feat: adding improved support for custom account types (#118)

simontesar · aaronschweig · nexus49 · web-flow · commit c3b6d8d0e79c · 2026-02-06T17:36:40.000+01:00
* feat: allow configurable custom account types in webhook On-behalf-of: @SAP <simon@simontesar.com> * feat: support custom account types with pre-provisioned workspace types On-behalf-of: @SAP <simon@simontesar.com> * feat: remove "account" from default accounttypes On-behalf-of: @SAP <simon@simontesar.com> * feat: remove enum from account.spec.accounttype On-behalf-of: @SAP <simon@simontesar.com> * feat: treat all non-org accounts the same("account" accountType is not special) On-behalf-of: @SAP <simon@simontesar.com> * fix: use right workspace type * fix: correct additional account types cli flag binding On-behalf-of: @SAP <simon@simontesar.com> * fix: update test setup to match custom account types changes - Update APIExport schema reference to use correct version - Fix test expectation for workspace type naming Signed-off-by: Bastian Echterhölter <bastian.echterhoelter@sap.com> On-behalf-of: @SAP <bastian.echterhoelter@sap.com> * feat: add org label to generated workspace types - Add core.platform-mesh.io/org label to org and account workspace types - Rename subroutine constants to shorter names Signed-off-by: Bastian Echterhölter <bastian.echterhoelter@sap.com> On-behalf-of: @SAP <bastian.echterhoelter@sap.com> --------- Signed-off-by: Bastian Echterhölter <bastian.echterhoelter@sap.com> Co-authored-by: I547291 <aaron.schweig@sap.com> Co-authored-by: Bastian Echterhölter <bastian.echterhoelter@sap.com>
diff --git a/api/v1alpha1/account_types.go b/api/v1alpha1/account_types.go
@@ -31,7 +31,6 @@ const (
 // AccountSpec defines the desired state of Account
 type AccountSpec struct {
 	// Type specifies the intended type for this Account object.
-	// +kubebuilder:validation:Enum=org;account
 	Type AccountType `json:"type"`
 
 	// The display name for this account
diff --git a/api/v1alpha1/account_webhook.go b/api/v1alpha1/account_webhook.go
@@ -12,11 +12,11 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 )
 
-func SetupAccountWebhookWithManager(mgr ctrl.Manager, denyList []string) error {
+func SetupAccountWebhookWithManager(mgr ctrl.Manager, organizationNameDenyList []string, accountTypeAllowList []AccountType) error {
 	return ctrl.NewWebhookManagedBy(mgr).
 		For(&Account{}).
 		WithDefaulter(&AccountDefaulter{}).
-		WithValidator(&AccountValidator{DenyList: denyList}).
+		WithValidator(&AccountValidator{OrganizationNameDenyList: organizationNameDenyList, AccountTypeAllowList: accountTypeAllowList}).
 		Complete()
 }
 
@@ -40,11 +40,17 @@ var _ webhook.CustomDefaulter = &AccountDefaulter{}
 var _ webhook.CustomValidator = &AccountValidator{}
 
 type AccountValidator struct {
-	DenyList []string
+	OrganizationNameDenyList []string
+	AccountTypeAllowList     []AccountType
 }
 
 func (v *AccountValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {
 	account := obj.(*Account)
+
+	if !slices.Contains(v.AccountTypeAllowList, account.Spec.Type) {
+		return nil, fmt.Errorf("account type %s not in allowlist", account.Spec.Type)
+	}
+
 	if account.Spec.Type != AccountTypeOrg {
 		return nil, nil
 	}
@@ -53,7 +59,7 @@ func (v *AccountValidator) ValidateCreate(ctx context.Context, obj runtime.Objec
 		return nil, fmt.Errorf("organization name %q is too short, must be at least 3 characters", account.Name)
 	}
 
-	if slices.Contains(v.DenyList, account.Name) {
+	if slices.Contains(v.OrganizationNameDenyList, account.Name) {
 		return nil, fmt.Errorf("organization name %q is not allowed", account.Name)
 	}
 
@@ -63,6 +69,10 @@ func (v *AccountValidator) ValidateCreate(ctx context.Context, obj runtime.Objec
 func (v *AccountValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) {
 	account := newObj.(*Account)
 
