From 41f8c666d32d5b1ce373d30787778c9511a4e4f8 Mon Sep 17 00:00:00 2001 From: Nancy <9d.24.nancy.sangani@gmail.com> Date: Tue, 14 Apr 2026 19:57:50 +0530 Subject: [PATCH] feat: introduce ServiceAccountToken template for Kubernetes resources Signed-off-by: Nancy <9d.24.nancy.sangani@gmail.com> --- internal/chart/v3/util/create.go | 28 +++++++++++++++++++++++++++ internal/chart/v3/util/create_test.go | 1 + pkg/chart/v2/util/create.go | 28 +++++++++++++++++++++++++++ pkg/chart/v2/util/create_test.go | 1 + 4 files changed, 58 insertions(+) diff --git a/internal/chart/v3/util/create.go b/internal/chart/v3/util/create.go index 48d2120e5..1bdb8c258 100644 --- a/internal/chart/v3/util/create.go +++ b/internal/chart/v3/util/create.go @@ -62,6 +62,8 @@ const ( ServiceName = TemplatesDir + sep + "service.yaml" // ServiceAccountName is the name of the example serviceaccount file. ServiceAccountName = TemplatesDir + sep + "serviceaccount.yaml" + // ServiceAccountTokenName is the name of the example service account token secret file. + ServiceAccountTokenName = TemplatesDir + sep + "serviceaccounttoken.yaml" // HorizontalPodAutoscalerName is the name of the example hpa file. HorizontalPodAutoscalerName = TemplatesDir + sep + "hpa.yaml" // NotesName is the name of the example NOTES.txt file. @@ -137,6 +139,14 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template name: "" + # Specifies whether a non-expiring token Secret should be created for this ServiceAccount. + # Starting from Kubernetes 1.24, ServiceAccount token Secrets are no longer auto-generated. + # Use the TokenRequest API (kubectl create token ) for short-lived tokens instead, + # as long-lived static tokens carry additional risk. Only enable this if your use case + # requires a non-expiring token (e.g., external systems that cannot use the TokenRequest API). + # See: https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets + createToken: false + # This is for setting Kubernetes Annotations to a Pod. # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ podAnnotations: {} @@ -490,6 +500,19 @@ automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} ` +const defaultServiceAccountToken = `{{- if and .Values.serviceAccount.create .Values.serviceAccount.createToken -}} +apiVersion: v1 +kind: Secret +type: kubernetes.io/service-account-token +metadata: + name: {{ include ".serviceAccountName" . }} + labels: + {{- include ".labels" . | nindent 4 }} + annotations: + kubernetes.io/service-account.name: {{ include ".serviceAccountName" . }} +{{- end }} +` + const defaultHorizontalPodAutoscaler = `{{- if .Values.autoscaling.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler @@ -772,6 +795,11 @@ func Create(name, dir string) (string, error) { path: filepath.Join(cdir, ServiceAccountName), content: transform(defaultServiceAccount, name), }, + { + // serviceaccounttoken.yaml + path: filepath.Join(cdir, ServiceAccountTokenName), + content: transform(defaultServiceAccountToken, name), + }, { // hpa.yaml path: filepath.Join(cdir, HorizontalPodAutoscalerName), diff --git a/internal/chart/v3/util/create_test.go b/internal/chart/v3/util/create_test.go index abdd52a82..6e1f8822d 100644 --- a/internal/chart/v3/util/create_test.go +++ b/internal/chart/v3/util/create_test.go @@ -52,6 +52,7 @@ func TestCreate(t *testing.T) { IgnorefileName, NotesName, ServiceAccountName, + ServiceAccountTokenName, ServiceName, TemplatesDir, TemplatesTestsDir, diff --git a/pkg/chart/v2/util/create.go b/pkg/chart/v2/util/create.go index 0d7ae8d5c..43478ceac 100644 --- a/pkg/chart/v2/util/create.go +++ b/pkg/chart/v2/util/create.go @@ -62,6 +62,8 @@ const ( ServiceName = TemplatesDir + sep + "service.yaml" // ServiceAccountName is the name of the example serviceaccount file. ServiceAccountName = TemplatesDir + sep + "serviceaccount.yaml" + // ServiceAccountTokenName is the name of the example service account token secret file. + ServiceAccountTokenName = TemplatesDir + sep + "serviceaccounttoken.yaml" // HorizontalPodAutoscalerName is the name of the example hpa file. HorizontalPodAutoscalerName = TemplatesDir + sep + "hpa.yaml" // NotesName is the name of the example NOTES.txt file. @@ -137,6 +139,14 @@ serviceAccount: # If not set and create is true, a name is generated using the fullname template. name: "" + # Specifies whether a non-expiring token Secret should be created for this ServiceAccount. + # Starting from Kubernetes 1.24, ServiceAccount token Secrets are no longer auto-generated. + # Use the TokenRequest API (kubectl create token ) for short-lived tokens instead, + # as long-lived static tokens carry additional risk. Only enable this if your use case + # requires a non-expiring token (e.g., external systems that cannot use the TokenRequest API). + # See: https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets + createToken: false + # This is for setting Kubernetes Annotations to a Pod. # For more information checkout: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/ podAnnotations: {} @@ -489,6 +499,19 @@ automountServiceAccountToken: {{ .Values.serviceAccount.automount }} {{- end }} ` +const defaultServiceAccountToken = `{{- if and .Values.serviceAccount.create .Values.serviceAccount.createToken -}} +apiVersion: v1 +kind: Secret +type: kubernetes.io/service-account-token +metadata: + name: {{ include ".serviceAccountName" . }} + labels: + {{- include ".labels" . | nindent 4 }} + annotations: + kubernetes.io/service-account.name: {{ include ".serviceAccountName" . }} +{{- end }} +` + const defaultHorizontalPodAutoscaler = `{{- if .Values.autoscaling.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler @@ -771,6 +794,11 @@ func Create(name, dir string) (string, error) { path: filepath.Join(cdir, ServiceAccountName), content: transform(defaultServiceAccount, name), }, + { + // serviceaccounttoken.yaml + path: filepath.Join(cdir, ServiceAccountTokenName), + content: transform(defaultServiceAccountToken, name), + }, { // hpa.yaml path: filepath.Join(cdir, HorizontalPodAutoscalerName), diff --git a/pkg/chart/v2/util/create_test.go b/pkg/chart/v2/util/create_test.go index 967972fc8..7bf54359a 100644 --- a/pkg/chart/v2/util/create_test.go +++ b/pkg/chart/v2/util/create_test.go @@ -52,6 +52,7 @@ func TestCreate(t *testing.T) { IgnorefileName, NotesName, ServiceAccountName, + ServiceAccountTokenName, ServiceName, TemplatesDir, TemplatesTestsDir,