github/kamaji
1
0
Fork 0
mirror of https://github.com/clastix/kamaji.git synced 2026-08-26 00:47:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(api): add automountServiceAccountToken field for control-plane deployment (#1219)

Browse Source 
This field allows disabling the automatic mounting of the
service account token to the control-plane deployment pods.
This commit is contained in:
Benjamin Gentil
2026-07-27 11:31:25 +02:00
committed by GitHub
parent d38875b150
commit d45faced13
7 changed files with 62 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/v1alpha1/tenantcontrolplane_types.go
+2
View File
@@ -327,6 +327,8 @@ type DeploymentSpec struct {
//+kubebuilder:default="default"
// ServiceAccountName allows to specify the service account to be mounted to the pods of the Control plane deployment
ServiceAccountName string `json:"serviceAccountName,omitempty"`
// AutomountServiceAccountToken allows to enable the automatic mounting of the service account token to the pods of the Control plane deployment
AutomountServiceAccountToken *bool `json:"automountServiceAccountToken,omitempty"`
// ContainerSecurityContexts allows to specify the security context for the individual control plane components.
ContainerSecurityContexts *ControlPlaneContainerSecurityContexts `json:"containerSecurityContexts,omitempty"`
// PodSecurityContext allows to specify the security context for the control plane pod.
api/v1alpha1/zz_generated.deepcopy.go
+5
View File
@@ -797,6 +797,11 @@ func (in *DeploymentSpec) DeepCopyInto(out *DeploymentSpec) {
*out = new(ControlPlaneProbes)
(*in).DeepCopyInto(*out)
}
if in.AutomountServiceAccountToken != nil {
in, out := &in.AutomountServiceAccountToken, &out.AutomountServiceAccountToken
*out = new(bool)
**out = **in
}
if in.ContainerSecurityContexts != nil {
in, out := &in.ContainerSecurityContexts, &out.ContainerSecurityContexts
*out = new(ControlPlaneContainerSecurityContexts)
charts/kamaji-crds/hack/kamaji.clastix.io_tenantcontrolplanes_spec.yaml
+3
View File
@@ -6301,6 +6301,9 @@ versions:
x-kubernetes-list-type: atomic
type: object
type: object
automountServiceAccountToken:
description: AutomountServiceAccountToken allows to enable the automatic mounting of the service account token to the pods of the Control plane deployment
type: boolean
containerSecurityContexts:
description: ContainerSecurityContexts allows to specify the security context for the individual control plane components.
properties:
charts/kamaji/crds/kamaji.clastix.io_tenantcontrolplanes.yaml
+3
View File
@@ -6309,6 +6309,9 @@ spec:
x-kubernetes-list-type: atomic
type: object
type: object
automountServiceAccountToken:
description: AutomountServiceAccountToken allows to enable the automatic mounting of the service account token to the pods of the Control plane deployment
type: boolean
containerSecurityContexts:
description: ContainerSecurityContexts allows to specify the security context for the individual control plane components.
properties:
docs/content/reference/api.md
+7
View File
@@ -31345,6 +31345,13 @@ Defining the options for the deployed Tenant Control Plane as Deployment resourc
More info: https://kubernetes.io/docs/tasks/configure-pod-container/assign-pods-nodes-using-node-affinity/<br/>
</td>
<td>false</td>
</tr><tr>
<td><b>automountServiceAccountToken</b></td>
<td>boolean</td>
<td>
AutomountServiceAccountToken allows to enable the automatic mounting of the service account token to the pods of the Control plane deployment<br/>
</td>
<td>false</td>
</tr><tr>
<td><b><a href="#tenantcontrolplanespeccontrolplanedeploymentcontainersecuritycontexts">containerSecurityContexts</a></b></td>
<td>object</td>
internal/builders/controlplane/deployment.go
+2
View File
@@ -1213,6 +1213,8 @@ func (d Deployment) setAffinity(spec *corev1.PodSpec, tcp kamajiv1alpha1.TenantC
}
func (d Deployment) setServiceAccount(spec *corev1.PodSpec, tcp kamajiv1alpha1.TenantControlPlane) {
spec.AutomountServiceAccountToken = tcp.Spec.ControlPlane.Deployment.AutomountServiceAccountToken
if len(tcp.Spec.ControlPlane.Deployment.ServiceAccountName) > 0 {
spec.ServiceAccountName = tcp.Spec.ControlPlane.Deployment.ServiceAccountName
internal/builders/controlplane/deployment_test.go
+40
View File
@@ -284,4 +284,44 @@ var _ = Describe("Controlplane Deployment", func() {
Expect(c.ReadinessProbe.HTTPGet.Port.IntValue()).To(Equal(6443))
})
})
Describe("ServiceAccount", func() {
It("should default to 'default' SA with nil automount", func() {
podSpec := &corev1.PodSpec{}
tcp := kamajiv1alpha1.TenantControlPlane{}
d.setServiceAccount(podSpec, tcp)
Expect(podSpec.ServiceAccountName).To(Equal("default"))
Expect(podSpec.AutomountServiceAccountToken).To(BeNil())
})
It("should set a custom SA name with nil automount", func() {
podSpec := &corev1.PodSpec{}
tcp := kamajiv1alpha1.TenantControlPlane{}
tcp.Spec.ControlPlane.Deployment.ServiceAccountName = "custom-sa"
d.setServiceAccount(podSpec, tcp)
Expect(podSpec.ServiceAccountName).To(Equal("custom-sa"))
Expect(podSpec.AutomountServiceAccountToken).To(BeNil())
})
It("should enable automount when AutomountServiceAccountToken is true", func() {
podSpec := &corev1.PodSpec{}
tcp := kamajiv1alpha1.TenantControlPlane{}
tcp.Spec.ControlPlane.Deployment.AutomountServiceAccountToken = pointer.To(true)
d.setServiceAccount(podSpec, tcp)
Expect(podSpec.ServiceAccountName).To(Equal("default"))
Expect(podSpec.AutomountServiceAccountToken).ToNot(BeNil())
Expect(*podSpec.AutomountServiceAccountToken).To(BeTrue())
})
It("should disable automount when AutomountServiceAccountToken is false", func() {
podSpec := &corev1.PodSpec{}
tcp := kamajiv1alpha1.TenantControlPlane{}
tcp.Spec.ControlPlane.Deployment.AutomountServiceAccountToken = pointer.To(false)
tcp.Spec.ControlPlane.Deployment.ServiceAccountName = "another-sa"
d.setServiceAccount(podSpec, tcp)
Expect(podSpec.ServiceAccountName).To(Equal("another-sa"))
Expect(podSpec.AutomountServiceAccountToken).ToNot(BeNil())
Expect(*podSpec.AutomountServiceAccountToken).To(BeFalse())
})
})
})