feat(kubernetes/chart): explicitly mount service-account-token in dep…

…loyment (bitnami-labs#885)
agarcia-oss · Jul 14, 2022 · 2d4b734 · 2d4b734
1 parent 1ee17f1
commit 2d4b734
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 9 deletions.
diff --git a/helm/sealed-secrets/README.md b/helm/sealed-secrets/README.md
@@ -84,7 +84,7 @@ The command removes all the Kubernetes components associated with the chart and
 
 | Name                                              | Description                                                                          | Value                               |
 | ------------------------------------------------- | ------------------------------------------------------------------------------------ | ----------------------------------- |
-| `image.registry`                                  | Sealed Secrets image registry                                                        | `docker.io`                           |
+| `image.registry`                                  | Sealed Secrets image registry                                                        | `docker.io`                         |
 | `image.repository`                                | Sealed Secrets image repository                                                      | `bitnami/sealed-secrets-controller` |
 | `image.tag`                                       | Sealed Secrets image tag (immutable tags are recommended)                            | `v0.18.0`                           |
 | `image.pullPolicy`                                | Sealed Secrets image pull policy                                                     | `IfNotPresent`                      |
@@ -124,6 +124,7 @@ The command removes all the Kubernetes components associated with the chart and
 | `containerSecurityContext.readOnlyRootFilesystem` | Whether the Sealed Secret container has a read-only root filesystem                  | `true`                              |
 | `containerSecurityContext.runAsNonRoot`           | Indicates that the Sealed Secret container must run as a non-root user               | `true`                              |
 | `containerSecurityContext.runAsUser`              | Set Sealed Secret containers' Security Context runAsUser                             | `1001`                              |
+| `automountServiceAccountToken`                    | Whether to automatically mount the service account API-token to a particular pod     | `""`                                |
 | `podLabels`                                       | Extra labels for Sealed Secret pods                                                  | `{}`                                |
 | `podAnnotations`                                  | Annotations for Sealed Secret pods                                                   | `{}`                                |
 | `priorityClassName`                               | Sealed Secret pods' priorityClassName                                                | `""`                                |
@@ -159,14 +160,15 @@ The command removes all the Kubernetes components associated with the chart and
 
 ### Other Parameters
 
-| Name                    | Description                                          | Value   |
-| ----------------------- | ---------------------------------------------------- | ------- |
-| `serviceAccount.create` | Specifies whether a ServiceAccount should be created | `true`  |
-| `serviceAccount.labels` | Extra labels to be added to the ServiceAccount       | `{}`    |
-| `serviceAccount.name`   | The name of the ServiceAccount to use.               | `""`    |
-| `rbac.create`           | Specifies whether RBAC resources should be created   | `true`  |
-| `rbac.labels`           | Extra labels to be added to RBAC resources           | `{}`    |
-| `rbac.pspEnabled`       | PodSecurityPolicy                                    | `false` |
+| Name                                          | Description                                               | Value   |
+| --------------------------------------------- | --------------------------------------------------------- | ------- |
+| `serviceAccount.create`                       | Specifies whether a ServiceAccount should be created      | `true`  |
+| `serviceAccount.labels`                       | Extra labels to be added to the ServiceAccount            | `{}`    |
+| `serviceAccount.name`                         | The name of the ServiceAccount to use.                    | `""`    |
+| `serviceAccount.automountServiceAccountToken` | Specifies, whether to mount the service account API-token | `""`    |
+| `rbac.create`                                 | Specifies whether RBAC resources should be created        | `true`  |
+| `rbac.labels`                                 | Extra labels to be added to RBAC resources                | `{}`    |
+| `rbac.pspEnabled`                             | PodSecurityPolicy                                         | `false` |
 
 
 ### Metrics parameters

diff --git a/helm/sealed-secrets/templates/deployment.yaml b/helm/sealed-secrets/templates/deployment.yaml
@@ -46,6 +46,9 @@ spec:
       securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "sealed-secrets.serviceAccountName" . }}
+      {{- if .Values.automountServiceAccountToken }}
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+      {{- end }}
       containers:
         - name: controller
           command:

diff --git a/helm/sealed-secrets/templates/service-account.yaml b/helm/sealed-secrets/templates/service-account.yaml
@@ -1,6 +1,9 @@
 {{ if .Values.serviceAccount.create }}
 apiVersion: v1
 kind: ServiceAccount
+{{- if .Values.serviceAccount.automountServiceAccountToken }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- end }}
 metadata:
   name: {{ include "sealed-secrets.serviceAccountName" . }}
   namespace: {{ include "sealed-secrets.namespace" . }}

diff --git a/helm/sealed-secrets/values.yaml b/helm/sealed-secrets/values.yaml
@@ -154,6 +154,10 @@ containerSecurityContext:
   readOnlyRootFilesystem: true
   runAsNonRoot: true
   runAsUser: 1001
+
+## @param automountServiceAccountToken whether to automatically mount the service account API-token to a particular pod
+automountServiceAccountToken: ""
+
 ## @param podLabels [object] Extra labels for Sealed Secret pods
 ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
 ##
@@ -313,6 +317,8 @@ serviceAccount:
   ## If not set and create is true, a name is generated using the sealed-secrets.fullname template
   ##
   name: ""
+  ## @param serviceAccount.automountServiceAccountToken Specifies, whether to mount the service account API-token
+  automountServiceAccountToken: ""
 ## RBAC configuration
 ##
 rbac: