[prometheus] automountServiceAccountToken to be configurable (#3998)

Signed-off-by: Ian H. Lee <[email protected]> Signed-off-by: MH <[email protected]> Co-authored-by: MH <[email protected]>
prometheus-community · Nov 21, 2023 · 228dc45 · 228dc45
1 parent b837e3b
commit 228dc45
Show file tree

Hide file tree

Showing 5 changed files with 18 additions and 3 deletions.
diff --git a/charts/prometheus/Chart.yaml b/charts/prometheus/Chart.yaml
@@ -1,7 +1,7 @@
 apiVersion: v2
 name: prometheus
 appVersion: v2.47.2
-version: 25.6.0
+version: 25.7.0
 kubeVersion: ">=1.19.0-0"
 description: Prometheus is a monitoring system and time series database.
 home: https://prometheus.io/

diff --git a/charts/prometheus/templates/deploy.yaml b/charts/prometheus/templates/deploy.yaml
@@ -47,6 +47,9 @@ spec:
       {{- end }}
 {{- end }}
       serviceAccountName: {{ template "prometheus.serviceAccountName.server" . }}
+{{- if kindIs "bool" .Values.server.automountServiceAccountToken }}
+      automountServiceAccountToken: {{ .Values.server.automountServiceAccountToken }}
+{{- end }}
       {{- if .Values.server.extraInitContainers }}
       initContainers:
 {{ toYaml .Values.server.extraInitContainers | indent 8 }}

diff --git a/charts/prometheus/templates/serviceaccount.yaml b/charts/prometheus/templates/serviceaccount.yaml
@@ -8,7 +8,9 @@ metadata:
   namespace: {{ include "prometheus.namespace" . }}
   annotations:
 {{ toYaml .Values.serviceAccounts.server.annotations | indent 4 }}
-{{- if .Values.serviceAccounts.server.automountServiceAccountToken }}
+{{- if kindIs "bool" .Values.server.automountServiceAccountToken }}
+automountServiceAccountToken: {{ .Values.server.automountServiceAccountToken }}
+{{- else if kindIs "bool" .Values.serviceAccounts.server.automountServiceAccountToken }}
 automountServiceAccountToken: {{ .Values.serviceAccounts.server.automountServiceAccountToken }}
 {{- end }}
 {{- end }}
diff --git a/charts/prometheus/templates/sts.yaml b/charts/prometheus/templates/sts.yaml
@@ -52,6 +52,9 @@ spec:
       {{- end }}
 {{- end }}
       serviceAccountName: {{ template "prometheus.serviceAccountName.server" . }}
+{{- if kindIs "bool" .Values.server.automountServiceAccountToken }}
+      automountServiceAccountToken: {{ .Values.server.automountServiceAccountToken }}
+{{- end }}
       {{- if .Values.server.extraInitContainers }}
       initContainers:
 {{ toYaml .Values.server.extraInitContainers | indent 8 }}

diff --git a/charts/prometheus/values.yaml b/charts/prometheus/values.yaml
@@ -19,7 +19,10 @@ serviceAccounts:
     create: true
     name: ""
     annotations: {}
-    # automountServiceAccountToken:
+
+    ## Opt out of automounting Kubernetes API credentials.
+    ## It will be overriden by server.automountServiceAccountToken value, if set.
+    # automountServiceAccountToken: false
 
 ## Additional labels to attach to all resources
 commonMetaLabels: {}
@@ -98,6 +101,10 @@ server:
   ##
   name: server
 
+  ## Opt out of automounting Kubernetes API credentials.
+  ## If set it will override serviceAccounts.server.automountServiceAccountToken value for ServiceAccount.
+  # automountServiceAccountToken: false
+
   ## Use a ClusterRole (and ClusterRoleBinding)
   ## - If set to false - we define a RoleBinding in the defined namespaces ONLY
   ##