Skip to content

Commit

Permalink
feat: Disable automatic service account mounting
Browse files Browse the repository at this point in the history
Service accounts aren't needed for most of the services
since they don't talk to the Kubernetes API.

For increased security, we disable the automatic mounting of secrets.
  • Loading branch information
MoritzWeber0 committed Mar 21, 2024
1 parent 704a2c8 commit c4874e9
Show file tree
Hide file tree
Showing 10 changed files with 10 additions and 0 deletions.
1 change: 1 addition & 0 deletions helm/templates/backend/postgres.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,7 @@ spec:
labels:
id: {{ .Release.Name }}-deployment-backend-postgres
spec:
automountServiceAccountToken: false
{{ if not .Values.development }}
volumes:
- name: {{ .Release.Name }}-data
Expand Down
1 change: 1 addition & 0 deletions helm/templates/docs/docs.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ spec:
labels:
id: {{ .Release.Name }}-deployment-docs
spec:
automountServiceAccountToken: false
{{- include "capellacollab.pod.spec" . | indent 6 -}}
containers:
- name: {{ .Release.Name }}-docs
Expand Down
1 change: 1 addition & 0 deletions helm/templates/frontend/frontend.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ spec:
annotations:
checksum/config-promtail: {{ include (print $.Template.BasePath "/promtail" "/promtail.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
volumes:
{{ if .Values.loki.enabled }}
- name: logs
Expand Down
1 change: 1 addition & 0 deletions helm/templates/grafana/nginx.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ spec:
annotations:
checksum/config: {{ include (print $.Template.BasePath "/grafana/nginx.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
volumes:
- name: {{ .Release.Name }}-grafana-nginx
configMap:
Expand Down
1 change: 1 addition & 0 deletions helm/templates/guacamole/guacamole.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ spec:
annotations:
checksum/config-promtail: {{ include (print $.Template.BasePath "/promtail" "/promtail.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
volumes:
{{ if .Values.loki.enabled }}
- name: unused
Expand Down
1 change: 1 addition & 0 deletions helm/templates/guacamole/guacd.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ spec:
annotations:
checksum/config-promtail: {{ include (print $.Template.BasePath "/promtail" "/promtail.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
volumes:
{{ if .Values.loki.enabled }}
- name: logs
Expand Down
1 change: 1 addition & 0 deletions helm/templates/guacamole/postgres.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ spec:
annotations:
checksum/config: {{ include (print $.Template.BasePath "/guacamole" "/postgres.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
volumes:
- name: {{ .Release.Name }}-data
persistentVolumeClaim:
Expand Down
1 change: 1 addition & 0 deletions helm/templates/mock/oauth.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ spec:
annotations:
checksum/config: {{ include (print $.Template.BasePath "/mock/oauth.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
volumes:
- name: {{ .Release.Name }}-oauth-mock
configMap:
Expand Down
1 change: 1 addition & 0 deletions helm/templates/prometheus/nginx.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ spec:
annotations:
checksum/config: {{ include (print $.Template.BasePath "/prometheus/nginx.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
volumes:
- name: {{ .Release.Name }}-prometheus-nginx
configMap:
Expand Down
1 change: 1 addition & 0 deletions helm/templates/prometheus/prometheus.deployment.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ spec:
annotations:
checksum/config: {{ include (print $.Template.BasePath "/prometheus/prometheus.configmap.yaml") . | sha256sum }}
spec:
automountServiceAccountToken: false
serviceAccountName: {{ .Release.Name }}-prometheus
{{- include "capellacollab.pod.spec" . | indent 6 -}}
containers:
Expand Down

0 comments on commit c4874e9

Please sign in to comment.