Remove automountServiceAccountToken for main containers

[alexec]

Summary

There's no reason to have this mounted for most tasks. In fact, main containers will get pod patch allowing the to change other pods within the namespace.

This might be easier than fixing #3961

Note, you now must explicitly mount the service account token, which has unpredicatable name.

Use Cases

Better default security.

---

Message from the maintainers:

Love this enhancement proposal? Give it a 👍. We prioritise the proposals with the most 👍.

[alexec]

Users can now configure this.

[sevetseh28]

Hey @alexec I'm wondering how I can configure this since my SA contains permissions to S3 (for artifact management). It makes no sense for the main container to have access to this and it's a serious security issue when running untrusted code. Based on the fields documentation I tried changing the Workflow like this:

spec:
  automountServiceAccountToken: false
  executor:
     serviceAccountName: argo-workflow-executor

but the Workflow is constantly showing events such as
"Unable to attach or mount volumes: unmounted volumes=[exec-sa-token], unattached volumes=[tmp-dir-argo exec-sa-token argo-staging var-run-argo aws-iam-token]: timed out waiting for the condition"
"MountVolume.SetUp failed for volume "exec-sa-token" : secret "argo-workflow-executor.service-account-token" not found"

Is this the proper way to configure that?

thank you

[discordianfish]

I've ran into the same issue.. It seem that without setting automountServiceAccountToken or any executor config, it is using the default service account. But if I do:

      autoMountServiceAccountToken: false
      executor:
        serviceAccountName: default

I get the same error:

  Warning  FailedMount  2s (x5 over 9s)  kubelet            MountVolume.SetUp failed for volume "exec-sa-token" : secret "default.service-account-token" not found

[philBrown]

Users can now configure this.

Hi @alexec, sorry to drag this up but it's not clear where or how this can be configured.

As far as I can tell, workflowpod.go adds the exec-sa-token volume mount for every container except wait when automountServiceAccountToken: false is set.

// Configure service account token volume for the main container when AutomountServiceAccountToken is disabled
if (woc.execWf.Spec.AutomountServiceAccountToken != nil && !*woc.execWf.Spec.AutomountServiceAccountToken) ||
	(tmpl.AutomountServiceAccountToken != nil && !*tmpl.AutomountServiceAccountToken) {
	for i, c := range pod.Spec.Containers {
		if c.Name == common.WaitContainerName {
			continue
		}
		c.VolumeMounts = append(c.VolumeMounts, apiv1.VolumeMount{
			Name:      common.ServiceAccountTokenVolumeName,
			MountPath: common.ServiceAccountTokenMountPath,
			ReadOnly:  true,
		})
		pod.Spec.Containers[i] = c
	}
}

[francozuca]

Hi, is there any update on this? I'm trying to avoid the main container to have any service account token since we don't need it.

We do have a Service Account called workflow-pod with the necessary permissions for the pod to update the Workflow status once the workflow is completed.

We are configuring the workflow as follows:

spec:
  automountServiceAccountToken: false
  executor:
     serviceAccountName: workflow-pod

And we get the error:

MountVolume.SetUp failed for volume "exec-sa-token" : secret "workflow-pod. service-account-token" not found

We have also tried without setting automountServiceAccountToken at all and it fails In the same way.

Is there anything else we can do or try different? Thanks!

[ephraimrothschild]

Running into the same issue. Is there any update on this?