
+
+	// TODO: Figure out why rest.Mode4 is failing
+	modes := []rest.DualWriterMode{rest.Mode0, rest.Mode1, rest.Mode2, rest.Mode3}
+	for _, mode := range modes {
+		t.Run(fmt.Sprintf("Service Account CRUD operations with dual writer mode %d", mode), func(t *testing.T) {
+			helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
+				AppModeProduction:    false,
+				DisableAnonymous:     true,
+				APIServerStorageType: "unified",
+				UnifiedStorageConfig: map[string]setting.UnifiedStorageConfig{
+					"serviceaccounts.iam.grafana.app": {
+						DualWriterMode: mode,
+					},
+				},
+				EnableFeatureToggles: []string{
+					featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs,
+					featuremgmt.FlagKubernetesAuthnMutation,
+				},
+			})
+			doServiceAccountCRUDTestsUsingTheNewAPIs(t, helper)
+
+			if mode < 3 {
+				doServiceAccountCRUDTestsUsingTheLegacyAPIs(t, helper)
+			}
+		})
+	}
+}
+
+func doServiceAccountCRUDTestsUsingTheNewAPIs(t *testing.T, helper *apis.K8sTestHelper) {
+	t.Run("should create service account and get it using the new APIs as a GrafanaAdmin", func(t *testing.T) {
+		ctx := context.Background()
+
+		saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Admin,
+			Namespace: helper.Namespacer(helper.Org1.Admin.Identity.GetOrgID()),
+			GVR:       gvrServiceAccounts,
+		})
+
+		created, err := saClient.Resource.Create(ctx, helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-create-v0.yaml"), metav1.CreateOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, created)
+
+		createdSpec := created.Object["spec"].(map[string]interface{})
+		require.Equal(t, "Test Service Account 1", createdSpec["title"])
+		require.Equal(t, false, createdSpec["disabled"])
+		require.Empty(t, createdSpec["plugin"])
+
+		createdUID := created.GetName()
+		require.NotEmpty(t, createdUID)
+
+		_, err = saClient.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+
+		fetched, err := saClient.Resource.Get(ctx, createdUID, metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, fetched)
+
+		fetchedSpec := fetched.Object["spec"].(map[string]interface{})
+		require.Equal(t, "Test Service Account 1", fetchedSpec["title"])
+		require.Equal(t, false, fetchedSpec["disabled"])
+		require.Empty(t, fetchedSpec["plugin"])
+
+		require.Equal(t, createdUID, fetched.GetName())
+		require.Equal(t, "default", fetched.GetNamespace())
+	})
+
+	t.Run("should not be able to create service account when using a user with insufficient permissions", func(t *testing.T) {
+		for _, user := range []apis.User{
+			helper.Org1.Editor,
+			helper.Org1.Viewer,
+		} {
+			t.Run(fmt.Sprintf("with basic role_%s", user.Identity.GetOrgRole()), func(t *testing.T) {
+				ctx := context.Background()
+				saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+					User:      user,
+					Namespace: helper.Namespacer(helper.Org1.Admin.Identity.GetOrgID()),
+					GVR:       gvrServiceAccounts,
+				})
+
+				_, err := saClient.Resource.Create(ctx, helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-create-v0.yaml"), metav1.CreateOptions{})
+				require.Error(t, err)
+				var statusErr *errors.StatusError
+				require.ErrorAs(t, err, &statusErr)
+				require.Equal(t, int32(403), statusErr.ErrStatus.Code)
+			})
+		}
+	})
+
+	t.Run("should not be able to create service account with invalid role", func(t *testing.T) {
+		ctx := context.Background()
+		saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Admin,
+			Namespace: helper.Namespacer(helper.Org1.Admin.Identity.GetOrgID()),
+			GVR:       gvrServiceAccounts,
+		})
+
+		saToCreate := helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-invalid-role-v0.yaml")
+
+		_, err := saClient.Resource.Create(ctx, saToCreate, metav1.CreateOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(400), statusErr.ErrStatus.Code)
+		require.Contains(t, statusErr.ErrStatus.Message, "invalid role: InvalidRole")
+	})
+
+	t.Run("should not be able to create service account with higher role than the user", func(t *testing.T) {
+		ctx := context.Background()
+
+		editorWithSACreate := helper.CreateUser("custom-editor", apis.Org1, org.RoleEditor,
+			[]resourcepermissions.SetResourcePermissionCommand{
+				{Actions: []string{serviceaccounts.ActionCreate}},
+			})
+
+		saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      editorWithSACreate,
+			Namespace: helper.Namespacer(editorWithSACreate.Identity.GetOrgID()),
+			GVR:       gvrServiceAccounts,
+		})
+
+		saToCreate := helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-higher-role-v0.yaml")
+
+		_, err := saClient.Resource.Create(ctx, saToCreate, metav1.CreateOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(403), statusErr.ErrStatus.Code)
+		require.Contains(t, statusErr.ErrStatus.Message, "can not assign a role higher than user's role")
+	})
+
+	t.Run("should not be able to create service account without a title", func(t *testing.T) {
+		ctx := context.Background()
+		saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Admin,
+			Namespace: helper.Namespacer(helper.Org1.Admin.Identity.GetOrgID()),
+			GVR:       gvrServiceAccounts,
+		})
+
+		saToCreate := helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-no-title-v0.yaml")
+
