feat: add automountServiceAccountToken support to Deployment

README.md

@@ -128,6 +128,7 @@ helm delete --namespace test my-application
 | deployment.securityContext | object | `nil` | Security Context for the pod. |
 | deployment.command | list | `[]` | Command for the app container. |
 | deployment.args | list | `[]` | Args for the app container. |
+| deployment.automountServiceAccountToken | bool | `true` | Mount Service Account token. |
 | deployment.ports | list | `nil` | List of ports for the app container. |
 | deployment.hostNetwork | bool | `nil` | Host network connectivity. |
 | deployment.terminationGracePeriodSeconds | int | `nil` | Gracefull termination period. |

application/templates/cronjob.yaml

@@ -60,6 +60,7 @@ spec:
           annotations: {{ toYaml . | nindent 12 }}
           {{- end }}
         spec:
+          automountServiceAccountToken: {{ kindIs "invalid" $job.automountServiceAccountToken | ternary true $job.automountServiceAccountToken }}
           {{- if $.Values.rbac.enabled }}
           {{- if $.Values.rbac.serviceAccount.name }}
           serviceAccountName: {{ $.Values.rbac.serviceAccount.name }}

application/templates/deployment.yaml

@@ -327,6 +327,7 @@ spec:
       serviceAccountName: {{ template "application.name" $ }}
       {{- end }}
       {{- end }}
+      automountServiceAccountToken: {{ .Values.deployment.automountServiceAccountToken }}
       {{- if .Values.deployment.hostNetwork }}
       hostNetwork: {{ .Values.deployment.hostNetwork }}
       {{- end }}

application/templates/job.yaml

@@ -40,6 +40,7 @@ spec:
       annotations: {{ toYaml . | nindent 8 }}
       {{- end }}
     spec:
+      automountServiceAccountToken: {{ kindIs "invalid" $job.automountServiceAccountToken | ternary true $job.automountServiceAccountToken }}
       {{- if $.Values.rbac.enabled }}
       {{- if $.Values.rbac.serviceAccount.name }}
       serviceAccountName: {{ $.Values.rbac.serviceAccount.name }}

application/tests/cronjob_test.yaml

@@ -329,3 +329,47 @@ tests:
       - equal:
           path: spec.jobTemplate.spec.template.spec.containers[0].image
           value: custom-image
+
+  - it: configures automount service account token by default
+    set:
+      cronJob:
+        enabled: true
+        jobs:
+          example:
+            image:
+              repository: example-image
+              tag: example-tag
+    asserts:
+      - equal:
+          path: spec.jobTemplate.spec.template.spec.automountServiceAccountToken
+          value: true
+
+  - it: enable automount service account token when configured
+    set:
+      cronJob:
+        enabled: true
+        jobs:
+          example:
+            automountServiceAccountToken: true
+            image:
+              repository: example-image
+              tag: example-tag
+    asserts:
+      - equal:
+          path: spec.jobTemplate.spec.template.spec.automountServiceAccountToken
+          value: true
+
+  - it: disable automount service account token when configured
+    set:
+      cronJob:
+        enabled: true
+        jobs:
+          example:
+            automountServiceAccountToken: false
+            image:
+              repository: example-image
+              tag: example-tag
+    asserts:
+      - equal:
+          path: spec.jobTemplate.spec.template.spec.automountServiceAccountToken
+          value: false

application/tests/deployment_test.yaml

@@ -114,6 +114,20 @@ tests:
           path: spec.template.spec.serviceAccountName
           value: example-app
 
+  - it: configures automount service account token by default
+    asserts:
+      - equal:
+          path: spec.template.spec.automountServiceAccountToken
+          value: true
+
+  - it: disable automount service account token when configured
+    set:
+      deployment.automountServiceAccountToken: false
+    asserts:
+      - equal:
+          path: spec.template.spec.automountServiceAccountToken
+          value: false
+
   - it: uses grpc probing when set
     set:
       applicationName: example-app

application/tests/job_test.yaml

@@ -328,3 +328,47 @@ tests:
       - equal:
           path: spec.template.spec.containers[0].image
           value: custom-image
+
+  - it: configures automount service account token by default
+    set:
+      job:
+        enabled: true
+        jobs:
+          example:
+            image:
+              repository: example-image
+              tag: example-tag
+    asserts:
+      - equal:
+          path: spec.template.spec.automountServiceAccountToken
+          value: true
+
+  - it: enable automount service account token when configured
+    set:
+      job:
+        enabled: true
+        jobs:
+          example:
+            automountServiceAccountToken: true
+            image:
+              repository: example-image
+              tag: example-tag
+    asserts:
+      - equal:
+          path: spec.template.spec.automountServiceAccountToken
+          value: true
+
+  - it: disable automount service account token when configured
+    set:
+      job:
+        enabled: true
+        jobs:
+          example:
+            automountServiceAccountToken: false
+            image:
+              repository: example-image
+              tag: example-tag
+    asserts:
+      - equal:
+          path: spec.template.spec.automountServiceAccountToken
+          value: false

application/values.yaml

@@ -443,6 +443,9 @@ deployment:
   # -- (list) Args for the app container.
   # @section -- Deployment Parameters
   args: []
+  # -- (bool) Mount Service Account token.
+  # @section -- Deployment Parameters
+  automountServiceAccountToken: true
   # -- (list) List of ports for the app container.
   # @section -- Deployment Parameters
   ports: