[Dashboards] Add support for automountServiceAccountToken (#683)

* [Dashboards] Add automountServiceAccountToken to values.yaml

Signed-off-by: Greg Smith <[email protected]>

* [Dashboards] Add automountServiceAccountToken to serviceAccount template

Signed-off-by: Greg Smith <[email protected]>

* [Dashboards] Update CHANGELOG.md

Signed-off-by: Greg Smith <[email protected]>

* [Dashboards] Bump chart version

Signed-off-by: Greg Smith <[email protected]>

* [Dashboards] Updated CHANGELOG.md

Signed-off-by: Greg Smith <[email protected]>

* [Dashboards] Bump chart version

Signed-off-by: Greg Smith <[email protected]>

* Update README.md

Signed-off-by: Greg Smith <[email protected]>

---------

Signed-off-by: Greg Smith <[email protected]>

Author: gsmith-sas

charts/opensearch-dashboards/CHANGELOG.md

@@ -14,6 +14,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 ### Security
 ---
+## [3.2.2]
+### Added
+- Support for disabling automountServiceAccountToken
+---
 ## [3.2.1]
 ### Added
 ### Changed
@@ -50,7 +54,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 ### Security
 
-[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.1...HEAD
+[Unreleased]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.2...HEAD
+[3.2.2]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.1...opensearch-dashboards-3.2.2
 [3.2.1]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.2.0...opensearch-dashboards-3.2.1
 [3.2.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.1.0...opensearch-dashboards-3.2.0
 [3.1.0]: https://github.com/opensearch-project/helm-charts/compare/opensearch-dashboards-3.0.0...opensearch-dashboards-3.1.0

charts/opensearch-dashboards/Chart.yaml

@@ -15,7 +15,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 3.2.1
+version: 3.2.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/opensearch-dashboards/README.md

@@ -77,6 +77,7 @@ helm uninstall my-release
 | `service.ipFamilies` | Sets the preferred IP variants and in which order they are preferred, the first family you list is used for the legacy .spec.ClusterIP field, [more information on dual stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/) | `""` |
 | `service.metricsPort` | The metrics port (for Performance Analyzer) that Kubernetes will use for the service. | `9601` |
 | `service.metricsPortName` | The name of the metrics port (for Performance Analyzer) within the service | `metrics` |
+| `serviceAccount.automountServiceAccountToken` | Specifies whether the Kubernetes API token for the ServiceAccount should be automatically mounted to the pod. | `true` |
 | `tolerations` | Configurable [tolerations][] | `[]` |
 | `topologySpreadConstraints` | Configuration for pod [topologySpreadConstraints][] | `[]` |
 | `updateStrategy` | The [updateStrategy][] for the StatefulSet. By default Kubernetes will wait for the cluster to be green after upgrading each pod. Setting this to `OnDelete` will allow you to manually delete each pod during upgrades | `RollingUpdate` |

charts/opensearch-dashboards/templates/serviceaccount.yaml

@@ -10,3 +10,7 @@ metadata:
     {{- toYaml . | nindent 4 }}
   {{- end }}
   {{- end }}
+{{- if .Values.serviceAccount.automountServiceAccountToken }}
+{{- else }}
+automountServiceAccountToken: false
+{{- end -}}

charts/opensearch-dashboards/values.yaml

@@ -53,6 +53,8 @@ serviceAccount:
   # The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
   name: ""
+  # Controls whether the ServiceAccount API token is automatically mounted on pod
+  automountServiceAccountToken: true
 
 rbac:
   create: true