Repository: open-telemetry/opentelemetry-helm-charts
Pull request #1617: feat(opentelemetry-operator): Add options for mounting service account token
Author: login: jinja2
Created: 2025-04-08T00:30:18Z | Merged: 2025-04-18T16:04:34Z

This PR addresses issue [#1616 ](https://github.com/open-telemetry/opentelemetry-helm-charts/issues/1616)

The PR adds 2 new options -
* explicitMountServiceAccountToken - When enabled, operator pod spec will have `automountServiceAccountToken` set to `false`, and the token will instead be explicitly mounted as volume. The projected volume config added to the chart reflects the default used by k8s when automounting is enabled as seen [here](https://github.com/kubernetes/kubernetes/blob/v1.32.3/plugin/pkg/admission/serviceaccount/admission.go#L485C1-L523C3) and the expiration period value is from the default [here](https://github.com/kubernetes/kubernetes/blob/v1.32.3/pkg/serviceaccount/claims.go#L39).
* manager.serviceAccount.automountServiceAccountToken - Sets the automountServiceAccountToken config of service account.

The default behavior remains the same with these changes.

I also tested these changes in an AKS cluster which had the Microsoft defender enabled with the addon `azure-policy` running. With the default config the operator pod can not be created with below error -

![image](https://github.com/user-attachments/assets/91b8e71f-a2e7-4e41-83cd-910b84ea0587)

But when run with `--set explicitMountServiceAccountToken=true`, the operator pod comes up without an admission policy issues.


