Skip to content

Commit 1a0fbee

Browse files
rocketeerbkwrocketeerbkw
authored
Merge pull request #420 from uselagoon/no-automountserviceaccounttoken
chore: dont automount serviceaccount token
2 parents 44bfe66 + 8804012 commit 1a0fbee

File tree

97 files changed

+121
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

97 files changed

+121
-0
lines changed

‎internal/templating/templates_cronjob.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,10 @@ func GenerateCronjobTemplate(
9999
},
100100
},
101101
}
102+
103+
// disable automounted service account
104+
cronjob.Spec.JobTemplate.Spec.Template.Spec.AutomountServiceAccountToken = helpers.BoolPtr(false)
105+
102106
cronjob.Spec.Schedule = nCronjob.Schedule
103107
cronjob.Spec.ConcurrencyPolicy = batchv1.ForbidConcurrent
104108
cronjob.Spec.SuccessfulJobsHistoryLimit = helpers.Int32Ptr(0)

‎internal/templating/templates_deployment.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,9 @@ func GenerateDeploymentTemplate(
101101
deployment.ObjectMeta.Labels = labels
102102
deployment.ObjectMeta.Annotations = annotations
103103

104+
// disable automounted service account
105+
deployment.Spec.Template.Spec.AutomountServiceAccountToken = helpers.BoolPtr(false)
106+
104107
if serviceValues.UseSpotInstances {
105108
// handle spot instance label and affinity/tolerations/selectors
106109
additionalLabels["lagoon.sh/spot"] = "true"

‎internal/templating/test-resources/cronjob/result-cli-1.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ spec:
4545
lagoon.sh/service-type: cli
4646
lagoon.sh/template: cli-0.1.0
4747
spec:
48+
automountServiceAccountToken: false
4849
containers:
4950
- command:
5051
- /lagoon/cronjob.sh
@@ -138,6 +139,7 @@ spec:
138139
lagoon.sh/service-type: cli
139140
lagoon.sh/template: cli-0.1.0
140141
spec:
142+
automountServiceAccountToken: false
141143
containers:
142144
- command:
143145
- /lagoon/cronjob.sh
@@ -231,6 +233,7 @@ spec:
231233
lagoon.sh/service-type: cli-persistent
232234
lagoon.sh/template: cli-persistent-0.1.0
233235
spec:
236+
automountServiceAccountToken: false
234237
containers:
235238
- command:
236239
- /lagoon/cronjob.sh

‎internal/templating/test-resources/cronjob/result-cli-2.yaml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ spec:
4545
lagoon.sh/service-type: cli
4646
lagoon.sh/template: cli-0.1.0
4747
spec:
48+
automountServiceAccountToken: false
4849
containers:
4950
- command:
5051
- /lagoon/cronjob.sh
@@ -143,6 +144,7 @@ spec:
143144
lagoon.sh/service-type: cli
144145
lagoon.sh/template: cli-0.1.0
145146
spec:
147+
automountServiceAccountToken: false
146148
containers:
147149
- command:
148150
- /lagoon/cronjob.sh
@@ -241,6 +243,7 @@ spec:
241243
lagoon.sh/service-type: cli-persistent
242244
lagoon.sh/template: cli-persistent-0.1.0
243245
spec:
246+
automountServiceAccountToken: false
244247
containers:
245248
- command:
246249
- /lagoon/cronjob.sh

‎internal/templating/test-resources/cronjob/result-cli-3.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ spec:
4545
lagoon.sh/service-type: cli
4646
lagoon.sh/template: cli-0.1.0
4747
spec:
48+
automountServiceAccountToken: false
4849
containers:
4950
- command:
5051
- /lagoon/cronjob.sh

‎internal/templating/test-resources/deployment/result-basic-1.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ spec:
4444
lagoon.sh/service-type: basic
4545
lagoon.sh/template: basic-0.1.0
4646
spec:
47+
automountServiceAccountToken: false
4748
containers:
4849
- env:
4950
- name: LAGOON_GIT_SHA
@@ -142,6 +143,7 @@ spec:
142143
- key: lagoon.sh/spot
143144
operator: Exists
144145
weight: 1
146+
automountServiceAccountToken: false
145147
containers:
146148
- env:
147149
- name: LAGOON_GIT_SHA
@@ -234,6 +236,7 @@ spec:
234236
lagoon.sh/service-type: basic-persistent
235237
lagoon.sh/template: basic-persistent-0.1.0
236238
spec:
239+
automountServiceAccountToken: false
237240
containers:
238241
- env:
239242
- name: LAGOON_GIT_SHA
@@ -326,6 +329,7 @@ spec:
326329
lagoon.sh/service-type: basic-persistent
327330
lagoon.sh/template: basic-persistent-0.1.0
328331
spec:
332+
automountServiceAccountToken: false
329333
containers:
330334
- env:
331335
- name: LAGOON_GIT_SHA
@@ -418,6 +422,7 @@ spec:
418422
lagoon.sh/service-type: basic-persistent
419423
lagoon.sh/template: basic-persistent-0.1.0
420424
spec:
425+
automountServiceAccountToken: false
421426
containers:
422427
- env:
423428
- name: LAGOON_GIT_SHA

‎internal/templating/test-resources/deployment/result-basic-2.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ spec:
5454
- key: lagoon.sh/spot
5555
operator: Exists
5656
weight: 1
57+
automountServiceAccountToken: false
5758
containers:
5859
- env:
5960
- name: LAGOON_GIT_SHA

‎internal/templating/test-resources/deployment/result-basic-3.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ spec:
5454
- key: lagoon.sh/spot
5555
operator: Exists
5656
weight: 1
57+
automountServiceAccountToken: false
5758
containers:
5859
- env:
5960
- name: LAGOON_GIT_SHA

‎internal/templating/test-resources/deployment/result-basic-4.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ spec:
4848
lagoon.sh/service-type: basic-single
4949
lagoon.sh/template: basic-single-0.1.0
5050
spec:
51+
automountServiceAccountToken: false
5152
containers:
5253
- env:
5354
- name: LAGOON_GIT_SHA

‎internal/templating/test-resources/deployment/result-basic-5.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ spec:
4444
lagoon.sh/service-type: basic
4545
lagoon.sh/template: basic-0.1.0
4646
spec:
47+
automountServiceAccountToken: false
4748
containers:
4849
- env:
4950
- name: LAGOON_GIT_SHA

0 commit comments

Comments
 (0)