+		_, err := saClient.Resource.Create(ctx, saToCreate, metav1.CreateOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(400), statusErr.ErrStatus.Code)
+		require.Contains(t, statusErr.ErrStatus.Message, "service account must have a title")
+	})
+
+	t.Run("should not be able to create external service account as a user", func(t *testing.T) {
+		ctx := context.Background()
+		saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Admin,
+			Namespace: helper.Namespacer(helper.Org1.Admin.Identity.GetOrgID()),
+			GVR:       gvrServiceAccounts,
+		})
+
+		saToCreate := helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-external-v0.yaml")
+
+		_, err := saClient.Resource.Create(ctx, saToCreate, metav1.CreateOptions{})
+		require.Error(t, err)
+		var statusErr *errors.StatusError
+		require.ErrorAs(t, err, &statusErr)
+		require.Equal(t, int32(403), statusErr.ErrStatus.Code)
+		require.Contains(t, statusErr.ErrStatus.Message, "only service identities can create external service accounts")
+	})
+
+	t.Run("should create service account with generateName and get it using the new APIs as a GrafanaAdmin", func(t *testing.T) {
+		ctx := context.Background()
+
+		saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User:      helper.Org1.Admin,
+			Namespace: helper.Namespacer(helper.Org1.Admin.Identity.GetOrgID()),
+			GVR:       gvrServiceAccounts,
+		})
+
+		created, err := saClient.Resource.Create(ctx, helper.LoadYAMLOrJSONFile("testdata/serviceaccount-test-generate-name-v0.yaml"), metav1.CreateOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, created)
+
+		createdSpec := created.Object["spec"].(map[string]interface{})
+		require.Equal(t, "Test Service Account with GenerateName", createdSpec["title"])
+		require.Equal(t, false, createdSpec["disabled"])
+		require.Empty(t, createdSpec["plugin"])
+
+		createdUID := created.GetName()
+		require.NotEmpty(t, createdUID)
+		require.Contains(t, createdUID, "sa-")
+
+		_, err = saClient.Resource.List(ctx, metav1.ListOptions{})
+		require.NoError(t, err)
+
+		fetched, err := saClient.Resource.Get(ctx, createdUID, metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, fetched)
+
+		fetchedSpec := fetched.Object["spec"].(map[string]interface{})
+		require.Equal(t, "Test Service Account with GenerateName", fetchedSpec["title"])
+		require.Equal(t, false, fetchedSpec["disabled"])
+		require.Empty(t, fetchedSpec["plugin"])
+
+		require.Equal(t, createdUID, fetched.GetName())
+		require.Equal(t, "default", fetched.GetNamespace())
+	})
+}
+
+func doServiceAccountCRUDTestsUsingTheLegacyAPIs(t *testing.T, helper *apis.K8sTestHelper) {
+	t.Run("should create service account using legacy APIs and get it using the new APIs", func(t *testing.T) {
+		ctx := context.Background()
+		saClient := helper.GetResourceClient(apis.ResourceClientArgs{
+			User: helper.Org1.Admin,
+			GVR:  gvrServiceAccounts,
+		})
+
+		legacySAPayload := `{
+			"name": "Test Service Account 2",
+			"role": "Viewer"
+		}`
+
+		rsp := apis.DoRequest(helper, apis.RequestParams{
+			User:   helper.Org1.Admin,
+			Method: "POST",
+			Path:   "/api/serviceaccounts",
+			Body:   []byte(legacySAPayload),
+		}, &serviceaccounts.ServiceAccountDTO{})
+
+		require.NotNil(t, rsp)
+		require.Equal(t, 201, rsp.Response.StatusCode)
+		require.NotEmpty(t, rsp.Result.UID)
+
+		sa, err := saClient.Resource.Get(ctx, rsp.Result.UID, metav1.GetOptions{})
+		require.NoError(t, err)
+		require.NotNil(t, sa)
+
+		saSpec := sa.Object["spec"].(map[string]interface{})
+		require.Equal(t, "Test Service Account 2", saSpec["title"])
+		require.Equal(t, false, saSpec["disabled"])
+		require.Empty(t, saSpec["plugin"])
+
+		require.Equal(t, rsp.Result.UID, sa.GetName())
+		require.Equal(t, "default", sa.GetNamespace())
+	})
+}
@@ -0,0 +1,9 @@
+apiVersion: iam.grafana.app/v0alpha1
+kind: ServiceAccount
+metadata:
+  name: test-sa-1
+spec:
+  title: "Test Service Account 1"
+  disabled: false
+  role: Editor
+  
@@ -0,0 +1,9 @@
+apiVersion: iam.grafana.app/v0alpha1
+kind: ServiceAccount
+metadata:
+  name: sa-external
+spec:
+  title: "extsvc-grafana-plugin-name"
+  role: Viewer
+  plugin: grafana-plugin-name
+  
@@ -0,0 +1,7 @@
+apiVersion: iam.grafana.app/v0alpha1
+kind: ServiceAccount
+metadata:
+  generateName: sa-
+spec:
+  title: Test Service Account with GenerateName
+  role: Viewer
@@ -0,0 +1,7 @@
+apiVersion: iam.grafana.app/v0alpha1
+kind: ServiceAccount
+metadata:
+  name: sa-with-higher-role
+spec:
+  title: SA with higher role
+  role: Admin
@@ -0,0 +1,7 @@
+apiVersion: iam.grafana.app/v0alpha1
+kind: ServiceAccount
+metadata:
+  name: sa-with-invalid-role
+spec:
+  title: SA with invalid role
+  role: InvalidRole
@@ -0,0 +1,7 @@
+apiVersion: iam.grafana.app/v0alpha1
+kind: ServiceAccount
+metadata:
+  name: sa-with-no-title
+spec:
+  title: ""
+  role: Viewer
@@ -7,4 +7,5 @@ spec:
  email: testuser1@example123.com
  login: testuser1
  name: Test User 1
-  provisioned: false
+  provisioned: false
+  
@@ -89,6 +89,98 @@
        ],
        "description": "list objects of kind ServiceAccount",
        "operationId": "listServiceAccount",
+        "parameters": [
+          {
+            "name": "allowWatchBookmarks",
+            "in": "query",
