Repository: cdk8s-team/cdk8s-plus
Pull request #1146 (2022-09-14 05:57:34)

feat(serviceaccount, pod): set automountServiceAccountToken to false
Kubernetes provisions a service account when creating a Pod. This service account's secret token is mounted within the Pod at runtime. 
Many containerized applications do not require direct access to the service account. Hence, setting `automountServiceAccountToken` to `false` to align with best practices.

Signed-off-by: Vinayak Kukreja <vinakuk@amazon.com>

Resolves https://github.com/cdk8s-team/cdk8s-plus/issues/818


Patch:
diff --git a/src/pod.ts b/src/pod.ts
index 3f6a2941..635dd743 100644
--- a/src/pod.ts
+++ b/src/pod.ts
@@ -35,7 +35,7 @@ export abstract class AbstractPod extends base.Resource implements IPodSelector,
     this.securityContext = new PodSecurityContext(props.securityContext);
     this.dns = new PodDns(props.dns);
     this.dockerRegistryAuth = props.dockerRegistryAuth;
-    this.automountServiceAccountToken = props.automountServiceAccountToken ?? true;
+    this.automountServiceAccountToken = props.automountServiceAccountToken ?? false;
 
     if (props.containers) {
       props.containers.forEach(c => this.addContainer(c));
@@ -408,7 +408,7 @@ export interface AbstractPodProps extends base.ResourceProps {
   /**
    * Indicates whether a service account token should be automatically mounted.
    *
-   * @default true
+   * @default false
    * @see https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server
    */
   readonly automountServiceAccountToken?: boolean;
diff --git a/src/service-account.ts b/src/service-account.ts
index 919a0477..ac244c27 100644
--- a/src/service-account.ts
+++ b/src/service-account.ts
@@ -27,7 +27,7 @@ export interface ServiceAccountProps extends base.ResourceProps {
    * Indicates whether pods running as this service account
    * should have an API token automatically mounted. Can be overridden at the pod level.
    *
-   * @default true
+   * @default false
    * @see https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server
    */
   readonly automountToken?: boolean;
@@ -101,7 +101,7 @@ export class ServiceAccount extends base.Resource implements IServiceAccount, rb
     super(scope, id);
 
     this._secrets = props.secrets ?? [];
-    this.automountToken = props.automountToken ?? true;
+    this.automountToken = props.automountToken ?? false;
 
     this.apiObject = new k8s.KubeServiceAccount(this, 'Resource', {
       metadata: props.metadata,