Diff:
diff --git a/charts/opentelemetry-operator/Chart.yaml b/charts/opentelemetry-operator/Chart.yaml
index 266d543ed0..8afb46c36f 100644
--- a/charts/opentelemetry-operator/Chart.yaml
+++ b/charts/opentelemetry-operator/Chart.yaml
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: opentelemetry-operator
-version: 0.86.1
+version: 0.86.2
 description: OpenTelemetry Operator Helm chart for Kubernetes
 type: application
 home: https://opentelemetry.io/
diff --git a/charts/opentelemetry-operator/examples/default/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml b/charts/opentelemetry-operator/examples/default/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml
index 24f3494818..b5229eab6e 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     cert-manager.io/inject-ca-from: default/example-opentelemetry-operator-serving-cert
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -91,7 +91,7 @@ metadata:
   annotations:
     cert-manager.io/inject-ca-from: default/example-opentelemetry-operator-serving-cert
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/certmanager.yaml b/charts/opentelemetry-operator/examples/default/rendered/certmanager.yaml
index 7624c237d8..94a02f1c14 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/certmanager.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/certmanager.yaml
@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -30,7 +30,7 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/clusterrole.yaml b/charts/opentelemetry-operator/examples/default/rendered/clusterrole.yaml
index f255cc7c52..11fd51fb40 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/clusterrole.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/clusterrole.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -257,7 +257,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -276,7 +276,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/clusterrolebinding.yaml b/charts/opentelemetry-operator/examples/default/rendered/clusterrolebinding.yaml
index 4aad268b68..d17de4f9e2 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/clusterrolebinding.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/clusterrolebinding.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -26,7 +26,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/deployment.yaml b/charts/opentelemetry-operator/examples/default/rendered/deployment.yaml
index 8ecf0ed4f0..dad2fa2563 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/deployment.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/deployment.yaml
@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -24,7 +24,7 @@ spec:
       annotations:
         kubectl.kubernetes.io/default-container: manager
       labels:
-        helm.sh/chart: opentelemetry-operator-0.86.1
+        helm.sh/chart: opentelemetry-operator-0.86.2
         app.kubernetes.io/name: opentelemetry-operator
         app.kubernetes.io/version: "0.122.0"
         app.kubernetes.io/managed-by: Helm
@@ -32,6 +32,7 @@ spec:
         app.kubernetes.io/instance: example
         app.kubernetes.io/component: controller-manager
     spec:
+      automountServiceAccountToken: true
       hostNetwork: false
       containers:
         - args:
diff --git a/charts/opentelemetry-operator/examples/default/rendered/role.yaml b/charts/opentelemetry-operator/examples/default/rendered/role.yaml
index dca9a1c8ac..fb475b739e 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/role.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/role.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/rolebinding.yaml b/charts/opentelemetry-operator/examples/default/rendered/rolebinding.yaml
index d55eaa139a..00ecc00cd5 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/rolebinding.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/rolebinding.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/service.yaml b/charts/opentelemetry-operator/examples/default/rendered/service.yaml
index ce169bad98..103261631b 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/service.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/service.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -32,7 +32,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/serviceaccount.yaml b/charts/opentelemetry-operator/examples/default/rendered/serviceaccount.yaml
index 54e5bac702..99602c27d4 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/serviceaccount.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/serviceaccount.yaml
@@ -2,11 +2,12 @@
 # Source: opentelemetry-operator/templates/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: true
 metadata:
   name: opentelemetry-operator
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/tests/test-certmanager-connection.yaml b/charts/opentelemetry-operator/examples/default/rendered/tests/test-certmanager-connection.yaml
index b12e29f32f..5bde378b9b 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/tests/test-certmanager-connection.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/tests/test-certmanager-connection.yaml
@@ -6,7 +6,7 @@ metadata:
   name: "example-opentelemetry-operator-cert-manager"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/default/rendered/tests/test-service-connection.yaml b/charts/opentelemetry-operator/examples/default/rendered/tests/test-service-connection.yaml
index f6032dce15..1d1233ed24 100644
--- a/charts/opentelemetry-operator/examples/default/rendered/tests/test-service-connection.yaml
+++ b/charts/opentelemetry-operator/examples/default/rendered/tests/test-service-connection.yaml
@@ -6,7 +6,7 @@ metadata:
   name: "example-opentelemetry-operator-metrics"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -59,7 +59,7 @@ metadata:
   name: "example-opentelemetry-operator-webhook"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml
index 24f3494818..b5229eab6e 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/admission-webhooks/operator-webhook-with-cert-manager.yaml
@@ -6,7 +6,7 @@ metadata:
   annotations:
     cert-manager.io/inject-ca-from: default/example-opentelemetry-operator-serving-cert
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -91,7 +91,7 @@ metadata:
   annotations:
     cert-manager.io/inject-ca-from: default/example-opentelemetry-operator-serving-cert
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/certmanager.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/certmanager.yaml
index 7624c237d8..94a02f1c14 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/certmanager.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/certmanager.yaml
@@ -4,7 +4,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -30,7 +30,7 @@ apiVersion: cert-manager.io/v1
 kind: Issuer
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrole.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrole.yaml
index f255cc7c52..11fd51fb40 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrole.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrole.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -257,7 +257,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -276,7 +276,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrolebinding.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrolebinding.yaml
index 4aad268b68..d17de4f9e2 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrolebinding.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/clusterrolebinding.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -26,7 +26,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/deployment.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/deployment.yaml
index 8ba9114e5c..c0f36f572f 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/deployment.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/deployment.yaml
@@ -4,7 +4,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -24,7 +24,7 @@ spec:
       annotations:
         kubectl.kubernetes.io/default-container: manager
       labels:
-        helm.sh/chart: opentelemetry-operator-0.86.1
+        helm.sh/chart: opentelemetry-operator-0.86.2
         app.kubernetes.io/name: opentelemetry-operator
         app.kubernetes.io/version: "0.122.0"
         app.kubernetes.io/managed-by: Helm
@@ -32,6 +32,7 @@ spec:
         app.kubernetes.io/instance: example
         app.kubernetes.io/component: controller-manager
     spec:
+      automountServiceAccountToken: true
       hostNetwork: false
       containers:
         - args:
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/role.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/role.yaml
index dca9a1c8ac..fb475b739e 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/role.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/role.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/rolebinding.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/rolebinding.yaml
index d55eaa139a..00ecc00cd5 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/rolebinding.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/rolebinding.yaml
@@ -4,7 +4,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/service.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/service.yaml
index ce169bad98..103261631b 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/service.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/service.yaml
@@ -4,7 +4,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -32,7 +32,7 @@ apiVersion: v1
 kind: Service
 metadata:
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/serviceaccount.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/serviceaccount.yaml
index 54e5bac702..99602c27d4 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/serviceaccount.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/serviceaccount.yaml
@@ -2,11 +2,12 @@
 # Source: opentelemetry-operator/templates/serviceaccount.yaml
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: true
 metadata:
   name: opentelemetry-operator
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-certmanager-connection.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-certmanager-connection.yaml
index b12e29f32f..5bde378b9b 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-certmanager-connection.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-certmanager-connection.yaml
@@ -6,7 +6,7 @@ metadata:
   name: "example-opentelemetry-operator-cert-manager"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-service-connection.yaml b/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-service-connection.yaml
index f6032dce15..1d1233ed24 100644
--- a/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-service-connection.yaml
+++ b/charts/opentelemetry-operator/examples/feature-gates/rendered/tests/test-service-connection.yaml
@@ -6,7 +6,7 @@ metadata:
   name: "example-opentelemetry-operator-metrics"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
@@ -59,7 +59,7 @@ metadata:
   name: "example-opentelemetry-operator-webhook"
   namespace: default
   labels:
-    helm.sh/chart: opentelemetry-operator-0.86.1
+    helm.sh/chart: opentelemetry-operator-0.86.2
     app.kubernetes.io/name: opentelemetry-operator
     app.kubernetes.io/version: "0.122.0"
     app.kubernetes.io/managed-by: Helm
diff --git a/charts/opentelemetry-operator/templates/deployment.yaml b/charts/opentelemetry-operator/templates/deployment.yaml
index 33a3da3c15..d6e07ea3c5 100644
--- a/charts/opentelemetry-operator/templates/deployment.yaml
+++ b/charts/opentelemetry-operator/templates/deployment.yaml
@@ -1,3 +1,4 @@
+{{- $explicitMount := not .Values.automountServiceAccountToken }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -33,6 +34,7 @@ spec:
         {{- end }}
         app.kubernetes.io/component: controller-manager
     spec:
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
       hostNetwork: {{ .Values.hostNetwork }}
       {{- if .Values.priorityClassName }}
       priorityClassName: {{ .Values.priorityClassName | quote }}
@@ -122,11 +124,18 @@ spec:
             initialDelaySeconds: 5
             periodSeconds: 10
           resources: {{ toYaml .Values.manager.resources | nindent 12 }}
-          {{- if or .Values.admissionWebhooks.create .Values.admissionWebhooks.secretName }}
+          {{- if or .Values.admissionWebhooks.create .Values.admissionWebhooks.secretName $explicitMount }}
           volumeMounts:
+            {{- if or .Values.admissionWebhooks.create .Values.admissionWebhooks.secretName }}
             - mountPath: /tmp/k8s-webhook-server/serving-certs
               name: cert
               readOnly: true
+            {{- end }}
+            {{- if $explicitMount }}
+            - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+              name: access-token
+              readOnly: true
+            {{- end }}
           {{- end }}
           {{- with .Values.manager.securityContext }}
           securityContext: {{ toYaml . | nindent 12 }}
@@ -151,6 +160,12 @@ spec:
           {{- with .Values.kubeRBACProxy.securityContext }}
           securityContext: {{ toYaml . | nindent 12 }}
           {{- end }}
+          {{- if $explicitMount }}
+          volumeMounts:
+            - name: access-token
+              mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+              readOnly: true
+          {{- end }}
         {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
@@ -170,12 +185,33 @@ spec:
       {{- end }}
       serviceAccountName: {{ template "opentelemetry-operator.serviceAccountName" . }}
       terminationGracePeriodSeconds: 10
-      {{- if or .Values.admissionWebhooks.create .Values.admissionWebhooks.secretName }}
+      {{- if or .Values.admissionWebhooks.create .Values.admissionWebhooks.secretName $explicitMount }}
       volumes:
+        {{- if or .Values.admissionWebhooks.create .Values.admissionWebhooks.secretName }}
         - name: cert
           secret:
             defaultMode: 420
             secretName: {{ default (printf "%s-controller-manager-service-cert" (include "opentelemetry-operator.fullname" .)) .Values.admissionWebhooks.secretName }}
+        {{- end }}
+        {{- if $explicitMount }}
+        - name: access-token
+          projected:
+            defaultMode: 420
+            sources:
+              - serviceAccountToken:
+                  expirationSeconds: 3607
+                  path: token
+              - configMap:
+                  name: kube-root-ca.crt
+                  items:
+                    - key: ca.crt
+                      path: ca.crt
+              - downwardAPI:
+                  items:
+                    - path: namespace
+                      fieldRef:
+                        fieldPath: metadata.namespace
+        {{- end }}
       {{- end }}
       securityContext:
 {{ toYaml .Values.securityContext | indent 8 }}
diff --git a/charts/opentelemetry-operator/templates/serviceaccount.yaml b/charts/opentelemetry-operator/templates/serviceaccount.yaml
index 8300ba4027..1264af9cbe 100644
--- a/charts/opentelemetry-operator/templates/serviceaccount.yaml
+++ b/charts/opentelemetry-operator/templates/serviceaccount.yaml
@@ -1,6 +1,7 @@
 {{- if .Values.manager.serviceAccount.create }}
 apiVersion: v1
 kind: ServiceAccount
+automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
 metadata:
   name: {{ template "opentelemetry-operator.serviceAccountName" . }}
   namespace: {{ .Release.Namespace }}
diff --git a/charts/opentelemetry-operator/values.schema.json b/charts/opentelemetry-operator/values.schema.json
index f6721615f9..a2ae284b75 100644
--- a/charts/opentelemetry-operator/values.schema.json
+++ b/charts/opentelemetry-operator/values.schema.json
@@ -20,7 +20,8 @@
     "priorityClassName",
     "securityContext",
     "testFramework",
-    "additionalLabels"
+    "additionalLabels",
+    "automountServiceAccountToken"
   ],
   "additionalProperties": false,
   "properties": {
@@ -2111,6 +2112,14 @@
       "examples": [
         {}
       ]
+    },
+    "automountServiceAccountToken": {
+      "type": "boolean",
+      "default": true,
+      "title": "Controls automounting of the service account token in both the operator pod and the associated service account object.",
+      "examples": [
+        false
+      ]
     }
   },
   "examples": [
diff --git a/charts/opentelemetry-operator/values.yaml b/charts/opentelemetry-operator/values.yaml
index 91577b0bad..8842bf92e9 100644
--- a/charts/opentelemetry-operator/values.yaml
+++ b/charts/opentelemetry-operator/values.yaml
@@ -355,6 +355,17 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# Determines how the operator pod mounts the service account token and also
+# sets the corresponding field in the associated service account object.
+# - When set to `true` (default), the service account token is automatically
+#   mounted to the pod, and the service account object will have the
+#   `automountServiceAccountToken` field set to `true`.
+# - When set to `false`, automounting of the service account token is disabled,
+#   and the token is manually mounted using a volume and volumeMounts in
+#   the pod spec by the chart. This also updates the `automountServiceAccountToken`
+#   field in the service account object to `false`.
+automountServiceAccountToken: true
+
 testFramework:
   image:
     repository: busybox


