Allow ingestion of automountServiceAccountToken: false via Values for all deployments in Helm chart

[stefankeidel]

Context

Our Kubernetes cluster is managed company wide and employs Gatekeeper Policies to enforce best practices and security settings cluster-wide. One of those settings demands that automountServiceAccountToken: false be set for all individual pods and deployments, so malicious pods cannot get access to the k8s control plane.

Feature description

We would love to be able to ingest that setting into all the deployments done by the Budibase helm chart, via Values.yaml like so:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-deployment
spec:
  template:
    spec:
      automountServiceAccountToken: false

I took a look and my guess is that implementation-wise it could be pretty close to how the affinity and tolerations settings work currently. They seem to get passed on to all the deployments as-is (or at least the few I checked).

[linear]

BUDI-8890 Allow ingestion of `automountServiceAccountToken: false` via Values for all deployments in Helm chart

[stefankeidel]

As a quick update @shogunpurple -- while this would be useful I think for most peeps running shared clusters with some sort of governance in larger organisations, we managed to work around it using kustomize as a sort of post-renderer running after the helm chart for now.