@@ -18,6 +18,23 @@ It does **not** implement the backup logic itself.
 
 This document covers only the **core** API and its contracts with drivers, not driver implementations.
 
+### Platform-managed default flow
+
+As of Phase 2, Cozystack also ships **opinionated defaults** for the entire stack:
+
+* A platform-managed S3 bucket `cozy-backups` (provisioned through `apps.cozystack.io/Bucket` in `tenant-root`).
+* Pre-rendered `Strategy` CRs `cozy-default-{cnpg,mariadb,etcd,altinity,foundationdb,velero-vminstance,velero-vmdisk}`.
+* A single cluster-wide `BackupClass` `cozy-default` whose `spec.strategies[]` binds each supported `apps.cozystack.io/<Kind>` to the matching strategy.
+* A `CredentialsProjector` inside `backupstrategy-controller` that copies the bucket-controller Secret into each tenant namespace as `cozy-backups-creds` on demand (per `BackupJob`/`RestoreJob` reconcile) and into a configured list of system namespaces (e.g. `cozy-velero`) on a periodic tick.
+
+Tenants reference `cozy-default` from `BackupJob`/`Plan`/`RestoreJob`; they never see the bucket controller Secret, never write to a Secret in their own namespace (default RBAC denies it), and never share an S3 path with another tenant (every default strategy template prefixes the object key with `<namespace>/<application>`).
+
+The platform-managed flow is layered *on top of* — not in place of — the core API. Custom `BackupClass`/Strategy CRs targeting other buckets continue to work; tenants picking `cozy-default` simply opt into the platform's pre-wired stack.
+
+**Open gap (FoundationDB):** the `cozy-default-foundationdb` Strategy CR is shipped but **not** bound by `cozy-default`. Restore for FoundationDB runs `fdbrestore` from inside the `cozy-foundationdb-operator` deployment, which does not yet mount `cozy-backups-creds` with the blob credentials file. Admins who want platform-default FDB backups today must either wire the operator deployment manually or use a custom BackupClass — see [Backup Classes](../../../docs/operations/backup-classes.md) for the follow-up plan.
+
+**Tenant visibility:** projected Secrets carry no `internal.cozystack.io/tenantresource` label, so the lineage-controller webhook does not promote them to a `TenantSecret` view. Combined with the default RBAC (no core/v1.Secret verbs on tenant ServiceAccounts), the projected credentials are unreadable from a tenant kubeconfig even when they sit in the tenant's own namespace; the operator Pods mount the Secret via kubelet, which bypasses tenant RBAC.
+
 ---
 
 ## 2. Goals and non-goals
 
@@ -25,6 +25,7 @@ import (
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
+	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
@@ -157,6 +158,18 @@ func main() {
 				&backupsv1alpha1.BackupClass{}: {},
 			},
 		},
+		Client: client.Options{
+			// Disable the controller-runtime cache for Secrets entirely.
+			// The credentials projector does point Get + CreateOrUpdate
+			// against arbitrary tenant namespaces, and a cluster-wide
+			// Secret informer would (a) require list/watch RBAC the chart
+			// explicitly does NOT grant, (b) keep every tenant Secret in
+			// the controller's RAM. Direct apiserver calls keep the
+			// blast radius bounded to the namespaces actively reconciled.
+			Cache: &client.CacheOptions{
+				DisableFor: []client.Object{&corev1.Secret{}},
+			},
+		},
 		// LeaderElectionReleaseOnCancel defines if the leader should step down voluntarily
 		// when the Manager ends. This requires the binary to immediately end when the
 		// Manager is stopped, otherwise, this setting is unsafe. Setting this significantly
@@ -174,19 +187,37 @@ func main() {
 		os.Exit(1)
 	}
 
+	credentialsConfig := backupcontroller.BackupCredentialsConfig{
+		SourceNamespace:  os.Getenv("BACKUP_STORAGE_SECRET_NAMESPACE"),
+		SourceSecretName: os.Getenv("BACKUP_STORAGE_SECRET_NAME"),
+		TargetSecretName: os.Getenv("BACKUP_STORAGE_CREDS_SECRET_NAME"),
+		Endpoint:         os.Getenv("BACKUP_STORAGE_ENDPOINT"),
+		Region:           os.Getenv("BACKUP_STORAGE_REGION"),
+		ForcePathStyle:   os.Getenv("BACKUP_STORAGE_FORCE_PATH_STYLE"),
+	}
+
+	if systemNamespaces := os.Getenv("BACKUP_STORAGE_SYSTEM_NAMESPACES"); systemNamespaces != "" {
+		if err := mgr.Add(backupcontroller.NewSystemCredentialsProjector(mgr.GetClient(), credentialsConfig, systemNamespaces, 0)); err != nil {
+			setupLog.Error(err, "unable to add SystemCredentialsProjector runnable")
+			os.Exit(1)
+		}
+	}
+
 	if err = (&backupcontroller.BackupJobReconciler{
-		Client:   mgr.GetClient(),
-		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("backup-controller"),
+		Client:            mgr.GetClient(),
+		Scheme:            mgr.GetScheme(),
+		Recorder:          mgr.GetEventRecorderFor("backup-controller"),
+		CredentialsConfig: credentialsConfig,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "BackupJob")
 		os.Exit(1)
 	}
 
 	if err = (&backupcontroller.RestoreJobReconciler{
-		Client:   mgr.GetClient(),
-		Scheme:   mgr.GetScheme(),
-		Recorder: mgr.GetEventRecorderFor("restore-controller"),
+		Client:            mgr.GetClient(),
+		Scheme:            mgr.GetScheme(),
+		Recorder:          mgr.GetEventRecorderFor("restore-controller"),
+		CredentialsConfig: credentialsConfig,
 	}).SetupWithManager(mgr); err != nil {
 		setupLog.Error(err, "unable to create controller", "controller", "RestoreJob")
 		os.Exit(1)