Reviews:
user: login: jaronoff97
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T14:57:29Z
user: login: jinja2
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T15:14:53Z
user: login: jinja2
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T15:27:55Z
user: login: jaronoff97
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T15:36:30Z
user: login: jinja2
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T15:52:38Z
user: login: jaronoff97
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T16:09:53Z
user: login: jinja2
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T16:57:33Z
user: login: jaronoff97
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T17:51:25Z
user: login: jinja2
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T18:01:47Z
user: login: jaronoff97
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T18:29:52Z
user: login: jinja2
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-04-08T18:51:46Z
user: login: Allex1
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-04-16T18:24:16Z
user: login: TylerHelmuth
state: APPROVED
author_association: MEMBER
submitted_at: 2025-04-18T16:04:11Z

Review comments:
diff_hunk: @@ -1,6 +1,6 @@
 apiVersion: v2
 name: opentelemetry-operator
-version: 0.84.2
+version: 0.85.0
path: charts/opentelemetry-operator/Chart.yaml
user: login: jaronoff97
body: this should be a patch version change
created_at: 2025-04-08T14:54:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to true, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+explicitMountServiceAccountToken: false
path: charts/opentelemetry-operator/values.yaml
user: login: jaronoff97
body: is there a case when this would be true and `automountServiceAccountToken` would be true? From my understanding i think it would be that these are mutually exclusive?
created_at: 2025-04-08T14:57:24Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to true, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+explicitMountServiceAccountToken: false
path: charts/opentelemetry-operator/values.yaml
user: login: jinja2
body: Yeah, I can't think of any use case where these won't be mutually exclusive.
created_at: 2025-04-08T15:14:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,6 +1,6 @@
 apiVersion: v2
 name: opentelemetry-operator
-version: 0.84.2
+version: 0.85.0
path: charts/opentelemetry-operator/Chart.yaml
user: login: jinja2
body: done
created_at: 2025-04-08T15:27:54Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to true, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+explicitMountServiceAccountToken: false
path: charts/opentelemetry-operator/values.yaml
user: login: jaronoff97
body: IMO we should keep `automountServiceAccountToken` and remove this flag then. should we also allow a user to supply their own mount rather than inferring it? I would assume anyone setting this false would know to do this.
created_at: 2025-04-08T15:36:30Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to true, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+explicitMountServiceAccountToken: false
path: charts/opentelemetry-operator/values.yaml
user: login: jinja2
body: > IMO we should keep automountServiceAccountToken and remove this flag then