Test patch:
diff --git a/test/__snapshots__/container.test.ts.snap b/test/__snapshots__/container.test.ts.snap
index 40e090cc..4acf50f2 100644
--- a/test/__snapshots__/container.test.ts.snap
+++ b/test/__snapshots__/container.test.ts.snap
@@ -12,7 +12,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "foo",
@@ -73,7 +73,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "foo",
@@ -123,7 +123,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "command": Array [
@@ -194,7 +194,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "image",
diff --git a/test/__snapshots__/cron-job.test.ts.snap b/test/__snapshots__/cron-job.test.ts.snap
index 6ee06ee5..07943571 100644
--- a/test/__snapshots__/cron-job.test.ts.snap
+++ b/test/__snapshots__/cron-job.test.ts.snap
@@ -22,7 +22,7 @@ Array [
               },
             },
             "spec": Object {
-              "automountServiceAccountToken": true,
+              "automountServiceAccountToken": false,
               "containers": Array [
                 Object {
                   "image": "image",
@@ -89,7 +89,7 @@ Array [
               },
             },
             "spec": Object {
-              "automountServiceAccountToken": true,
+              "automountServiceAccountToken": false,
               "containers": Array [
                 Object {
                   "image": "image",
diff --git a/test/__snapshots__/daemon-set.test.ts.snap b/test/__snapshots__/daemon-set.test.ts.snap
index 359276b2..015d560f 100644
--- a/test/__snapshots__/daemon-set.test.ts.snap
+++ b/test/__snapshots__/daemon-set.test.ts.snap
@@ -22,7 +22,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "image",
@@ -84,7 +84,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "image",
diff --git a/test/__snapshots__/deployment.test.ts.snap b/test/__snapshots__/deployment.test.ts.snap
index 03cfcab6..a8163ef0 100644
--- a/test/__snapshots__/deployment.test.ts.snap
+++ b/test/__snapshots__/deployment.test.ts.snap
@@ -31,7 +31,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "image",
@@ -162,7 +162,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "image",
@@ -266,7 +266,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "image",
@@ -369,7 +369,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -461,7 +461,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -551,7 +551,7 @@ Array [
               },
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -622,7 +622,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -705,7 +705,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -776,7 +776,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -856,7 +856,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -949,7 +949,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -1039,7 +1039,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -1110,7 +1110,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -1193,7 +1193,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -1264,7 +1264,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -1344,7 +1344,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -1437,7 +1437,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -1527,7 +1527,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
@@ -1615,7 +1615,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -1700,7 +1700,7 @@ Array [
               ],
             },
           },
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "redis",
@@ -1752,7 +1752,7 @@ Array [
       "name": "test-redis-c870fe8d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
diff --git a/test/__snapshots__/network-policy.test.ts.snap b/test/__snapshots__/network-policy.test.ts.snap
index 9691aaa4..704570f9 100644
--- a/test/__snapshots__/network-policy.test.ts.snap
+++ b/test/__snapshots__/network-policy.test.ts.snap
@@ -104,7 +104,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -149,7 +149,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -235,7 +235,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -299,7 +299,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "pod",
@@ -387,7 +387,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -470,7 +470,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -552,7 +552,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -639,7 +639,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -734,7 +734,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -825,7 +825,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -930,7 +930,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1016,7 +1016,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1103,7 +1103,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1148,7 +1148,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1234,7 +1234,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1298,7 +1298,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "pod",
@@ -1386,7 +1386,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1469,7 +1469,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1551,7 +1551,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1638,7 +1638,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1733,7 +1733,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1824,7 +1824,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1929,7 +1929,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2015,7 +2015,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2102,7 +2102,7 @@ Array [
       "name": "test-web-c854d28f",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -2185,7 +2185,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "web",
diff --git a/test/__snapshots__/pod.test.ts.snap b/test/__snapshots__/pod.test.ts.snap
index 22b294b7..063cc0ff 100644
--- a/test/__snapshots__/pod.test.ts.snap
+++ b/test/__snapshots__/pod.test.ts.snap
@@ -36,7 +36,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -143,7 +143,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -204,7 +204,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -280,7 +280,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -330,7 +330,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -406,7 +406,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -456,7 +456,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -573,7 +573,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -634,7 +634,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -710,7 +710,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -760,7 +760,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -836,7 +836,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -886,7 +886,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -990,7 +990,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1069,7 +1069,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1187,7 +1187,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1294,7 +1294,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1344,7 +1344,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1470,7 +1470,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "pod",
@@ -1522,7 +1522,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1691,7 +1691,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1736,7 +1736,7 @@ Array [
       "name": "test-pod3-c81af0d3",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1786,7 +1786,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -1897,7 +1897,7 @@ Array [
       "namespace": "n1",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2017,7 +2017,7 @@ Array [
       "namespace": "n2",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2067,7 +2067,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2229,7 +2229,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2341,7 +2341,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2445,7 +2445,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2524,7 +2524,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2642,7 +2642,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2759,7 +2759,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2809,7 +2809,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -2935,7 +2935,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "pod",
@@ -2987,7 +2987,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3156,7 +3156,7 @@ Array [
       "name": "test-pod2-c895d79d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3201,7 +3201,7 @@ Array [
       "name": "test-pod3-c81af0d3",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3251,7 +3251,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3362,7 +3362,7 @@ Array [
       "namespace": "n1",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3482,7 +3482,7 @@ Array [
       "namespace": "n2",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3532,7 +3532,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3694,7 +3694,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "pod",
@@ -3806,7 +3806,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "image",
@@ -3856,7 +3856,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "image",
@@ -3950,7 +3950,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "image",
@@ -4031,7 +4031,7 @@ Array [
   },
   Object {
     "apiVersion": "v1",
-    "automountServiceAccountToken": true,
+    "automountServiceAccountToken": false,
     "kind": "ServiceAccount",
     "metadata": Object {
       "name": "test-serviceaccount-c8f15383",
@@ -4052,7 +4052,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "image",
@@ -4146,7 +4146,7 @@ Array [
       "name": "test-pod1-c8153666",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "image",
@@ -4285,7 +4285,7 @@ Array [
       "name": "test-pod-c890e1b8",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "image",
@@ -4555,7 +4555,7 @@ Array [
       "name": "test-redis-c870fe8d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
@@ -4626,7 +4626,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
@@ -4695,7 +4695,7 @@ Array [
           },
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
@@ -4745,7 +4745,7 @@ Array [
       "name": "test-redis-c870fe8d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
@@ -4807,7 +4807,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -4857,7 +4857,7 @@ Array [
       "name": "test-redis-c870fe8d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
@@ -4916,7 +4916,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -4983,7 +4983,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -5048,7 +5048,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -5098,7 +5098,7 @@ Array [
       "name": "test-redis-c870fe8d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
@@ -5160,7 +5160,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -5210,7 +5210,7 @@ Array [
       "name": "test-redis-c870fe8d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
@@ -5269,7 +5269,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -5336,7 +5336,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -5408,7 +5408,7 @@ Array [
           ],
         },
       },
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "web",
@@ -5458,7 +5458,7 @@ Array [
       "name": "test-redis-c870fe8d",
     },
     "spec": Object {
-      "automountServiceAccountToken": true,
+      "automountServiceAccountToken": false,
       "containers": Array [
         Object {
           "image": "redis",
diff --git a/test/__snapshots__/service.test.ts.snap b/test/__snapshots__/service.test.ts.snap
index e7a52b8b..cf335de2 100644
--- a/test/__snapshots__/service.test.ts.snap
+++ b/test/__snapshots__/service.test.ts.snap
@@ -63,7 +63,7 @@ Array [
           },
         },
         "spec": Object {
-          "automountServiceAccountToken": true,
+          "automountServiceAccountToken": false,
           "containers": Array [
             Object {
               "image": "image",
diff --git a/test/pod.test.ts b/test/pod.test.ts
index b2c4edb1..29f6e30b 100644
--- a/test/pod.test.ts
+++ b/test/pod.test.ts
@@ -15,7 +15,7 @@ test('defaults', () => {
 
