matheuscscp · Oct 24, 2026 · Oct 24, 2026 · Oct 24, 2026
diff --git a/README.md b/README.md
@@ -1,7 +1,6 @@
 # image-reflector-controller
 
 [![CII Best Practices](https://bestpractices.coreinfrastructure.org/projects/4790/badge)](https://bestpractices.coreinfrastructure.org/projects/4790)
-[![report](https://goreportcard.com/badge/github.com/fluxcd/image-reflector-controller)](https://goreportcard.com/report/github.com/fluxcd/image-reflector-controller)
 [![license](https://img.shields.io/github/license/fluxcd/image-reflector-controller.svg)](https://github.com/fluxcd/image-reflector-controller/blob/main/LICENSE)
 [![release](https://img.shields.io/github/release/fluxcd/image-reflector-controller/all.svg)](https://github.com/fluxcd/image-reflector-controller/releases)
 

diff --git a/api/v1/imagerepository_types.go b/api/v1/imagerepository_types.go
@@ -60,7 +60,10 @@ type ImageRepositorySpec struct {
 	ProxySecretRef *meta.LocalObjectReference `json:"proxySecretRef,omitempty"`
 
 	// ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
-	// the image pull if the service account has attached pull secrets.
+	// the image pull, either with the pull secrets attached to the service account or with
+	// an object identity.
+	// For more information about object identity:
+	// https://fluxcd.io/flux/integrations/object-identity/
 	// +kubebuilder:validation:MaxLength=253
 	// +optional
 	ServiceAccountName string `json:"serviceAccountName,omitempty"`

diff --git a/config/crd/bases/image.toolkit.fluxcd.io_imagerepositories.yaml b/config/crd/bases/image.toolkit.fluxcd.io_imagerepositories.yaml
@@ -181,7 +181,10 @@ spec:
               serviceAccountName:
                 description: |-
                   ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
-                  the image pull if the service account has attached pull secrets.
+                  the image pull, either with the pull secrets attached to the service account or with
+                  an object identity.
+                  For more information about object identity:
+                  https://fluxcd.io/flux/integrations/object-identity/
                 maxLength: 253
                 type: string
               suspend:

diff --git a/docs/README.md b/docs/README.md
@@ -63,8 +63,8 @@ image-reflector-controller acquires an X.509-SVID from the SPIFFE Workload API a
 authenticate to the SPIFFE Broker API. The `SPIFFE_ENDPOINT_SOCKET` environment
 variable must point to the Workload API socket.
 
-The Broker is used to acquire JWT-SVIDs for object-level workload identity when
-a ServiceAccount sets `credential.auth.fluxcd.io/provider` to `spiffe`. The
+The Broker is used to acquire JWT-SVIDs for object identity when a
+ServiceAccount sets `credential.auth.fluxcd.io/provider` to `spiffe`. The
 Broker endpoint is a TCP gRPC target, e.g.
 `dns:///spire-server.spire.svc.cluster.local:8443`.
 

diff --git a/docs/api/v1/image-reflector.md b/docs/api/v1/image-reflector.md
@@ -651,7 +651,10 @@ string
 <td>
 <em>(Optional)</em>
 <p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
-the image pull if the service account has attached pull secrets.</p>
+the image pull, either with the pull secrets attached to the service account or with
+an object identity.
+For more information about object identity:
+<a href="https://fluxcd.io/flux/integrations/object-identity/">https://fluxcd.io/flux/integrations/object-identity/</a></p>
 </td>
 </tr>
 <tr>
@@ -866,7 +869,10 @@ string
 <td>
 <em>(Optional)</em>
 <p>ServiceAccountName is the name of the Kubernetes ServiceAccount used to authenticate
-the image pull if the service account has attached pull secrets.</p>
+the image pull, either with the pull secrets attached to the service account or with
+an object identity.
+For more information about object identity:
+<a href="https://fluxcd.io/flux/integrations/object-identity/">https://fluxcd.io/flux/integrations/object-identity/</a></p>
 </td>
 </tr>
 <tr>

diff --git a/docs/spec/v1/imagerepositories.md b/docs/spec/v1/imagerepositories.md
@@ -32,8 +32,8 @@ In the above example:
 - The registry authentication is done using a generic provider, indicated by the
   `.spec.provider` field and referenced using `.spec.secretRef`. For the generic
   provider, authentication can also use the image pull secrets attached to
-  `.spec.serviceAccountName`, or a ServiceAccount token for object-level
-  workload identity. See [Provider](#provider) for more details related to
+  `.spec.serviceAccountName`, or a ServiceAccount token for object identity.
+  See [Provider](#provider) for more details related to
   registry authentication.
 - The canonical form of the image set in `.spec.image` is used to scan the
   repository. The resolved canonical form of the image is reported in the
@@ -197,15 +197,14 @@ the `.spec.provider` field:
 
 - When `.spec.provider` is set to `generic`, the controller will use the image
   pull secrets attached to the Service Account for static authentication, or
-  use the Service Account token for object-level workload identity when the
+  use the Service Account token for object identity when the
   Service Account opts in with the credential annotations described below.
 - When `.spec.provider` is set to `aws`, `azure`, or `gcp`, the Service Account
-  will be used for Workload Identity authentication.
+  will be used to acquire an object identity.
 
-For a complete guide to the ServiceAccount annotations used for object-level
-workload identity, including the `spiffe` credential provider, see the
-[ServiceAccount annotations](/flux/integrations/serviceaccount-annotations)
-docs.
+For a complete guide to the ServiceAccount annotations used for object
+identity, including the `spiffe` credential provider, see the
+[Object Identity](/flux/integrations/object-identity/) docs.
 
 **Note:** that for a publicly accessible image repository, you don't need to
 provide a `secretRef` nor `serviceAccountName`.
@@ -521,7 +520,7 @@ Supported options are:
 The `generic` provider can be used for public repositories, when
 static credentials are used for authentication, either with
 `spec.secretRef` or `spec.serviceAccountName`, or when a Kubernetes
-ServiceAccount token is used for object-level workload identity, as described
+ServiceAccount token is used for object identity, as described
 in the [ServiceAccount name](#serviceaccount-name) section.
 If you do not specify `.spec.provider`, it defaults to `generic`.