Allow changing automountServiceAccountToken in the PodSpec

[vidarno]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you expect to see?

There is no way to set automountServiceAccountToken in the current helm chart.

automountServiceAccountToken is set to false in the actual service account definition, but in environments that have policies that require automountServiceAccountToken to be false in the actual Podspec this isn't good enough.

Ideally the same value would change automountServiceAccountToken in both the service account definition and in the podspec, but since they are respectively true and false by default this would effectively change the default behaviour if both were set by this one value so I suggest to only have this value control the attribute in the podspec and not both.

I am ready to provide a PR that provides this feature. It passes the tests and has updated the schema.

[mloiseleur]

There is no way because Traefik needs this token.
Would you please describe with more details your use case ?

[vidarno]

The need comes from environments that don't allow automounting the serviceaccount due to policies (OPA, Kyverno or similar).

The solution in such an environment is to disable automounting of the serviceaccount and instead use service account token projection, like described here - https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#launch-a-pod-using-service-account-token-projection

Using this helm-chart, this could be done with something like:

        additionalVolumeMounts:
          - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
            name: kube-api-access
        volumes:
          - name: kube-api-access
            projected:
              sources:
                - serviceAccountToken:
                    path: token
                - configMap:
                    items:
                      - key: ca.crt
                        path: ca.crt
                    name: kube-root-ca.crt
                - downwardAPI:
                    items:
                      - fieldRef:
                          apiVersion: v1
                          fieldPath: metadata.namespace
                        path: namespace 

[mloiseleur]

We are interested in this issue, but we’re unsure about the use case and the traction it will receive. We are going to leave the status as kind/proposal to give the community time to let us know if they would like this idea.
We will reevaluate as people respond.