   expect(manifest).toMatchSnapshot();
   expect(spec.restartPolicy).toEqual(RestartPolicy.ALWAYS);
-  expect(spec.automountServiceAccountToken).toBeTruthy();
+  expect(spec.automountServiceAccountToken).toBeFalsy();
 });
 
 test('fails with two volumes with the same name', () => {
@@ -513,8 +513,8 @@ test('auto mounting token defaults to true', () => {
 
   const spec: k8s.PodSpec = Testing.synth(chart)[0].spec;
 
-  expect(pod.automountServiceAccountToken).toBeTruthy();
-  expect(spec.automountServiceAccountToken).toBeTruthy();
+  expect(pod.automountServiceAccountToken).toBeFalsy();
+  expect(spec.automountServiceAccountToken).toBeFalsy();
 
 });
 
@@ -1395,11 +1395,11 @@ describe('permissions', () => {
 
     const scraper = new kplus.Pod(chart, 'Pod2', {
       containers: [{ image: 'scraper' }],
+      automountServiceAccountToken: true,
     });
 
     pod.permissions.grantRead(scraper);
     expect(Testing.synth(chart)).toMatchSnapshot();
-
   });
 
   test('can grant read permissions to workload', () => {
@@ -1411,11 +1411,11 @@ describe('permissions', () => {
 
     const scraper = new kplus.Deployment(chart, 'Deployment', {
       containers: [{ image: 'scraper' }],
+      automountServiceAccountToken: true,
     });
 
     pod.permissions.grantRead(scraper);
     expect(Testing.synth(chart)).toMatchSnapshot();
-
   });
 
   test('can grant read permissions twice with different subjects', () => {
diff --git a/test/secret.test.ts b/test/secret.test.ts
index aca5fdfa..b9e4c041 100644
--- a/test/secret.test.ts
+++ b/test/secret.test.ts
@@ -136,7 +136,7 @@ test('Can create a service account token secret', () => {
 Array [
   Object {
     "apiVersion": "v1",
-    "automountServiceAccountToken": true,
+    "automountServiceAccountToken": false,
     "kind": "ServiceAccount",
     "metadata": Object {
       "name": "test-serviceaccount-c8f15383",
diff --git a/test/service-account.test.ts b/test/service-account.test.ts
index 40bc7bfe..a4ff05bb 100644
--- a/test/service-account.test.ts
+++ b/test/service-account.test.ts
@@ -20,19 +20,19 @@ test('minimal definition', () => {
   const sa = new kplus.ServiceAccount(chart, 'my-service-account');
 
   // THEN
-  expect(sa.automountToken).toBeTruthy();
+  expect(sa.automountToken).toBeFalsy();
   expect(Testing.synth(chart)).toMatchInlineSnapshot(`
-    Array [
-      Object {
-        "apiVersion": "v1",
-        "automountServiceAccountToken": true,
-        "kind": "ServiceAccount",
-        "metadata": Object {
-          "name": "test-my-service-account-c84bb46b",
-        },
-      },
-    ]
-  `);
+Array [
+  Object {
+    "apiVersion": "v1",
+    "automountServiceAccountToken": false,
+    "kind": "ServiceAccount",
+    "metadata": Object {
+      "name": "test-my-service-account-c84bb46b",
+    },
+  },
+]
+`);
 });
 
 test('secrets can be added to the service account', () => {