Disable automounting service account token in servicelb pods

Signed-off-by: Brad Davidson <brad.davidson@rancher.com>

Disable automounting service account token in servicelb pods
64b502e9 · Brad Davidson · Brad Davidson · 7826407a · 64b502e9
Commit 64b502e9 authored Sep 17, 2021 by Brad Davidson Committed by Brad Davidson Sep 17, 2021
Hide whitespace changes
Inline Side-by-side

Showing with 4 additions and 0 deletions

controller.go pkg/servicelb/controller.go +4 -0

No files found.
--- a/pkg/servicelb/controller.go
+++ b/pkg/servicelb/controller.go
@@ -25,6 +25,7 @@ import (
 	"k8s.io/client-go/kubernetes"
 	v1getter "k8s.io/client-go/kubernetes/typed/apps/v1"
 	coregetter "k8s.io/client-go/kubernetes/typed/core/v1"
+	utilpointer "k8s.io/utils/pointer"
 )

 var (
@@ -327,6 +328,9 @@ func (h *handler) newDaemonSet(svc *core.Service) (*apps.DaemonSet, error) {
 						svcNameLabel: svc.Name,
 					},
 				},
+				Spec: core.PodSpec{
+					AutomountServiceAccountToken: utilpointer.Bool(false),
+				},
 			},
 			UpdateStrategy: apps.DaemonSetUpdateStrategy{
 				Type: apps.RollingUpdateDaemonSetStrategyType,