+            "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "continue",
+            "in": "query",
+            "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldSelector",
+            "in": "query",
+            "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "labelSelector",
+            "in": "query",
+            "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.",
+            "schema": {
+              "type": "integer",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "resourceVersion",
+            "in": "query",
+            "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "resourceVersionMatch",
+            "in": "query",
+            "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "sendInitialEvents",
+            "in": "query",
+            "description": "`sendInitialEvents=true` may be set together with `watch=true`. In that case, the watch stream will begin with synthetic events to produce the current state of objects in the collection. Once all such events have been sent, a synthetic \"Bookmark\" event  will be sent. The bookmark will report the ResourceVersion (RV) corresponding to the set of objects, and be marked with `\"k8s.io/initial-events-end\": \"true\"` annotation. Afterwards, the watch stream will proceed as usual, sending watch events corresponding to changes (subsequent to the RV) to objects watched.\n\nWhen `sendInitialEvents` option is set, we require `resourceVersionMatch` option to also be set. The semantic of the watch request is as following: - `resourceVersionMatch` = NotOlderThan\n  is interpreted as \"data at least as new as the provided `resourceVersion`\"\n  and the bookmark event is send when the state is synced\n  to a `resourceVersion` at least as fresh as the one provided by the ListOptions.\n  If `resourceVersion` is unset, this is interpreted as \"consistent read\" and the\n  bookmark event is send when the state is synced at least to the moment\n  when request started being processed.\n- `resourceVersionMatch` set to any other value or unset\n  Invalid error is returned.\n\nDefaults to true if `resourceVersion=\"\"` or `resourceVersion=\"0\"` (for backward compatibility reasons) and to false otherwise.",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "timeoutSeconds",
+            "in": "query",
+            "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.",
+            "schema": {
+              "type": "integer",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "watch",
+            "in": "query",
+            "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          }
+        ],
        "responses": {
          "200": {
            "description": "OK",
@@ -128,52 +220,285 @@
          "kind": "ServiceAccount"
        }
      },
+      "post": {
+        "tags": [
+          "ServiceAccount"
+        ],
+        "description": "create a ServiceAccount",
+        "operationId": "createServiceAccount",
+        "parameters": [
+          {
+            "name": "dryRun",
+            "in": "query",
+            "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldManager",
+            "in": "query",
+            "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldValidation",
+            "in": "query",
+            "description": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+              }
+            },
+            "application/vnd.kubernetes.protobuf": {
+              "schema": {
+                "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+              }
+            },
+            "application/yaml": {
+              "schema": {
+                "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              }
+            }
+          },
+          "202": {
+            "description": "Accepted",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              }
+            }
+          }
+        },
+        "x-kubernetes-action": "post",
+        "x-kubernetes-group-version-kind": {
+          "group": "iam.grafana.app",
+          "version": "v0alpha1",
+          "kind": "ServiceAccount"
+        }
+      },
+      "delete": {
+        "tags": [
+          "ServiceAccount"
+        ],
+        "description": "delete collection of ServiceAccount",
+        "operationId": "deletecollectionServiceAccount",
+        "parameters": [
+          {
+            "name": "continue",
+            "in": "query",
+            "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "dryRun",
+            "in": "query",
+            "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldSelector",
+            "in": "query",
+            "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "gracePeriodSeconds",
+            "in": "query",
+            "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.",
+            "schema": {
+              "type": "integer",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "ignoreStoreReadErrorWithClusterBreakingPotential",
+            "in": "query",
