Allow changing automountServiceAccountToken in PodSpec via values.yaml

[vidarno]

What does this PR do?

This PR adds serviceAccount.automountServiceAccountToken to values.yaml and thus allows changing automountServiceAccountToken in the PodSpec, which is true by default. This PR does not change the default behavior.

Motivation

automountServiceAccountToken is set to false in the actual service account definition, but in environments that have policies that require automountServiceAccountToken to be false in the actual Podspec this isn't good enough. Ideally the same value would change automountServiceAccountToken in both the service account definition and in the podspec, but since they are respectively true and false by default this would effectively change the default behaviour if both were set by this one value so I opted to only have this value control the attribute in the podspec.

This is the issue described in #1254

More

• [X ] Yes, I updated the tests accordingly
• Yes, I updated the schema accordingly
• Yes, I ran make test and all the tests passed

[darkweaver87]

Hello @vidarno,

Thanks for your contribution :-)

Could you describe your use case a bit more ? Because Traefik needs a token to list/get/update the resources (Ingress/IngressRoutes/Middlewares, ...) it needs depending on the providers you're using. Or, are you willing to inject the token manually using a TokenRequest for instance ?

In any case, could you add some tests around your change ?

Thanks.

Rémi

[vidarno]

The need comes from environments that don't allow automounting the serviceaccount due to policies (OPA, Kyverno or similar).

The solution in such an environment is to disable automounting of the serviceaccount and instead use service account token projection, like described here - https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#launch-a-pod-using-service-account-token-projection

This helm chart already has support for volumes and volumemounts, so this should be a good alternative to automounting the serviceaccount for those who are unable to do so.