feat(chart): expose automountServiceAccountToken and extra volumes

[tejassinghbhati]

Description

Implements #442.

The chart never rendered automountServiceAccountToken, so Gatekeeper policies that require it to be set explicitly reject the workload for leaving it to the cluster default. There was also no way to add volumes, which is exactly what you need in order to run without an automounted token.

This renders serviceAccount.automountServiceAccountToken on both the ServiceAccount and the pod spec, and adds extraVolumes / extraVolumeMounts. The default stays true, so nothing changes for existing installs.

Worth being explicit about one thing, because turning the flag off on its own leaves you with a controller that cannot reach the API server. It authenticates through rest.InClusterConfig(), which needs token, ca.crt and namespace under /var/run/secrets/kubernetes.io/serviceaccount. Disabling the automount removes all three, so they have to come back via a projected volume. Rather than leave that to be rediscovered, values.yaml carries the full working example inline.

Related Issue

Fixes #442

Type of Change

/kind feature

Testing

New automount_test.yaml suite. Chart tests go from 37 to 43, all green, and helm lint is clean.

The suite covers the default on both objects, the explicit false case, extra volumes and mounts being wired through, and one case that seemed worth pinning: the chart already mounts webhook and metrics certificates, so it asserts those survive alongside the extra entries rather than being replaced.

I also rendered the exact configuration from the issue end to end:

$ helm template x ./charts/node-readiness-controller -f pss.yaml --show-only templates/deployment.yaml
      automountServiceAccountToken: false
          volumeMounts:
            - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
              name: sa-token
              readOnly: true
      volumes:
        - name: sa-token
          projected:
            sources:
            - serviceAccountToken:
                expirationSeconds: 3600
                path: token
            - configMap:
                items:
                - key: ca.crt
                  path: ca.crt
                name: kube-root-ca.crt
            - downwardAPI:
                items:
                - fieldRef:
                    fieldPath: metadata.namespace
                  path: namespace

One test assertion I got wrong first time, mentioning it since it is mildly surprising: volumes: is rendered unconditionally by the template, so on a default install the key exists with nothing under it rather than being absent. The test uses isNullOrEmpty instead of isNull.

Checklist

• make test passes
• make lint passes

Does this PR introduce a user-facing change?

The Helm chart now renders `automountServiceAccountToken` on the ServiceAccount and pod spec, and supports `extraVolumes` and `extraVolumeMounts`, so it can satisfy Gatekeeper and Pod Security policies that require the field to be set explicitly or forbid automounted tokens.

[kubernetes-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: tejassinghbhati
Once this PR has been reviewed and has the lgtm label, please assign sergeykanzhelev for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[netlify]

✅ Deploy Preview for node-readiness-controller canceled.

Name	Link
🔨 Latest commit	2038b2b
🔍 Latest deploy log	https://app.netlify.com/projects/node-readiness-controller/deploys/6a9973e1d02653000880c592

[kubernetes-prow]

Hi @tejassinghbhati. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.