+            "description": "if set to true, it will trigger an unsafe deletion of the resource in case the normal deletion flow fails with a corrupt object error. A resource is considered corrupt if it can not be retrieved from the underlying storage successfully because of a) its data can not be transformed e.g. decryption failure, or b) it fails to decode into an object. NOTE: unsafe deletion ignores finalizer constraints, skips precondition checks, and removes the object from the storage. WARNING: This may potentially break the cluster if the workload associated with the resource being unsafe-deleted relies on normal deletion flow. Use only if you REALLY know what you are doing. The default value is false, and the user must opt in to enable it",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "labelSelector",
+            "in": "query",
+            "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.",
+            "schema": {
+              "type": "integer",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "orphanDependents",
+            "in": "query",
+            "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "propagationPolicy",
+            "in": "query",
+            "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "resourceVersion",
+            "in": "query",
+            "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "resourceVersionMatch",
+            "in": "query",
+            "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "sendInitialEvents",
+            "in": "query",
+            "description": "`sendInitialEvents=true` may be set together with `watch=true`. In that case, the watch stream will begin with synthetic events to produce the current state of objects in the collection. Once all such events have been sent, a synthetic \"Bookmark\" event  will be sent. The bookmark will report the ResourceVersion (RV) corresponding to the set of objects, and be marked with `\"k8s.io/initial-events-end\": \"true\"` annotation. Afterwards, the watch stream will proceed as usual, sending watch events corresponding to changes (subsequent to the RV) to objects watched.\n\nWhen `sendInitialEvents` option is set, we require `resourceVersionMatch` option to also be set. The semantic of the watch request is as following: - `resourceVersionMatch` = NotOlderThan\n  is interpreted as \"data at least as new as the provided `resourceVersion`\"\n  and the bookmark event is send when the state is synced\n  to a `resourceVersion` at least as fresh as the one provided by the ListOptions.\n  If `resourceVersion` is unset, this is interpreted as \"consistent read\" and the\n  bookmark event is send when the state is synced at least to the moment\n  when request started being processed.\n- `resourceVersionMatch` set to any other value or unset\n  Invalid error is returned.\n\nDefaults to true if `resourceVersion=\"\"` or `resourceVersion=\"0\"` (for backward compatibility reasons) and to false otherwise.",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "timeoutSeconds",
+            "in": "query",
+            "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.",
+            "schema": {
+              "type": "integer",
+              "uniqueItems": true
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              }
+            }
+          }
+        },
+        "x-kubernetes-action": "deletecollection",
+        "x-kubernetes-group-version-kind": {
+          "group": "iam.grafana.app",
+          "version": "v0alpha1",
+          "kind": "ServiceAccount"
+        }
+      },
      "parameters": [
-        {
-          "name": "allowWatchBookmarks",
-          "in": "query",
-          "description": "allowWatchBookmarks requests watch events with type \"BOOKMARK\". Servers that do not implement bookmarks may ignore this flag and bookmarks are sent at the server's discretion. Clients should not assume bookmarks are returned at any specific interval, nor may they assume the server will send any BOOKMARK event during a session. If this is not a watch, this field is ignored.",
-          "schema": {
-            "type": "boolean",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "continue",
-          "in": "query",
-          "description": "The continue option should be set when retrieving more results from the server. Since this value is server defined, clients may only use the continue value from a previous query result with identical query parameters (except for the value of continue) and the server may reject a continue value it does not recognize. If the specified continue value is no longer valid whether due to expiration (generally five to fifteen minutes) or a configuration change on the server, the server will respond with a 410 ResourceExpired error together with a continue token. If the client needs a consistent list, it must restart their list without the continue field. Otherwise, the client may send another list request with the token received with the 410 error, the server will respond with a list starting from the next key, but from the latest snapshot, which is inconsistent from the previous list results - objects that are created, modified, or deleted after the first list request will be included in the response, as long as their keys are after the \"next key\".\n\nThis field is not supported when watch is true. Clients may start a watch from the last resourceVersion value returned by the server and not miss any modifications.",
