commit 38d393dbdb8e7b92448f993341935370fc43c366
Author: Jiří Suchomel <jiri.suchomel@suse.com>
Date:   Mon Oct 19 12:39:25 2020 +0200

    Disable mounting serviceAccount credentials from pods
    
    Pods should not need the access to SA credentials.
    
    Signed-off-by: Jiří Suchomel <jiri.suchomel@suse.com>

diff --git a/templates/chartmuseum/chartmuseum-dpl.yaml b/templates/chartmuseum/chartmuseum-dpl.yaml
index 7335fe5..9498b4d 100644
--- a/templates/chartmuseum/chartmuseum-dpl.yaml
+++ b/templates/chartmuseum/chartmuseum-dpl.yaml
@@ -45,6 +45,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       containers:
       - name: chartmuseum
         image: {{ .Values.chartmuseum.image.repository }}:{{ .Values.chartmuseum.image.tag }}
diff --git a/templates/clair/clair-dpl.yaml b/templates/clair/clair-dpl.yaml
index 44c8ea7..0428196 100644
--- a/templates/clair/clair-dpl.yaml
+++ b/templates/clair/clair-dpl.yaml
@@ -39,6 +39,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       initContainers:
       - name: "inject-config-db-url"
         securityContext:
diff --git a/templates/core/core-dpl.yaml b/templates/core/core-dpl.yaml
index f1a9f7e..339aec7 100644
--- a/templates/core/core-dpl.yaml
+++ b/templates/core/core-dpl.yaml
@@ -40,6 +40,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       containers:
       - name: core
         image: {{ .Values.core.image.repository }}:{{ .Values.core.image.tag }}
diff --git a/templates/database/database-ss.yaml b/templates/database/database-ss.yaml
index 38bfb6f..f02a7fa 100644
--- a/templates/database/database-ss.yaml
+++ b/templates/database/database-ss.yaml
@@ -32,6 +32,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       initContainers:
       - name: "change-permission-of-directory"
         securityContext:
diff --git a/templates/jobservice/jobservice-dpl.yaml b/templates/jobservice/jobservice-dpl.yaml
index c1bba2b..ad41362 100644
--- a/templates/jobservice/jobservice-dpl.yaml
+++ b/templates/jobservice/jobservice-dpl.yaml
@@ -45,6 +45,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       containers:
       - name: jobservice
         image: {{ .Values.jobservice.image.repository }}:{{ .Values.jobservice.image.tag }}
diff --git a/templates/notary/notary-server.yaml b/templates/notary/notary-server.yaml
index e8da66c..a5bbf8a 100644
--- a/templates/notary/notary-server.yaml
+++ b/templates/notary/notary-server.yaml
@@ -34,6 +34,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       initContainers:
       - name: "inject-config-db-url"
         securityContext:
diff --git a/templates/notary/notary-signer.yaml b/templates/notary/notary-signer.yaml
index a3e73c5..8799582 100644
--- a/templates/notary/notary-signer.yaml
+++ b/templates/notary/notary-signer.yaml
@@ -30,6 +30,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       initContainers:
       - name: "inject-config-db-url"
         securityContext:
diff --git a/templates/portal/deployment.yaml b/templates/portal/deployment.yaml
index 855830f..382cf8a 100644
--- a/templates/portal/deployment.yaml
+++ b/templates/portal/deployment.yaml
@@ -33,6 +33,7 @@ spec:
 {{- if .Values.portal.serviceAccountName }}
       serviceAccountName: {{ .Values.portal.serviceAccountName }}
 {{- end }}
+      automountServiceAccountToken: false
       containers:
       - name: portal
         image: {{ .Values.portal.image.repository }}:{{ .Values.portal.image.tag }}
diff --git a/templates/redis/statefulset.yaml b/templates/redis/statefulset.yaml
index 8f51dc4..2913f10 100644
--- a/templates/redis/statefulset.yaml
+++ b/templates/redis/statefulset.yaml
@@ -34,6 +34,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       containers:
       - name: redis
         image: {{ .Values.redis.internal.image.repository }}:{{ .Values.redis.internal.image.tag }}
diff --git a/templates/registry/registry-dpl.yaml b/templates/registry/registry-dpl.yaml
index a620470..6321950 100644
--- a/templates/registry/registry-dpl.yaml
+++ b/templates/registry/registry-dpl.yaml
@@ -45,6 +45,7 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      automountServiceAccountToken: false
       containers:
       - name: registry
         image: {{ .Values.registry.registry.image.repository }}:{{ .Values.registry.registry.image.tag }}
