feat: add optional automountServiceAccountToken to webhook

Signed-off-by: falcorocks <[email protected]>
sigstore · Feb 14, 2025 · 71ca3a5 · 71ca3a5
1 parent 54b3961
commit 71ca3a5
Show file tree

Hide file tree

Showing 4 changed files with 13 additions and 0 deletions.
diff --git a/charts/policy-controller/README.md b/charts/policy-controller/README.md
@@ -170,6 +170,7 @@ helm uninstall [RELEASE_NAME]
 | loglevel | string | `"info"` |  |
 | serviceMonitor.enabled | bool | `false` |  |
 | webhook.affinity | object | `{}` |  |
+| webhook.automountServiceAccountToken | bool | `true` |  |
 | webhook.configData | object | `{}` |  |
 | webhook.customLabels | object | `{}` |  |
 | webhook.env | object | `{}` |  |

diff --git a/charts/policy-controller/templates/webhook/deployment_webhook.yaml b/charts/policy-controller/templates/webhook/deployment_webhook.yaml
@@ -31,6 +31,11 @@ spec:
       tolerations:
         {{- toYaml .Values.commonTolerations | nindent 8 }}
       serviceAccountName: {{ include "webhook.serviceAccountName" . }}
+      {{- if .Values.webhook.automountServiceAccountToken }}
+      automountServiceAccountToken: true
+      {{- else }}
+      automountServiceAccountToken: false
+      {{- end }}
       {{- if .Values.webhook.priorityClass }}
       priorityClassName: {{ .Values.webhook.priorityClass }}
       {{- end }}

diff --git a/charts/policy-controller/values.schema.json b/charts/policy-controller/values.schema.json
@@ -197,6 +197,12 @@
           "title": "affinity",
           "type": "object"
         },
+        "automountServiceAccountToken": {
+          "default": true,
+          "required": [],
+          "title": "automountServiceAccountToken",
+          "type": "boolean"
+        },
         "configData": {
           "required": [],
           "title": "configData",

diff --git a/charts/policy-controller/values.yaml b/charts/policy-controller/values.yaml
@@ -84,6 +84,7 @@ webhook:
     # defaulting: 10
     # validating: 10
   priorityClass: ""
+  automountServiceAccountToken: true
 
 leasescleanup:
   priorityClass: ""