[kube-state-metrics] Add automountServiceAccountToken flags

Signed-off-by: Jan-Otto Kröpke <[email protected]>
jkroepke · Jul 1, 2024 · 261e3c8 · 261e3c8
1 parent ab2f3e8
commit 261e3c8
Show file tree

Hide file tree

Showing 4 changed files with 8 additions and 1 deletion.
diff --git a/charts/kube-state-metrics/Chart.yaml b/charts/kube-state-metrics/Chart.yaml
@@ -7,7 +7,7 @@ keywords:
   - prometheus
   - kubernetes
 type: application
-version: 5.20.1
+version: 5.20.2
 appVersion: 2.12.0
 home: https://github.com/kubernetes/kube-state-metrics/
 sources:

diff --git a/charts/kube-state-metrics/templates/deployment.yaml b/charts/kube-state-metrics/templates/deployment.yaml
@@ -36,6 +36,7 @@ spec:
 {{ toYaml .Values.podAnnotations | indent 8 }}
       {{- end }}
     spec:
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
       hostNetwork: {{ .Values.hostNetwork }}
       serviceAccountName: {{ template "kube-state-metrics.serviceAccountName" . }}
       {{- if .Values.securityContext.enabled }}

diff --git a/charts/kube-state-metrics/templates/serviceaccount.yaml b/charts/kube-state-metrics/templates/serviceaccount.yaml
@@ -1,6 +1,7 @@
 {{- if .Values.serviceAccount.create -}}
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 metadata:
   labels:
     {{- include "kube-state-metrics.labels" . | indent 4 }}

diff --git a/charts/kube-state-metrics/values.yaml b/charts/kube-state-metrics/values.yaml
@@ -52,6 +52,9 @@ revisionHistoryLimit: 10
 # all the possible args can be found here: https://github.com/kubernetes/kube-state-metrics/blob/master/docs/cli-arguments.md
 extraArgs: []
 
+# If false then the user will opt out of automounting API credentials.
+automountServiceAccountToken: true
+
 service:
   port: 8080
   # Default to clusterIP for backward compatibility
@@ -154,6 +157,8 @@ serviceAccount:
   # Use case: AWS EKS IAM roles for service accounts
   # ref: https://docs.aws.amazon.com/eks/latest/userguide/specify-service-account-role.html
   annotations: {}
+  # If false then the user will opt out of automounting API credentials.
+  automountServiceAccountToken: true
 
 prometheus:
   monitor: