Repository: bitnami-labs/sealed-secrets (language: go)

Issue:
automountServiceAccountToken set to false breaks the deployment
<!--
 Before you open the bug report please review the following FAQ:

 - [Sealed Secrets FAQ](https://github.com/bitnami-labs/sealed-secrets#faq)
 -->

**Which component**:
Controller, v2.8.1

**Describe the bug**
This is a follow-up bug to https://github.com/bitnami-labs/sealed-secrets/issues/1125

Once setting the Service Account automount  for a sealed-secrets deployment and SA to `false`, sealed-secrets wont start up correctly. This is the error message: 

```
2023/03/21 15:47:00 Starting sealed-secrets controller version: 0.20.2
controller version: 0.20.2
panic: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory

goroutine 1 [running]:
main.mainE({0x1bbade0, 0xc000012018}, 0x406719?, 0x60?, {0xc00003e0c0, 0x4, 0x4})
	/home/runner/work/sealed-secrets/sealed-secrets/cmd/controller/main.go:93 +0x226
main.main()
	/home/runner/work/sealed-secrets/sealed-secrets/cmd/controller/main.go:99 +0x4e
```

**To Reproduce**
Add this to your values and deploy using a Helm chart: 

```
# This changes the deployment
automountServiceAccountToken: false
serviceAccount:
  # This changes the Service Account
  automountServiceAccountToken: false
```


**Expected behavior**
Expectation would be for sealed-secrets to work without a SA automount OR no option to disable SA automount, in case its not possible.


Discussion / hints:
You are right, @gnd. The controller [needs the token mounted](https://github.com/kubernetes/client-go/blob/1517ffb8d37c99e6a3a2842bcdee0aa271f0332b/rest/config.go#L521). We will remove this property from the chart. Thanks.

Fix patch:
diff --git a/helm/sealed-secrets/README.md b/helm/sealed-secrets/README.md
index d9daa038b9..e1b9083b2a 100644
--- a/helm/sealed-secrets/README.md
+++ b/helm/sealed-secrets/README.md
@@ -128,7 +128,6 @@ The command removes all the Kubernetes components associated with the chart and
 | `containerSecurityContext.runAsNonRoot`           | Indicates that the Sealed Secret container must run as a non-root user                 | `true`                              |
 | `containerSecurityContext.runAsUser`              | Set Sealed Secret containers' Security Context runAsUser                               | `1001`                              |
 | `containerSecurityContext.capabilities`           | Adds and removes POSIX capabilities from running containers (see `values.yaml`)        |                                     |
-| `automountServiceAccountToken`                    | whether to automatically mount the service account API-token to a particular pod       | `true`                              |
 | `podLabels`                                       | Extra labels for Sealed Secret pods                                                    | `{}`                                |
 | `podAnnotations`                                  | Annotations for Sealed Secret pods                                                     | `{}`                                |
 | `priorityClassName`                               | Sealed Secret pods' priorityClassName                                                  | `""`                                |
@@ -166,18 +165,17 @@ The command removes all the Kubernetes components associated with the chart and
 
 ### Other Parameters
 
-| Name                                          | Description                                                   | Value              |
-| --------------------------------------------- | ------------------------------------------------------------- | ------------------ |
-| `serviceAccount.annotations`                  | Annotations for Sealed Secret service account                 | `{}`               |
-| `serviceAccount.create`                       | Specifies whether a ServiceAccount should be created          | `true`             |
-| `serviceAccount.labels`                       | Extra labels to be added to the ServiceAccount                | `{}`               |
-| `serviceAccount.name`                         | The name of the ServiceAccount to use.                        | `""`               |
-| `serviceAccount.automountServiceAccountToken` | Specifies, whether to mount the service account API-token     | `true`             |
-| `rbac.create`                                 | Specifies whether RBAC resources should be created            | `true`             |
-| `rbac.clusterRole`                            | Specifies whether the Cluster Role resource should be created | `true`             |
-| `rbac.clusterRoleName`                        | Specifies the name for the Cluster Role resource              | `secrets-unsealer` |
-| `rbac.labels`                                 | Extra labels to be added to RBAC resources                    | `{}`               |
-| `rbac.pspEnabled`                             | PodSecurityPolicy                                             | `false`            |
+| Name                         | Description                                                   | Value              |
+| ---------------------------- | ------------------------------------------------------------- | ------------------ |
+| `serviceAccount.annotations` | Annotations for Sealed Secret service account                 | `{}`               |
+| `serviceAccount.create`      | Specifies whether a ServiceAccount should be created          | `true`             |
+| `serviceAccount.labels`      | Extra labels to be added to the ServiceAccount                | `{}`               |
+| `serviceAccount.name`        | The name of the ServiceAccount to use.                        | `""`               |
+| `rbac.create`                | Specifies whether RBAC resources should be created            | `true`             |
+| `rbac.clusterRole`           | Specifies whether the Cluster Role resource should be created | `true`             |
+| `rbac.clusterRoleName`       | Specifies the name for the Cluster Role resource              | `secrets-unsealer` |
+| `rbac.labels`                | Extra labels to be added to RBAC resources                    | `{}`               |
+| `rbac.pspEnabled`            | PodSecurityPolicy                                             | `false`            |
 
 ### Metrics parameters
 
diff --git a/helm/sealed-secrets/templates/deployment.yaml b/helm/sealed-secrets/templates/deployment.yaml
index d239328734..fb936f06fd 100644
--- a/helm/sealed-secrets/templates/deployment.yaml
+++ b/helm/sealed-secrets/templates/deployment.yaml
@@ -46,7 +46,6 @@ spec:
       securityContext: {{- omit .Values.podSecurityContext "enabled" | toYaml | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "sealed-secrets.serviceAccountName" . }}
-      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
       {{- if .Values.hostNetwork }}
       hostNetwork: true
       {{- end }}
diff --git a/helm/sealed-secrets/templates/service-account.yaml b/helm/sealed-secrets/templates/service-account.yaml
index 22cb4864f5..e58126d780 100644
--- a/helm/sealed-secrets/templates/service-account.yaml
+++ b/helm/sealed-secrets/templates/service-account.yaml
@@ -1,7 +1,6 @@
 {{ if .Values.serviceAccount.create }}
 apiVersion: v1
 kind: ServiceAccount
-automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 metadata:
   name: {{ include "sealed-secrets.serviceAccountName" . }}
   namespace: {{ include "sealed-secrets.namespace" . }}
diff --git a/helm/sealed-secrets/values.yaml b/helm/sealed-secrets/values.yaml
index cbc073ef25..c418433a13 100644
--- a/helm/sealed-secrets/values.yaml
+++ b/helm/sealed-secrets/values.yaml
@@ -169,9 +169,6 @@ containerSecurityContext:
     drop:
       - ALL
 
-## @param automountServiceAccountToken whether to automatically mount the service account API-token to a particular pod
-automountServiceAccountToken: true
-
 ## @param podLabels [object] Extra labels for Sealed Secret pods
 ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
 ##
@@ -347,8 +344,6 @@ serviceAccount:
   ## If not set and create is true, a name is generated using the sealed-secrets.fullname template
   ##
   name: ""
-  ## @param serviceAccount.automountServiceAccountToken Specifies, whether to mount the service account API-token
-  automountServiceAccountToken: true
 ## RBAC configuration
 ##
 rbac:


Test patch: