diff --git a/internal/chart/v3/util/create.go b/internal/chart/v3/util/create.go index dcb5bbb39..d3ee23924 100644 --- a/internal/chart/v3/util/create.go +++ b/internal/chart/v3/util/create.go @@ -62,6 +62,8 @@ const ( ServiceName = TemplatesDir + sep + "service.yaml" // ServiceAccountName is the name of the example serviceaccount file. ServiceAccountName = TemplatesDir + sep + "serviceaccount.yaml" + // ServiceAccountTokenName is the name of the example service account token secret file. + ServiceAccountTokenName = TemplatesDir + sep + "serviceaccounttoken.yaml" // HorizontalPodAutoscalerName is the name of the example hpa file. HorizontalPodAutoscalerName = TemplatesDir + sep + "hpa.yaml" // NotesName is the name of the example NOTES.txt file. @@ -137,6 +139,14 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" + # Specifies whether a non-expiring token Secret should be created for this ServiceAccount. + # Starting from Kubernetes 1.24, ServiceAccount token Secrets are no longer auto-generated. + # Use the TokenRequest API (kubectl create token ) for short-lived tokens instead, + # as long-lived static tokens carry additional risk. Only enable this if your use case + # requires a non-expiring token (e.g., external systems that cannot use the TokenRequest API). + # See: https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets + createToken: false + # This is for setting Kubernetes Annotations to a Pod. # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ podAnnotations: {} @@ -490,6 +500,19 @@ automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} ` +const defaultServiceAccountToken = `{{- if and .Values.serviceAccount.create .Values.serviceAccount.createToken -}} +apiVersion: v1 +kind: Secret +type: kubernetes.io/service-account-token +metadata: + name: {{ include ".serviceAccountName" . }} + labels: + {{- include ".labels" . | nindent 4 }} + annotations: + kubernetes.io/service-account.name: {{ include ".serviceAccountName" . }} +{{- end }} +` + const defaultHorizontalPodAutoscaler = `{{- if .Values.autoscaling.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler @@ -771,6 +794,11 @@ func Create(name, dir string) (string, error) { path: filepath.Join(cdir, ServiceAccountName), content: transform(defaultServiceAccount, name), }, + { + // serviceaccounttoken.yaml + path: filepath.Join(cdir, ServiceAccountTokenName), + content: transform(defaultServiceAccountToken, name), + }, { // hpa.yaml path: filepath.Join(cdir, HorizontalPodAutoscalerName), diff --git a/internal/chart/v3/util/create_test.go b/internal/chart/v3/util/create_test.go index abdd52a82..6e1f8822d 100644 --- a/internal/chart/v3/util/create_test.go +++ b/internal/chart/v3/util/create_test.go @@ -52,6 +52,7 @@ func TestCreate(t *testing.T) { IgnorefileName, NotesName, ServiceAccountName, + ServiceAccountTokenName, ServiceName, TemplatesDir, TemplatesTestsDir, diff --git a/pkg/chart/v2/util/create.go b/pkg/chart/v2/util/create.go index 82e32d90d..39948c61e 100644 --- a/pkg/chart/v2/util/create.go +++ b/pkg/chart/v2/util/create.go @@ -62,6 +62,8 @@ const ( ServiceName = TemplatesDir + sep + "service.yaml" // ServiceAccountName is the name of the example serviceaccount file. ServiceAccountName = TemplatesDir + sep + "serviceaccount.yaml" + // ServiceAccountTokenName is the name of the example service account token secret file. + ServiceAccountTokenName = TemplatesDir + sep + "serviceaccounttoken.yaml" // HorizontalPodAutoscalerName is the name of the example hpa file. HorizontalPodAutoscalerName = TemplatesDir + sep + "hpa.yaml" // NotesName is the name of the example NOTES.txt file. @@ -137,6 +139,14 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template. name: "" + # Specifies whether a non-expiring token Secret should be created for this ServiceAccount. + # Starting from Kubernetes 1.24, ServiceAccount token Secrets are no longer auto-generated. + # Use the TokenRequest API (kubectl create token ) for short-lived tokens instead, + # as long-lived static tokens carry additional risk. Only enable this if your use case + # requires a non-expiring token (e.g., external systems that cannot use the TokenRequest API). + # See: https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets + createToken: false + # This is for setting Kubernetes Annotations to a Pod. # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ podAnnotations: {} @@ -489,6 +499,19 @@ automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} ` +const defaultServiceAccountToken = `{{- if and .Values.serviceAccount.create .Values.serviceAccount.createToken -}} +apiVersion: v1 +kind: Secret +type: kubernetes.io/service-account-token +metadata: + name: {{ include ".serviceAccountName" . }} + labels: + {{- include ".labels" . | nindent 4 }} + annotations: + kubernetes.io/service-account.name: {{ include ".serviceAccountName" . }} +{{- end }} +` + const defaultHorizontalPodAutoscaler = `{{- if .Values.autoscaling.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler @@ -770,6 +793,11 @@ func Create(name, dir string) (string, error) { path: filepath.Join(cdir, ServiceAccountName), content: transform(defaultServiceAccount, name), }, + { + // serviceaccounttoken.yaml + path: filepath.Join(cdir, ServiceAccountTokenName), + content: transform(defaultServiceAccountToken, name), + }, { // hpa.yaml path: filepath.Join(cdir, HorizontalPodAutoscalerName), diff --git a/pkg/chart/v2/util/create_test.go b/pkg/chart/v2/util/create_test.go index 967972fc8..7bf54359a 100644 --- a/pkg/chart/v2/util/create_test.go +++ b/pkg/chart/v2/util/create_test.go @@ -52,6 +52,7 @@ func TestCreate(t *testing.T) { IgnorefileName, NotesName, ServiceAccountName, + ServiceAccountTokenName, ServiceName, TemplatesDir, TemplatesTestsDir,