-          "schema": {
-            "type": "string",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "fieldSelector",
-          "in": "query",
-          "description": "A selector to restrict the list of returned objects by their fields. Defaults to everything.",
-          "schema": {
-            "type": "string",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "labelSelector",
-          "in": "query",
-          "description": "A selector to restrict the list of returned objects by their labels. Defaults to everything.",
-          "schema": {
-            "type": "string",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "limit",
-          "in": "query",
-          "description": "limit is a maximum number of responses to return for a list call. If more items exist, the server will set the `continue` field on the list metadata to a value that can be used with the same initial query to retrieve the next set of results. Setting a limit may return fewer than the requested amount of items (up to zero items) in the event all requested objects are filtered out and clients should only use the presence of the continue field to determine whether more results are available. Servers may choose not to support the limit argument and will return all of the available results. If limit is specified and the continue field is empty, clients may assume that no more results are available. This field is not supported if watch is true.\n\nThe server guarantees that the objects returned when using continue will be identical to issuing a single list call without a limit - that is, no objects created, modified, or deleted after the first request is issued will be included in any subsequent continued requests. This is sometimes referred to as a consistent snapshot, and ensures that a client that is using limit to receive smaller chunks of a very large result can ensure they see all possible objects. If objects are updated during a chunked list the version of the object that was present at the time the first list result was calculated is returned.",
-          "schema": {
-            "type": "integer",
-            "uniqueItems": true
-          }
-        },
        {
          "name": "namespace",
          "in": "path",
@@ -192,51 +517,6 @@
            "type": "string",
            "uniqueItems": true
          }
-        },
-        {
-          "name": "resourceVersion",
-          "in": "query",
-          "description": "resourceVersion sets a constraint on what resource versions a request may be served from. See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
-          "schema": {
-            "type": "string",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "resourceVersionMatch",
-          "in": "query",
-          "description": "resourceVersionMatch determines how resourceVersion is applied to list calls. It is highly recommended that resourceVersionMatch be set for list calls where resourceVersion is set See https://kubernetes.io/docs/reference/using-api/api-concepts/#resource-versions for details.\n\nDefaults to unset",
-          "schema": {
-            "type": "string",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "sendInitialEvents",
-          "in": "query",
-          "description": "`sendInitialEvents=true` may be set together with `watch=true`. In that case, the watch stream will begin with synthetic events to produce the current state of objects in the collection. Once all such events have been sent, a synthetic \"Bookmark\" event  will be sent. The bookmark will report the ResourceVersion (RV) corresponding to the set of objects, and be marked with `\"k8s.io/initial-events-end\": \"true\"` annotation. Afterwards, the watch stream will proceed as usual, sending watch events corresponding to changes (subsequent to the RV) to objects watched.\n\nWhen `sendInitialEvents` option is set, we require `resourceVersionMatch` option to also be set. The semantic of the watch request is as following: - `resourceVersionMatch` = NotOlderThan\n  is interpreted as \"data at least as new as the provided `resourceVersion`\"\n  and the bookmark event is send when the state is synced\n  to a `resourceVersion` at least as fresh as the one provided by the ListOptions.\n  If `resourceVersion` is unset, this is interpreted as \"consistent read\" and the\n  bookmark event is send when the state is synced at least to the moment\n  when request started being processed.\n- `resourceVersionMatch` set to any other value or unset\n  Invalid error is returned.\n\nDefaults to true if `resourceVersion=\"\"` or `resourceVersion=\"0\"` (for backward compatibility reasons) and to false otherwise.",
-          "schema": {
-            "type": "boolean",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "timeoutSeconds",
-          "in": "query",
-          "description": "Timeout for the list/watch call. This limits the duration of the call, regardless of any activity or inactivity.",
-          "schema": {
-            "type": "integer",
-            "uniqueItems": true
-          }
-        },
-        {
-          "name": "watch",
