From e10de883ecfb18e550800f213e5060b86ae87fff Mon Sep 17 00:00:00 2001 From: Hao Liu <44379968+TheRealHaoLiu@users.noreply.github.com> Date: Thu, 18 Jun 2026 10:43:23 -0400 Subject: [PATCH] fix: disable service account token automount for activation job pods MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Activation job pods do not need Kubernetes API access — they run user-supplied rulebooks and decision environment images. Set automount_service_account_token to False so the default service account token is not projected into these pods. Co-Authored-By: Claude Opus 4.6 (1M context) --- src/aap_eda/services/activation/engine/kubernetes.py | 1 + tests/integration/services/activation/engine/test_kubernetes.py | 2 ++ 2 files changed, 3 insertions(+) diff --git a/src/aap_eda/services/activation/engine/kubernetes.py b/src/aap_eda/services/activation/engine/kubernetes.py index 869a8f799..5ea6058d6 100644 --- a/src/aap_eda/services/activation/engine/kubernetes.py +++ b/src/aap_eda/services/activation/engine/kubernetes.py @@ -346,6 +346,7 @@ def _create_pod_template_spec( spec_kwargs: dict = { "restart_policy": "Never", "containers": [container], + "automount_service_account_token": False, } if request.credential: self._create_secret(request, log_handler) diff --git a/tests/integration/services/activation/engine/test_kubernetes.py b/tests/integration/services/activation/engine/test_kubernetes.py index b6e8b2a02..0183b3abb 100644 --- a/tests/integration/services/activation/engine/test_kubernetes.py +++ b/tests/integration/services/activation/engine/test_kubernetes.py @@ -315,6 +315,7 @@ def capture_job(namespace, body): spec = created_body.spec.template.spec assert spec.service_account_name == "eda-workload" + assert spec.automount_service_account_token is False labels = created_body.spec.template.metadata.labels assert labels["app"] == "eda" assert labels["job-name"] == engine.job_name @@ -904,3 +905,4 @@ def test_engine_start_no_tolerations_by_default( ) pod_spec = job_body.spec.template.spec assert pod_spec.tolerations is None + assert pod_spec.automount_service_account_token is False