polaris/checks/automountServiceAccountToken.yaml

successMessage: The ServiceAccount will not be automounted
failureMessage: The ServiceAccount will be automounted
category: Security
target: PodSpec
schema:
  '$schema': http://json-schema.org/draft-07/schema
  type: object
  properties:
    serviceAccountName:
      type: string
    automountServiceAccountToken:
      type: boolean
      not:
        const: true
additionalSchemaStrings:
  ServiceAccount: |
    {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
    type: object
    required:
      - metadata
      - automountServiceAccountToken
    properties:
      metadata:
        type: object
        required: ["name"]
        properties:
          name:
            type: string
            const: "{{ .Polaris.PodSpec.serviceAccountName }}"
      {{ if not (eq .Polaris.PodSpec.automountServiceAccountToken false) }}
      automountServiceAccountToken:
        type: boolean
        const: false
      {{ end }}
    {{ end }}