-          "in": "query",
-          "description": "Watch for changes to the described resources and return them as a stream of add, update, and remove notifications. Specify resourceVersion.",
-          "schema": {
-            "type": "boolean",
-            "uniqueItems": true
-          }
        }
      ]
    },
@@ -276,6 +556,330 @@
          "kind": "ServiceAccount"
        }
      },
+      "put": {
+        "tags": [
+          "ServiceAccount"
+        ],
+        "description": "replace the specified ServiceAccount",
+        "operationId": "replaceServiceAccount",
+        "parameters": [
+          {
+            "name": "dryRun",
+            "in": "query",
+            "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldManager",
+            "in": "query",
+            "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldValidation",
+            "in": "query",
+            "description": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+              }
+            },
+            "application/vnd.kubernetes.protobuf": {
+              "schema": {
+                "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+              }
+            },
+            "application/yaml": {
+              "schema": {
+                "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              }
+            }
+          }
+        },
+        "x-kubernetes-action": "put",
+        "x-kubernetes-group-version-kind": {
+          "group": "iam.grafana.app",
+          "version": "v0alpha1",
+          "kind": "ServiceAccount"
+        }
+      },
+      "delete": {
+        "tags": [
+          "ServiceAccount"
+        ],
+        "description": "delete a ServiceAccount",
+        "operationId": "deleteServiceAccount",
+        "parameters": [
+          {
+            "name": "dryRun",
+            "in": "query",
+            "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "gracePeriodSeconds",
+            "in": "query",
+            "description": "The duration in seconds before the object should be deleted. Value must be non-negative integer. The value zero indicates delete immediately. If this value is nil, the default grace period for the specified type will be used. Defaults to a per object value if not specified. zero means delete immediately.",
+            "schema": {
+              "type": "integer",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "ignoreStoreReadErrorWithClusterBreakingPotential",
+            "in": "query",
+            "description": "if set to true, it will trigger an unsafe deletion of the resource in case the normal deletion flow fails with a corrupt object error. A resource is considered corrupt if it can not be retrieved from the underlying storage successfully because of a) its data can not be transformed e.g. decryption failure, or b) it fails to decode into an object. NOTE: unsafe deletion ignores finalizer constraints, skips precondition checks, and removes the object from the storage. WARNING: This may potentially break the cluster if the workload associated with the resource being unsafe-deleted relies on normal deletion flow. Use only if you REALLY know what you are doing. The default value is false, and the user must opt in to enable it",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "orphanDependents",
+            "in": "query",
+            "description": "Deprecated: please use the PropagationPolicy, this field will be deprecated in 1.7. Should the dependent objects be orphaned. If true/false, the \"orphan\" finalizer will be added to/removed from the object's finalizers list. Either this field or PropagationPolicy may be set, but not both.",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "propagationPolicy",
+            "in": "query",
+            "description": "Whether and how garbage collection will be performed. Either this field or OrphanDependents may be set, but not both. The default policy is decided by the existing finalizer set in the metadata.finalizers and the resource-specific default policy. Acceptable values are: 'Orphan' - orphan the dependents; 'Background' - allow the garbage collector to delete the dependents in the background; 'Foreground' - a cascading policy that deletes all dependents in the foreground.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              }
+            }
+          },
+          "202": {
+            "description": "Accepted",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Status"
+                }
+              }
+            }
+          }
+        },
+        "x-kubernetes-action": "delete",
+        "x-kubernetes-group-version-kind": {
+          "group": "iam.grafana.app",
+          "version": "v0alpha1",
+          "kind": "ServiceAccount"
+        }
+      },
+      "patch": {
+        "tags": [
+          "ServiceAccount"
+        ],
+        "description": "partially update the specified ServiceAccount",
+        "operationId": "updateServiceAccount",
+        "parameters": [
+          {
+            "name": "dryRun",
+            "in": "query",
