docs: add service account group to CapsuleGroups

docs/operator/use-cases/overview.md

@@ -20,7 +20,7 @@ To simplify the usage of Capsule in this scenario, we'll work with the following
 
 Use Capsule to address any of the following scenarios:
 
-* [Onboard Tenants](./onboarding.md)
+* [Assign Tenant Ownership](./tenant-ownership.md)
 * [Create Namespaces](./create-namespaces.md)
 * [Assign Permissions](./permissions.md)
 * [Enforce Resources Quotas and Limits](./resources-quota-limits.md)

docs/operator/use-cases/onboarding.md → docs/operator/use-cases/tenant-ownership.md

@@ -1,4 +1,4 @@
-# Onboard a new tenant
+# Tenant ownership
 Bill, the cluster admin, receives a new request from Acme Corp.'s CTO asking for a new tenant to be onboarded and Alice user will be the tenant owner. Bill then assigns Alice's identity of `alice` in the Acme Corp. identity management system. Since Alice is a tenant owner, Bill needs to assign `alice` the Capsule group defined by `--capsule-user-group` option, which defaults to `capsule.clastix.io`.
 
 To keep things simple, we assume that Bill just creates a client certificate for authentication using X.509 Certificate Signing Request, so Alice's certificate has `"/CN=alice/O=capsule.clastix.io"`.
@@ -136,5 +136,26 @@ kubectl --as system:serviceaccount:default:robot --as-group capsule.clastix.io a
 yes
 ```
 
+The service account has to be part of Capsule group, so Bill has to set in the `CapsuleConfiguration`
+
+```yaml
+apiVersion: capsule.clastix.io/v1alpha1
+kind: CapsuleConfiguration
+metadata:
+  name: default
+spec:
+  userGroups:
+  - capsule.clastix.io
+  - system:serviceaccounts:default
+```
+
+because, by default, each service account is a member of following groups:
+
+```
+system:serviceaccounts
+system:serviceaccounts:{service-account-namespace}
+system:authenticated
+```
+
 # What’s next
 See how a tenant owner, creates new namespaces. [Create namespaces](./create-namespaces.md).