Lokomotive: Don't mount the default Service Account in pods by default

[iaguis]

Currently we're mounting the default Service Account to all pods. However, most pods don't need access to the API Server so we shouldn't be mounting it to reduce attack surface.

[knrt10]

I can take this up, if no one is working

[knrt10]

Currently, as discussed all pods running have default sa mounted, so they have all permissions to call k8s api. I think automountServiceAccountToken: false should be the default setting, which will prevent that.

[invidian]

Note: this must be done for all pods in the cluster, all components :|

[knrt10]

@iaguis @invidian I am a little bit confused, can you please explain one thing to me? Currently, all the components that we have implemented are using their own Serviceaccount so default SA is not getting mounted in their pods. Is this issue regarding not mounting default SA on newly created pods that user creates in their cluster? Also I found this thread regarding it https://github.com/kubernetes/kubernetes/issues/57601

[iaguis]

What I had in mind with this issue was not mounting a default SA by default in new pods, so setting automountServiceAccountToken: false.

Also, for components we have we should not mount any SA if they don't need access to the API Server. This might already be the case if the manifests are written correctly but we should double check.

[knrt10]

Also, for components we have we should not mount any SA if they don't need access to the API Server. This might already be the case if the manifests are written correctly but we should double check.

Yes, I'm checking for each component.

What I had in mind with this issue was not mounting a default SA by default in new pods, so setting automountServiceAccountToken: false

By new pods did you mean that the user creates?

[iaguis]

By new pods did you mean that the user creates?

Yes.

[surajssd]

We have decided to put the code for the webhook in the lokomotive repo. Now the go code is under review.

[knrt10]

Consensus regarding naming

Helm Chart name: lokomotive
Namespace: lokomotive-system
Deployment, service: admission-webhook-server