fix: disable service account token automount for user pods

Author: gmolto

pkg/types/service.go

@@ -351,8 +351,10 @@ func (service *Service) ToPodSpec(cfg *Config) (*v1.PodSpec, error) {
 	if err != nil {
 		return nil, err
 	}
+	disableServiceAccountTokenAutomount := false
 
 	podSpec := &v1.PodSpec{
+		AutomountServiceAccountToken: &disableServiceAccountTokenAutomount,
 		ImagePullSecrets: SetImagePullSecrets(service.ImagePullSecrets),
 		Containers: []v1.Container{
 			{

pkg/types/service_test.go

@@ -354,6 +354,12 @@ func TestToPodSpec(t *testing.T) {
 				if podSpec.Containers[0].Command[0] != fmt.Sprintf("%s/%s", VolumePath, WatchdogName) {
 					t.Fatalf("expected command to be supervisor path %s, got %s", fmt.Sprintf("%s/%s", VolumePath, WatchdogName), podSpec.Containers[0].Command[0])
 				}
+				if podSpec.AutomountServiceAccountToken == nil {
+					t.Fatalf("expected automountServiceAccountToken to be set")
+				}
+				if *podSpec.AutomountServiceAccountToken {
+					t.Fatalf("expected automountServiceAccountToken to be false")
+				}
 
 			}
 		})