pod SA, disable automount SA tokens

charts/frontend/templates/_helpers.tpl

@@ -249,4 +249,12 @@ imagePullSecrets:
 - name: {{ .Release.Name }}-registry
 {{- end }}
 {{- end }}
+{{- end }}
+
+{{- define "frontend.serviceAccountName" }}
+{{- if .Values.serviceAccount.name }}
+{{- .Values.serviceAccount.name }}
+{{- else }}
+{{- .Release.Name }}-sa
+{{- end }}
 {{- end }}

charts/frontend/templates/backup-cron.yaml

@@ -140,6 +140,7 @@ spec:
           {{- end }}
           {{- end }}
           restartPolicy: Never
+          serviceAccountName: {{ include "frontend.serviceAccountName" . }}
           volumes:
             - name: shared-data
               emptyDir:

charts/frontend/templates/nginx.yaml

@@ -100,7 +100,7 @@ spec:
         resources:
             {{- .Values.signalsciences.resources | toYaml | nindent 10 }}
         {{- end }}
-
+      serviceAccountName: {{ include "frontend.serviceAccountName" . }}
       volumes:
         - name: nginx-conf
           configMap:

charts/frontend/templates/serviceaccount.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ .Release.Name }}-sa
+  labels:
+    {{- include "frontend.release_labels" . | nindent 4 }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
+{{- include "frontend.imagePullSecrets" . }}

charts/frontend/templates/services-cron.yaml

@@ -84,6 +84,7 @@ spec:
               {{- $.Values.serviceDefaults.resources | toYaml | nindent 14 }}
               {{- end }}
               {{- end }}
+          serviceAccountName: {{ include "frontend.serviceAccountName" $ }}
           volumes:
             {{- if $service.mounts }}
             {{- range $index, $mountName := $service.mounts -}}

charts/frontend/templates/services-deployment.yaml

@@ -84,6 +84,7 @@ spec:
           {{ else -}}
           {{ $.Values.serviceDefaults.resources | toYaml | nindent 10 }}
           {{- end }}
+      serviceAccountName: {{ include "frontend.serviceAccountName" $ }}
       volumes:
         {{ if $service.mounts }}
         {{- range $index, $mountName := $service.mounts -}}

charts/frontend/templates/varnish-deployment.yaml

@@ -72,6 +72,7 @@ spec:
           mountPath: "/etc/varnish/secret"
           subPath: control_key
           readOnly: true
+      serviceAccountName: {{ include "frontend.serviceAccountName" . }}
       volumes:
       - name: varnish-vcl
         configMap:

charts/frontend/values.schema.json

@@ -8,6 +8,14 @@
     "branchName": { "type": "string" },
     "imagePullSecrets": { "type": "array" },
     "imagePullSecret": { "type": "string" },
+    "serviceAccount": { 
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "automountServiceAccountToken": { "type": "boolean" }
+      }
+    },
     "app": { "type": "string" },
     "exposeDomains": {
       "type": "object",

charts/frontend/values.yaml

@@ -24,6 +24,12 @@ imagePullSecrets: []
 # Custom imagePullSecret for the containers. Base64 encoded. This will create a secret and append it to the imagePullSecrets. 
 imagePullSecret: ""
 
+serviceAccount:
+  # Default value: [Release.Name]-sa
+  name: ""
+  # Mount service account token to the containers.
+  automountServiceAccountToken: false
+
 # The app label added to our Kubernetes resources.
 app: frontend
 
@@ -400,6 +406,8 @@ mariadb:
               operator: NotIn
               values:
               - static-ip
+  serviceAccount:
+    create: true
   enableServiceLinks: false
 
 varnish:
@@ -466,10 +474,17 @@ elasticsearch:
     - name: xpack.security.enabled
       value: "false"
 
+  # Disable service links that cause a slow startup.
+  enableServiceLinks: false
+
+  rbac:
+    create: true
+    automountToken: false
+
   # This value should be slightly less than 50% of the requested memory.
   esJavaOpts: -Xmx220m -Xms220m
   xpack:
-    enabled: false
+    elasticenabled: false
   volumeClaimTemplate:
     resources:
       requests:
@@ -517,7 +532,11 @@ postgresql:
   # Use a low default to prevent unnecessary storage use.
   persistence:
     size: 1Gi
+  serviceAccount:
+    create: true
+    automountServiceAccountToken: false
 
+# https://github.com/wunderio/charts/blob/master/rabbitmq/values.yaml
 rabbitmq:
   enabled: false
 
@@ -582,4 +601,6 @@ redis:
       requests:
         cpu: 50m
         memory: 256Mi
+  serviceAccount:
+    automountServiceAccountToken: false