Ack, yeah I'll update the flag. My main reason for not keeping the flag same as `automountServiceAccountToken` was to make it clear to the user that the chart config will do more than just updating the value of this pod spec option.

> should we also allow a user to supply their own mount rather than inferring it?

I think the chart adding the vol/mounts is better for user experience. The alternative would require a user to add `volumes` to the pod and `volumeMounts` for both the manager and kube-rbac-proxy containers in addition to setting `automountServiceAccountToken` to false. The chart at present does not have any option to add extra volumes and mounts, so we'll be adding these.

If you prefer the more do-it-yourself approach, I am ok updating the chart accordingly. Lmk.
created_at: 2025-04-08T15:52:37Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to true, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+explicitMountServiceAccountToken: false
path: charts/opentelemetry-operator/values.yaml
user: login: jaronoff97
body: Yeah let's just have the chart do it then (it being automate this by adding the vol/mounts)
created_at: 2025-04-08T16:09:53Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to true, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+explicitMountServiceAccountToken: false
path: charts/opentelemetry-operator/values.yaml
user: login: jinja2
body: update the flag name, thanks!
created_at: 2025-04-08T16:57:33Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to false, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec by the chart.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+automountServiceAccountToken: true
path: charts/opentelemetry-operator/values.yaml
user: login: jaronoff97
body: do we need both of these?
created_at: 2025-04-08T17:51:21Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to false, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec by the chart.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+automountServiceAccountToken: true
path: charts/opentelemetry-operator/values.yaml
user: login: jinja2
body: I wouldn't say we "need" two options for service account vs workload. I was going for more flexibility for any advanced use cases. But unifying both object's setting with one config for simplicity would also be okay.
created_at: 2025-04-08T18:01:46Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to false, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec by the chart.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+automountServiceAccountToken: true
path: charts/opentelemetry-operator/values.yaml
user: login: jaronoff97
body: Yeah i think we should just have one to keep it easy IMO
created_at: 2025-04-08T18:29:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -354,6 +357,12 @@ securityContext:
   runAsUser: 65532
   fsGroup: 65532
 
+# -- Determines how the operator pod mounts the service account token.
+# When set to false, automounting of the service account token is disabled, and the token is manually mounted
+# using a volume and volumeMounts in the pod spec by the chart.
+# This is useful for security hardening, as it prevents the pod from automatically having access to the service account token unless explicitly mounted.
+automountServiceAccountToken: true
path: charts/opentelemetry-operator/values.yaml
user: login: jinja2
body: done!
created_at: 2025-04-08T18:51:46Z
author_association: CONTRIBUTOR

PR comments:
user: login: jinja2
created_at: 2025-04-10T15:26:12Z
body: Hi @jaronoff97, just wanted to follow up. I’ve pushed the requested updates. Lmk if there’s anything else I should tweak when you get a chance to take another look. Thanks!
author_association: CONTRIBUTOR
user: login: Allex1
created_at: 2025-04-14T14:19:07Z
body: @jinja2 can you please rebase/resolve conflicts ?
author_association: CONTRIBUTOR
user: login: jinja2
created_at: 2025-04-16T15:00:18Z
body: @Allex1 conflicts have been fixed, thanks!
author_association: CONTRIBUTOR
user: login: jinja2
created_at: 2025-04-16T18:42:07Z
body: Updated the version chart version as 0.86.1 was already merged
author_association: CONTRIBUTOR