OCPBUGS-60568: Use BoundServceAccountTokenVolume dy default

[lance5890]

kind of post-cleanup of #1100 and openshift/kubernetes#714

Summary by CodeRabbit

• Chores
  • Updated pod specifications and service account configurations for internal operator components.

[openshift-ci]

Hi @lance5890. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[lance5890]

/hold

[lance5890]

need to wait the openshift/cluster-version-operator#1225 to merge first

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[tchap]

/remove-lifecycle stale

[tchap]

Blocked by openshift/cluster-version-operator#1264 now.

[tchap]

/assign

[lance5890]

/assign

with the openshift/cluster-version-operator#1264 merged, this PR is not blocked now

[lance5890]

/unhold

[tchap]

/ok-to-test

[tchap]

/test

[openshift-ci]

@tchap: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test e2e-aws-encryption

/test e2e-monitoring

/test unit

/test verify

/test verify-deps

Use /test all to run the following jobs that were automatically triggered:

pull-ci-openshift-library-go-master-unit

pull-ci-openshift-library-go-master-verify

pull-ci-openshift-library-go-master-verify-deps

Details

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tchap]

We need to test this on a real component, please create a PR for cluster-kube-controller-manager-operator, for example, that uses this particular library-go PR so that we can see on CI that everything works. Thanks!

[tchap]

/hold

[lance5890]

We need to test this on a real component, please create a PR for cluster-kube-controller-manager-operator, for example, that uses this particular library-go PR so that we can see on CI that everything works. Thanks!

The cluster-kube-controller-manager-operator tests are all passed!

[openshift-ci-robot]

@tchap: This pull request references Jira Issue OCPBUGS-60568, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tchap]

The testing job looks OK BTW. When you inspect CI and check installer-7-ip-10-0-26-20.us-west-1.compute.internal, it's the first installer pod that uses the dynamic binding when upgrading.

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2ff72f31-c985-4fdb-92b9-1c58cc169eda

📥 Commits

Reviewing files that changed from the base of the PR and between ba2b9a3 and f7fd773.

📒 Files selected for processing (2)

• pkg/operator/staticpod/controller/installer/manifests/installer-pod.yaml
• pkg/operator/staticpod/controller/prune/manifests/pruner-pod.yaml

💤 Files with no reviewable changes (2)

• pkg/operator/staticpod/controller/prune/manifests/pruner-pod.yaml
• pkg/operator/staticpod/controller/installer/manifests/installer-pod.yaml

---

Walkthrough

Both the installer and pruner pod manifests are updated to use explicit service account references instead of manually mounting projected service account token volumes. The installer pod adds a named service account declaration while both pods remove explicit token injection configuration.

Changes

Service Account Configuration Refactor

Layer / File(s)	Summary
Installer pod service account configuration pkg/operator/staticpod/controller/installer/manifests/installer-pod.yaml	Pod spec now specifies serviceAccountName: installer-sa and removes automountServiceAccountToken: false. The container's kube-api-access projected volume mount and volume definition are removed.
Pruner pod service account configuration pkg/operator/staticpod/controller/prune/manifests/pruner-pod.yaml	Pod spec removes explicit automountServiceAccountToken setting. The container's kube-api-access projected volume mount and volume definition are removed, leaving other volume mounts unchanged.

---

🎯 2 (Simple) | ⏱️ ~8 minutes

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error, 1 inconclusive)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	Both manifests contain privileged: true and runAsUser: 0 without explicit justification comments in the YAML files, violating the check's requirement to flag privileged settings.	Add comments in manifests explaining why privileged: true and root access are required, or document the justification in the PR description for system-critical cluster component access.
Title check	❓ Inconclusive	The title contains a typo ('BoundServceAccountTokenVolume' and 'dy' instead of 'Default') and is partially related to the changes, which remove explicit service account token volume mounts from pod manifests.	Correct the typos: 'BoundServceAccountTokenVolume' should be 'BoundServiceAccountTokenVolume' and 'dy' should be 'by', making the full title read 'OCPBUGS-60568: Use BoundServiceAccountTokenVolume by default'.

✅ Passed checks (13 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PR modifies only Kubernetes manifest files (installer-pod.yaml, pruner-pod.yaml), not Ginkgo tests. Repository contains standard Go tests with no Ginkgo patterns.
Test Structure And Quality	✅ Passed	PR contains only Kubernetes manifest file changes; no Ginkgo test code was added or modified, making the test structure check not applicable.
Microshift Test Compatibility	✅ Passed	PR contains only Kubernetes manifest file changes (installer-pod.yaml, pruner-pod.yaml), not new Ginkgo e2e tests. Custom check for MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	This PR contains only Kubernetes manifest YAML changes (installer-pod.yaml and pruner-pod.yaml), not any new Ginkgo e2e tests. The SNO compatibility check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR changes static pod manifests to enable Kubernetes Bound Service Account Token feature. No new scheduling constraints introduced; topology-agnostic service account token mounting behavior only.
Ote Binary Stdout Contract	✅ Passed	PR modifies only Kubernetes manifest YAML files with no code changes; OTE stdout contract check is inapplicable to manifest-only changes.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	No new Ginkgo e2e tests (It(), Describe(), Context(), When()) were added in this PR. The changes are limited to Kubernetes manifest YAML files for static pod configuration.
No-Weak-Crypto	✅ Passed	PR modifies only Kubernetes YAML manifest files for pod specifications; no weak cryptographic algorithms, custom crypto implementations, or non-constant-time secret comparisons are present.
No-Sensitive-Data-In-Logs	✅ Passed	PR removes manual service account token volumes from pods and uses Kubernetes' native BoundServiceAccountTokenVolume. No logging exposes passwords, tokens, keys, or sensitive data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[tchap]

/remove-lifecycle stale

[tchap]

@lance5890 Could you rebase the testing PR so that we can move this forward? Thanks.

[openshift-ci-robot]

@lance5890: This pull request references Jira Issue OCPBUGS-60568, which is invalid:

• expected the bug to target either version "5.0." or "openshift-5.0.", but it targets "4.22" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

kind of post-cleanup of #1100 and openshift/kubernetes#714

Summary by CodeRabbit

• Chores
• Updated pod specifications and service account configurations for internal operator components.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tchap]

/jira refresh

[openshift-ci-robot]

@tchap: This pull request references Jira Issue OCPBUGS-60568, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[tchap]

/lgtm

[tchap]

All tests are passing on the linked testing PR, so this looks good to me.

[bertinatto]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bertinatto, lance5890, tchap

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• pkg/operator/staticpod/OWNERS [bertinatto]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@lance5890: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@lance5890: Jira Issue OCPBUGS-60568: All pull requests linked via external trackers have merged:

• openshift/cluster-kube-controller-manager-operator#858
• openshift/cluster-version-operator#1264
• openshift/library-go#2001

Jira Issue OCPBUGS-60568 has been moved to the MODIFIED state.

Details

In response to this:

kind of post-cleanup of #1100 and openshift/kubernetes#714

Summary by CodeRabbit

• Chores
• Updated pod specifications and service account configurations for internal operator components.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.