From b69afd630b0e0e62693fe65eed7a4d0467d10c88 Mon Sep 17 00:00:00 2001
From: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
Date: Mon, 17 Nov 2025 08:30:01 +0100
Subject: [PATCH] k8s: dont mount service account tokens to apps

Signed-off-by: Pascal Sthamer <10992664+P4sca1@users.noreply.github.com>
---
 functions/onprem/orborus/orborus.go | 10 +++++++---
 functions/onprem/worker/worker.go   |  9 ++++++---
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/functions/onprem/orborus/orborus.go b/functions/onprem/orborus/orborus.go
index b5bcf486..365f368a 100755
--- a/functions/onprem/orborus/orborus.go
+++ b/functions/onprem/orborus/orborus.go
@@ -1426,6 +1426,9 @@ func deployK8sWorker(image string, identifier string, env []string) error {
 	}
 
 	replicaNumberInt32 := int32(replicaNumber)
+	// worker makes authenticated requests to the k8s api to create app deployments.
+	// Therefore, it needs to have access to the service account token.
+	automountServiceAccountToken := true
 
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
@@ -1445,9 +1448,10 @@ func deployK8sWorker(image string, identifier string, env []string) error {
 					Containers: []corev1.Container{
 						containerAttachment,
 					},
-					DNSPolicy:          corev1.DNSClusterFirst,
-					ServiceAccountName: workerServiceAccountName,
-					SecurityContext:    podSecurityContext,
+					DNSPolicy:                    corev1.DNSClusterFirst,
+					ServiceAccountName:           workerServiceAccountName,
+					AutomountServiceAccountToken: &automountServiceAccountToken,
+					SecurityContext:              podSecurityContext,
 				},
 			},
 		},
diff --git a/functions/onprem/worker/worker.go b/functions/onprem/worker/worker.go
index 09c95187..caa160b3 100644
--- a/functions/onprem/worker/worker.go
+++ b/functions/onprem/worker/worker.go
@@ -625,6 +625,8 @@ func deployk8sApp(image string, identifier string, env []string) error {
 	}
 
 	replicaNumberInt32 := int32(replicaNumber)
+	// apps do not need access the k8s api.
+	automountServiceAccountToken := false
 
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
@@ -656,9 +658,10 @@ func deployk8sApp(image string, identifier string, env []string) error {
 							Resources:       buildResourcesFromEnv(),
 						},
 					},
-					DNSPolicy:          corev1.DNSClusterFirst,
-					ServiceAccountName: appServiceAccountName,
-					SecurityContext:    podSecurityContext,
+					DNSPolicy:                    corev1.DNSClusterFirst,
+					ServiceAccountName:           appServiceAccountName,
+					AutomountServiceAccountToken: &automountServiceAccountToken,
+					SecurityContext:              podSecurityContext,
 				},
 			},
 		},