Update the template to support extraVolumes & extraVolumeMounts field for AdmissionWebhooks Job Manifest

[Pravin-Kumar-GitHub]

We were trying to disable the AutoMountServiceAccountToken for the Admissions Webhook Create Secret and Patch Webhook jobs. However, when we set AMT to False, the job fails unless we set the ExtraVol and ExtraVolMounts. However, it seems that the two attributes are not included within the templates.

Current Kubernetes version which we're using is 1.30.9

https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-createSecret.yaml

https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/templates/admission-webhooks/job-patch/job-patchWebhook.yaml

Is there a way to include extraVolume & extraVolumeMounts in the template for future helm versions? Is there an alternative method to resolve this?

[k8s-ci-robot]

This issue is currently awaiting triage.

If Ingress contributors determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Gacko]

I assume your cloud provider is recommending disabling automountServiceAccountToken, right? This recommendation is made for people having it enabled, because this is the default, but not needing API server access. These jobs in fact need API server access, so disabling it and manually implementing the service account token mounting is just making the maintenance of your deployment unnecessarily more complex.

Still I understand your issue and the need for such volumes if the automountServiceAccountToken is disabled. Unfortunately we currently do not have the capacity to implement such a feature.

I therefore can only propose 3 solutions to you:

• Use CertManager and disable the whole Webhook Patch Job.
• Keep automountServiceAccountToken enabled and ignore the alert.
• Provide a PR to implement such a feature.

[arjunbabuust]

Hi @Gacko

Could you please explain the steps to submit a PR for this Change Request?

[arjunbnair97]

Added PR: #13127

FYI @Gacko @Pravin-Kumar-GitHub