+	if !slices.Contains(v.AccountTypeAllowList, account.Spec.Type) {
+		return nil, fmt.Errorf("account type %s not in allowlist", account.Spec.Type)
+	}
+
 	if account.Spec.Type != AccountTypeOrg {
 		return nil, nil
 	}
@@ -71,7 +81,7 @@ func (v *AccountValidator) ValidateUpdate(ctx context.Context, oldObj, newObj ru
 		return nil, fmt.Errorf("organization name %q is too short, must be at least 3 characters", account.Name)
 	}
 
-	if slices.Contains(v.DenyList, account.Name) {
+	if slices.Contains(v.OrganizationNameDenyList, account.Name) {
 		return nil, fmt.Errorf("organization name %q is not allowed", account.Name)
 	}
 
diff --git a/api/v1alpha1/account_webhook_test.go b/api/v1alpha1/account_webhook_test.go
@@ -39,7 +39,7 @@ func TestAccountValidator_ValidateCreate(t *testing.T) {
 			name: "non-organization account with denied name",
 			account: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "admin"},
-				Spec:       AccountSpec{Type: "personal"},
+				Spec:       AccountSpec{Type: "account"},
 			},
 			denyList:    []string{"admin", "root", "system"},
 			expectError: false,
@@ -67,7 +67,7 @@ func TestAccountValidator_ValidateCreate(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			validator := &AccountValidator{DenyList: tt.denyList}
+			validator := &AccountValidator{OrganizationNameDenyList: tt.denyList, AccountTypeAllowList: []AccountType{AccountTypeAccount, AccountTypeOrg}}
 			_, err := validator.ValidateCreate(context.Background(), tt.account)
 
 			if tt.expectError {
@@ -117,10 +117,10 @@ func TestAccountValidator_ValidateUpdate(t *testing.T) {
 			expectError: false,
 		},
 		{
-			name: "changing from personal to organization with denied name",
+			name: "changing from account to organization with denied name",
 			oldAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "admin"},
-				Spec:       AccountSpec{Type: "personal"},
+				Spec:       AccountSpec{Type: "account"},
 			},
 			newAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "admin"},
@@ -131,10 +131,10 @@ func TestAccountValidator_ValidateUpdate(t *testing.T) {
 			errorMsg:    `organization name "admin" is not allowed`,
 		},
 		{
-			name: "changing from personal to organization with allowed name",
+			name: "changing from account to organization with allowed name",
 			oldAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "my-account"},
-				Spec:       AccountSpec{Type: "personal"},
+				Spec:       AccountSpec{Type: "account"},
 			},
 			newAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "my-account"},
@@ -144,27 +144,27 @@ func TestAccountValidator_ValidateUpdate(t *testing.T) {
 			expectError: false,
 		},
 		{
-			name: "changing from organization to personal with denied name",
+			name: "changing from organization to account with denied name",
 			oldAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "admin"},
 				Spec:       AccountSpec{Type: "org"},
 			},
 			newAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "admin"},
-				Spec:       AccountSpec{Type: "personal"},
+				Spec:       AccountSpec{Type: "account"},
 			},
 			denyList:    []string{"admin", "root", "system"},
 			expectError: false,
 		},
 		{
-			name: "updating personal account with denied name",
+			name: "updating account account with denied name",
 			oldAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "admin"},
-				Spec:       AccountSpec{Type: "personal"},
+				Spec:       AccountSpec{Type: "account"},
 			},
 			newAccount: &Account{
 				ObjectMeta: metav1.ObjectMeta{Name: "admin"},
-				Spec:       AccountSpec{Type: "personal"},
+				Spec:       AccountSpec{Type: "account"},
 			},
 			denyList:    []string{"admin", "root", "system"},
 			expectError: false,
@@ -200,7 +200,7 @@ func TestAccountValidator_ValidateUpdate(t *testing.T) {
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			validator := &AccountValidator{DenyList: tt.denyList}
+			validator := &AccountValidator{OrganizationNameDenyList: tt.denyList, AccountTypeAllowList: []AccountType{AccountTypeAccount, AccountTypeOrg}}
 			_, err := validator.ValidateUpdate(context.Background(), tt.oldAccount, tt.newAccount)
 
 			if tt.expectError {
diff --git a/api/v1alpha1/zz_generated.deepcopy.go b/api/v1alpha1/zz_generated.deepcopy.go
diff --git a/cmd/operator.go b/cmd/operator.go
@@ -169,8 +169,13 @@ func RunController(_ *cobra.Command, _ []string) { // coverage-ignore
 			}
 		}
 
+		accountTypeAllowList := []v1alpha1.AccountType{v1alpha1.AccountTypeOrg}
+		for _, additionalType := range operatorCfg.Webhooks.AdditionalAccountTypes {
+			accountTypeAllowList = append(accountTypeAllowList, v1alpha1.AccountType(additionalType))
+		}
+
 		log.Info().Strs("deniedNames", denyList).Msg("webhooks are enabled")
-		if err := v1alpha1.SetupAccountWebhookWithManager(mgr.GetLocalManager(), denyList); err != nil {
+		if err := v1alpha1.SetupAccountWebhookWithManager(mgr.GetLocalManager(), denyList, accountTypeAllowList); err != nil {
 			log.Fatal().Err(err).Str("webhook", "Account").Msg("unable to create webhook")
 		}
 	}
diff --git a/config/crd/core.platform-mesh.io_accounts.yaml b/config/crd/core.platform-mesh.io_accounts.yaml
@@ -97,9 +97,6 @@ spec:
                 type: array
               type:
                 description: Type specifies the intended type for this Account object.
-                enum:
-                - org
-                - account
                 type: string
             required:
             - displayName
diff --git a/config/resources/apiresourceschema-accounts.core.platform-mesh.io.yaml b/config/resources/apiresourceschema-accounts.core.platform-mesh.io.yaml
@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
   creationTimestamp: null
-  name: v250915-1185c0b.accounts.core.platform-mesh.io
+  name: v260109-82344be.accounts.core.platform-mesh.io
 spec:
   group: core.platform-mesh.io
   names:
@@ -93,9 +93,6 @@ spec:
               type: array
             type:
               description: Type specifies the intended type for this Account object.
-              enum:
-              - org
-              - account
               type: string
           required:
           - displayName
diff --git a/internal/config/config.go b/internal/config/config.go
@@ -3,10 +3,11 @@ package config
 // OperatorConfig struct to hold the app config
 type OperatorConfig struct {
 	Webhooks struct {
-		Enabled  bool   `mapstructure:"webhooks-enabled" default:"false"`
-		CertDir  string `mapstructure:"webhooks-cert-dir" default:"certs"`
-		Port     int    `mapstructure:"webhooks-port" default:"9443"`
-		DenyList string `mapstructure:"webhooks-deny-list"`
+		Enabled                bool     `mapstructure:"webhooks-enabled" default:"false"`
+		CertDir                string   `mapstructure:"webhooks-cert-dir" default:"certs"`
+		Port                   int      `mapstructure:"webhooks-port" default:"9443"`
+		DenyList               string   `mapstructure:"webhooks-deny-list"`
+		AdditionalAccountTypes []string `mapstructure:"webhooks-additional-account-types"`
 	} `mapstructure:",squash"`
 	Subroutines struct {
 		WorkspaceType struct {
diff --git a/internal/controller/account_controller_test.go b/internal/controller/account_controller_test.go
@@ -241,7 +241,7 @@ func (s *AccountTestSuite) verifyWorkspace(ctx context.Context, orgName, account
 	s.Require().NoError(s.rootOrgsDefaultClient.Get(ctx, types.NamespacedName{Name: accountName}, workspace))
 	s.Equal(accountName, workspace.Name)
 	s.NotNil(workspace.Spec.Type)
-	expectedType := kcptenancyv1alpha.WorkspaceTypeName(fmt.Sprintf("%s-acc", orgName))
+	expectedType := kcptenancyv1alpha.WorkspaceTypeName(fmt.Sprintf("%s-%s", orgName, v1alpha1.AccountTypeAccount))
 	s.Equal(expectedType, workspace.Spec.Type.Name)
 }
 
diff --git a/internal/controller/test/setup/01-platform-mesh-system/apiexport-core.platform-mesh.io.yaml b/internal/controller/test/setup/01-platform-mesh-system/apiexport-core.platform-mesh.io.yaml
@@ -6,7 +6,7 @@ metadata:
 spec:
   latestResourceSchemas:
     - v260126-7c674ee.accountinfos.core.platform-mesh.io
-    - v250915-1185c0b.accounts.core.platform-mesh.io
+    - v260109-82344be.accounts.core.platform-mesh.io
   permissionClaims:
     - resource: apibindings
       group: apis.kcp.io
diff --git a/internal/controller/test/setup/01-platform-mesh-system/apiresourceschema-accounts.core.platform-mesh.io.yaml b/internal/controller/test/setup/01-platform-mesh-system/apiresourceschema-accounts.core.platform-mesh.io.yaml
@@ -2,7 +2,7 @@ apiVersion: apis.kcp.io/v1alpha1
 kind: APIResourceSchema
 metadata:
   creationTimestamp: null
-  name: v250915-1185c0b.accounts.core.platform-mesh.io
+  name: v260109-82344be.accounts.core.platform-mesh.io
 spec:
   group: core.platform-mesh.io
   names:
@@ -93,9 +93,6 @@ spec:
               type: array
             type:
               description: Type specifies the intended type for this Account object.
-              enum:
-              - org
-              - account
               type: string
           required:
           - displayName
diff --git a/pkg/subroutines/util/util.go b/pkg/subroutines/util/util.go
@@ -1,11 +1,11 @@
 package util
 
-import "fmt"
+import (
+	"fmt"
 
-func GetOrgWorkspaceTypeName(accountName string) string {
-	return fmt.Sprintf("%s-org", accountName)
-}
+	"github.com/platform-mesh/account-operator/api/v1alpha1"
+)
 
-func GetAccountWorkspaceTypeName(accountName string) string {
-	return fmt.Sprintf("%s-acc", accountName)
+func GetWorkspaceTypeName(accountName string, accountType v1alpha1.AccountType) string {
+	return fmt.Sprintf("%s-%s", accountName, accountType)
 }
diff --git a/pkg/subroutines/util/util_test.go b/pkg/subroutines/util/util_test.go
@@ -3,16 +3,12 @@ package util_test
 import (
 	"testing"
 
+	"github.com/platform-mesh/account-operator/api/v1alpha1"
 	"github.com/platform-mesh/account-operator/pkg/subroutines/util"
 	"github.com/stretchr/testify/assert"
 )
 
-func TestGetOrgWorkspaceTypeName(t *testing.T) {
-	got := util.GetOrgWorkspaceTypeName("test")
+func TestGetWorkspaceTypeName(t *testing.T) {
+	got := util.GetWorkspaceTypeName("test", v1alpha1.AccountTypeOrg)
 	assert.Equal(t, "test-org", got)
 }
-
-func TestGetAccountWorkspaceTypeName(t *testing.T) {
-	got := util.GetAccountWorkspaceTypeName("test")
-	assert.Equal(t, "test-acc", got)
-}
diff --git a/pkg/subroutines/workspace/workspace.go b/pkg/subroutines/workspace/workspace.go
@@ -96,12 +96,10 @@ func (r *WorkspaceSubroutine) Process(ctx context.Context, ro runtimeobject.Runt
 	if err != nil {
 		return ctrl.Result{}, errors.NewOperatorError(err, true, true)
 	}
-
 	clusterClient := clusterRef.GetClient()
 
-	workspaceTypeName := util.GetOrgWorkspaceTypeName(instance.Name)
-	if instance.Spec.Type == v1alpha1.AccountTypeAccount {
-
+	workspaceTypeName := util.GetWorkspaceTypeName(instance.Name, instance.Spec.Type)
+	if instance.Spec.Type != v1alpha1.AccountTypeOrg {
 		accountInfo := &v1alpha1.AccountInfo{}
 		if err := clusterClient.Get(ctx, client.ObjectKey{Name: manageaccountinfo.DefaultAccountInfoName}, accountInfo); err != nil {
 			if kerrors.IsNotFound(err) {
@@ -115,7 +113,7 @@ func (r *WorkspaceSubroutine) Process(ctx context.Context, ro runtimeobject.Runt
 			return ctrl.Result{RequeueAfter: r.limiter.When(instance)}, nil
 		}
 
-		workspaceTypeName = util.GetAccountWorkspaceTypeName(accountInfo.Spec.Organization.Name)
+		workspaceTypeName = util.GetWorkspaceTypeName(accountInfo.Spec.Organization.Name, instance.Spec.Type)
 	}
 
 	ready, err := r.checkWorkspaceTypeReady(ctx, workspaceTypeName)
@@ -127,15 +125,14 @@ func (r *WorkspaceSubroutine) Process(ctx context.Context, ro runtimeobject.Runt
 	}
 
 	createdWorkspace := &kcptenancyv1alpha.Workspace{ObjectMeta: metav1.ObjectMeta{Name: instance.Name}}
-	_, err = controllerutil.CreateOrUpdate(ctx, clusterClient, createdWorkspace, func() error {
+	if _, err = controllerutil.CreateOrUpdate(ctx, clusterClient, createdWorkspace, func() error {
 		createdWorkspace.Spec.Type = &kcptenancyv1alpha.WorkspaceTypeReference{
 			Name: kcptenancyv1alpha.WorkspaceTypeName(workspaceTypeName),
 			Path: orgsWorkspacePath,
 		}
 
 		return controllerutil.SetOwnerReference(instance, createdWorkspace, clusterClient.Scheme())
-	})
-	if err != nil {
+	}); err != nil {
 		return ctrl.Result{}, errors.NewOperatorError(err, true, true)
 	}
 
diff --git a/pkg/subroutines/workspacetype/workspace_type.go b/pkg/subroutines/workspacetype/workspace_type.go
diff --git a/pkg/subroutines/workspacetype/workspace_type_test.go b/pkg/subroutines/workspacetype/workspace_type_test.go
diff --git a/test/setup/01-platform-mesh-system/apiexport-core.platform-mesh.io.yaml b/test/setup/01-platform-mesh-system/apiexport-core.platform-mesh.io.yaml

Original file line number	Diff line number	Diff line change
`@@ -12,11 +12,11 @@ import (`
`12`	`12`	`"sigs.k8s.io/controller-runtime/pkg/webhook/admission"`
`13`	`13`	`)`
`14`	`14`
`15`		`-func SetupAccountWebhookWithManager(mgr ctrl.Manager, denyList []string) error {`
	`15`	`+func SetupAccountWebhookWithManager(mgr ctrl.Manager, organizationNameDenyList []string, accountTypeAllowList []AccountType) error {`
`16`	`16`	`return ctrl.NewWebhookManagedBy(mgr).`
`17`	`17`	`For(&Account{}).`
`18`	`18`	`WithDefaulter(&AccountDefaulter{}).`
`19`		`- WithValidator(&AccountValidator{DenyList: denyList}).`
	`19`	`+ WithValidator(&AccountValidator{OrganizationNameDenyList: organizationNameDenyList, AccountTypeAllowList: accountTypeAllowList}).`
`20`	`20`	`Complete()`
`21`	`21`	`}`
`22`	`22`
`@@ -40,11 +40,17 @@ var _ webhook.CustomDefaulter = &AccountDefaulter{}`
`40`	`40`	`var _ webhook.CustomValidator = &AccountValidator{}`
`41`	`41`
`42`	`42`	`type AccountValidator struct {`
`43`		`- DenyList []string`
	`43`	`+ OrganizationNameDenyList []string`
	`44`	`+ AccountTypeAllowList []AccountType`
`44`	`45`	`}`
`45`	`46`
`46`	`47`	`func (v *AccountValidator) ValidateCreate(ctx context.Context, obj runtime.Object) (admission.Warnings, error) {`
`47`	`48`	`account := obj.(*Account)`
	`49`	`+`
	`50`	`+ if !slices.Contains(v.AccountTypeAllowList, account.Spec.Type) {`
	`51`	`+ return nil, fmt.Errorf("account type %s not in allowlist", account.Spec.Type)`
	`52`	`+ }`
	`53`	`+`
`48`	`54`	`if account.Spec.Type != AccountTypeOrg {`
`49`	`55`	`return nil, nil`
`50`	`56`	`}`
`@@ -53,7 +59,7 @@ func (v *AccountValidator) ValidateCreate(ctx context.Context, obj runtime.Objec`
`53`	`59`	`return nil, fmt.Errorf("organization name %q is too short, must be at least 3 characters", account.Name)`
`54`	`60`	`}`
`55`	`61`
`56`		`- if slices.Contains(v.DenyList, account.Name) {`
	`62`	`+ if slices.Contains(v.OrganizationNameDenyList, account.Name) {`
`57`	`63`	`return nil, fmt.Errorf("organization name %q is not allowed", account.Name)`
`58`	`64`	`}`
`59`	`65`
`@@ -63,6 +69,10 @@ func (v *AccountValidator) ValidateCreate(ctx context.Context, obj runtime.Objec`
`63`	`69`	`func (v *AccountValidator) ValidateUpdate(ctx context.Context, oldObj, newObj runtime.Object) (admission.Warnings, error) {`
`64`	`70`	`account := newObj.(*Account)`
`65`	`71`
	`72`	`+ if !slices.Contains(v.AccountTypeAllowList, account.Spec.Type) {`
	`73`	`+ return nil, fmt.Errorf("account type %s not in allowlist", account.Spec.Type)`
	`74`	`+ }`
	`75`	`+`
`66`	`76`	`if account.Spec.Type != AccountTypeOrg {`
`67`	`77`	`return nil, nil`
`68`	`78`	`}`
`@@ -71,7 +81,7 @@ func (v *AccountValidator) ValidateUpdate(ctx context.Context, oldObj, newObj ru`
`71`	`81`	`return nil, fmt.Errorf("organization name %q is too short, must be at least 3 characters", account.Name)`
`72`	`82`	`}`
`73`	`83`
`74`		`- if slices.Contains(v.DenyList, account.Name) {`
	`84`	`+ if slices.Contains(v.OrganizationNameDenyList, account.Name) {`
`75`	`85`	`return nil, fmt.Errorf("organization name %q is not allowed", account.Name)`
`76`	`86`	`}`
`77`	`87`
Original file line number	Diff line number	Diff line change
`@@ -169,8 +169,13 @@ func RunController(_ *cobra.Command, _ []string) { // coverage-ignore`
`169`	`169`	`}`
`170`	`170`	`}`
`171`	`171`
	`172`	`+ accountTypeAllowList := []v1alpha1.AccountType{v1alpha1.AccountTypeOrg}`
	`173`	`+ for _, additionalType := range operatorCfg.Webhooks.AdditionalAccountTypes {`
	`174`	`+ accountTypeAllowList = append(accountTypeAllowList, v1alpha1.AccountType(additionalType))`
	`175`	`+ }`
	`176`	`+`
`172`	`177`	`log.Info().Strs("deniedNames", denyList).Msg("webhooks are enabled")`
`173`		`- if err := v1alpha1.SetupAccountWebhookWithManager(mgr.GetLocalManager(), denyList); err != nil {`
	`178`	`+ if err := v1alpha1.SetupAccountWebhookWithManager(mgr.GetLocalManager(), denyList, accountTypeAllowList); err != nil {`
`174`	`179`	`log.Fatal().Err(err).Str("webhook", "Account").Msg("unable to create webhook")`
`175`	`180`	`}`
`176`	`181`	`}`
Original file line number	Diff line number	Diff line change
`@@ -241,7 +241,7 @@ func (s *AccountTestSuite) verifyWorkspace(ctx context.Context, orgName, account`
`241`	`241`	`s.Require().NoError(s.rootOrgsDefaultClient.Get(ctx, types.NamespacedName{Name: accountName}, workspace))`
`242`	`242`	`s.Equal(accountName, workspace.Name)`
`243`	`243`	`s.NotNil(workspace.Spec.Type)`
`244`		`- expectedType := kcptenancyv1alpha.WorkspaceTypeName(fmt.Sprintf("%s-acc", orgName))`
	`244`	`+ expectedType := kcptenancyv1alpha.WorkspaceTypeName(fmt.Sprintf("%s-%s", orgName, v1alpha1.AccountTypeAccount))`
`245`	`245`	`s.Equal(expectedType, workspace.Spec.Type.Name)`
`246`	`246`	`}`
`247`	`247`