+            "description": "When present, indicates that modifications should not be persisted. An invalid or unrecognized dryRun directive will result in an error response and no further processing of the request. Valid values are: - All: all dry run stages will be processed",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldManager",
+            "in": "query",
+            "description": "fieldManager is a name associated with the actor or entity that is making these changes. The value must be less than or 128 characters long, and only contain printable characters, as defined by https://golang.org/pkg/unicode/#IsPrint. This field is required for apply requests (application/apply-patch) but optional for non-apply patch types (JsonPatch, MergePatch, StrategicMergePatch).",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "fieldValidation",
+            "in": "query",
+            "description": "fieldValidation instructs the server on how to handle objects in the request (POST/PUT/PATCH) containing unknown or duplicate fields. Valid values are: - Ignore: This will ignore any unknown fields that are silently dropped from the object, and will ignore all but the last duplicate field that the decoder encounters. This is the default behavior prior to v1.23. - Warn: This will send a warning via the standard warning response header for each unknown field that is dropped from the object, and for each duplicate field that is encountered. The request will still succeed if there are no other errors, and will only persist the last of any duplicate fields. This is the default in v1.23+ - Strict: This will fail the request with a BadRequest error if any unknown fields would be dropped from the object, or if any duplicate fields are present. The error returned from the server will contain all unknown and duplicate fields encountered.",
+            "schema": {
+              "type": "string",
+              "uniqueItems": true
+            }
+          },
+          {
+            "name": "force",
+            "in": "query",
+            "description": "Force is going to \"force\" Apply requests. It means user will re-acquire conflicting fields owned by other people. Force flag must be unset for non-apply patch requests.",
+            "schema": {
+              "type": "boolean",
+              "uniqueItems": true
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/apply-patch+yaml": {
+              "schema": {
+                "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Patch"
+              }
+            },
+            "application/json-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Patch"
+              }
+            },
+            "application/merge-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Patch"
+              }
+            },
+            "application/strategic-merge-patch+json": {
+              "schema": {
+                "$ref": "#/components/schemas/io.k8s.apimachinery.pkg.apis.meta.v1.Patch"
+              }
+            }
+          },
+          "required": true
+        },
+        "responses": {
+          "200": {
+            "description": "OK",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              }
+            }
+          },
+          "201": {
+            "description": "Created",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/vnd.kubernetes.protobuf": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              },
+              "application/yaml": {
+                "schema": {
+                  "$ref": "#/components/schemas/com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccount"
+                }
+              }
+            }
+          }
+        },
+        "x-kubernetes-action": "patch",
+        "x-kubernetes-group-version-kind": {
+          "group": "iam.grafana.app",
+          "version": "v0alpha1",
+          "kind": "ServiceAccount"
+        }
+      },
      "parameters": [
        {
          "name": "name",
@@ -2386,14 +2990,24 @@
      "com.github.grafana.grafana.apps.iam.pkg.apis.iam.v0alpha1.ServiceAccountSpec": {
        "type": "object",
        "required": [
-          "title",
-          "disabled"
+          "disabled",
+          "plugin",
+          "role",
+          "title"
        ],
        "properties": {
          "disabled": {
            "type": "boolean",
            "default": false
          },
+          "plugin": {
+            "type": "string",
+            "default": ""
+          },
+          "role": {
+            "type": "string",
+            "default": ""
+          },
          "title": {
            "type": "string",
            "default": ""
@@ -4492,14 +5106,24 @@
      "github.com/grafana/grafana/apps/iam/pkg/apis/iam/v0alpha1.ServiceAccountSpec": {
        "type": "object",
        "required": [
-          "title",
-          "disabled"
+          "disabled",
+          "plugin",
+          "role",
+          "title"
        ],
        "properties": {
          "disabled": {
            "type": "boolean",
            "default": false
          },
+          "plugin": {
+            "type": "string",
+            "default": ""
+          },
+          "role": {
+            "type": "string",
+            "default": ""
+          },
          "title": {
            "type": "string",
            "default": ""