[Helm Chart]: Add automountServiceAccountToken to pod spec

[bianchi2]

Setting automountServiceAccountToken to false is often enforced in regulated clusters. Adding it to pod spec with the default value true.

[stevehipwell]

Thanks for the PR @bianchi2. I've added some suggestions to tidy up the implementation.

Also I think that if the chart provides a serviceAccount.automountToken value then I'd expect this to primarily modify the ServiceAccount resource; so could you please add automountServiceAccountToken: {{ .Values.serviceAccount.automountToken }} to the service account template.

I think I'm happy that this value is also used for the pod spec.

[bianchi2]

@stevehipwell thanks! Indeed, it's cleaner this way - no changes to existing deployments. Fixed now.

[bianchi2]

@stevehipwell please let me know if there's anything else to do to have this one merged. That's the only thing that forces us fork this helm chart (or use kustomize post render) which we'd like to avoid. Thanks

[stevehipwell]

Also I think that if the chart provides a serviceAccount.automountToken value then I'd expect this to primarily modify the ServiceAccount resource; so could you please add automountServiceAccountToken: {{ .Values.serviceAccount.automountToken }} to the service account template.

A per my previous comment I'm waiting on an update to the ServiceAccount template, but using the with pattern as the default is null.

Also you will need to bump the chart version and update the annotations in Chart.yaml.

[bianchi2]

@stevehipwell I have updated the PR. One thing though. When using:

{{- with .Values.serviceAccount.automountServiceAccountToken }}
automountServiceAccountToken: {{ . }}
{{- end }}

automountServiceAccountToken does not show up in the generated yamls at all when I set serviceAccount.automountServiceAccountToken to false (which is why we need it in the first place since it's implicitly true by default). That's the behavior of "with syntax" - if it's false, it skips it.

In helpers, I have defined the following, basically checking if it's not nil:

{{- define "fluent-bit.automountServiceAccountToken" -}}
{{- if ne .Values.serviceAccount.automountServiceAccountToken nil }}
automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
{{- end }}
{{- end }}

So now, when unset (default behavior), nothing changes in the rendered templates, and when set the value is used in both pod and sa.

I hope it makes sense.

[stevehipwell]

I'd rather keep this simple and not create a template for a conditional check.

[stevehipwell]

LGTM