Repository: intel/intel-device-plugins-for-kubernetes
Pull request #1170 (2022-09-23 04:32:42)

deployments: disable unused serviceAccounts for plugins
Signed-off-by: Mikko Ylinen <mikko.ylinen@intel.com>


Patch:
diff --git a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
index 60adf69b..354f3c9c 100644
--- a/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
+++ b/deployments/dlb_plugin/base/intel-dlb-plugin.yaml
@@ -13,6 +13,7 @@ spec:
       labels:
         app: intel-dlb-plugin
     spec:
+      automountServiceAccountToken: false
       containers:
       - name: intel-dlb-plugin
         env:
diff --git a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
index a7a3d605..7bb8cc47 100644
--- a/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
+++ b/deployments/dsa_plugin/base/intel-dsa-plugin.yaml
@@ -13,6 +13,7 @@ spec:
       labels:
         app: intel-dsa-plugin
     spec:
+      automountServiceAccountToken: false
       containers:
       - name: intel-dsa-plugin
         env:
diff --git a/deployments/iaa_plugin/base/intel-iaa-plugin.yaml b/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
index e9f19800..5f2731d8 100644
--- a/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
+++ b/deployments/iaa_plugin/base/intel-iaa-plugin.yaml
@@ -13,6 +13,7 @@ spec:
       labels:
         app: intel-iaa-plugin
     spec:
+      automountServiceAccountToken: false
       containers:
       - name: intel-iaa-plugin
         env:
diff --git a/deployments/qat_plugin/base/intel-qat-plugin.yaml b/deployments/qat_plugin/base/intel-qat-plugin.yaml
index 6728149f..dfe9414e 100644
--- a/deployments/qat_plugin/base/intel-qat-plugin.yaml
+++ b/deployments/qat_plugin/base/intel-qat-plugin.yaml
@@ -13,6 +13,7 @@ spec:
       labels:
         app: intel-qat-plugin
     spec:
+      automountServiceAccountToken: false
       containers:
       - name: intel-qat-plugin
         image: intel/intel-qat-plugin:devel
diff --git a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
index 7e5499d5..9e402028 100644
--- a/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
+++ b/deployments/sgx_plugin/base/intel-sgx-plugin.yaml
@@ -13,6 +13,7 @@ spec:
       labels:
         app: intel-sgx-plugin
     spec:
+      automountServiceAccountToken: false
       containers:
       - name: intel-sgx-plugin
         image: intel/intel-sgx-plugin:devel
diff --git a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
index 92af8cb9..47065704 100644
--- a/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
+++ b/deployments/vpu_plugin/base/intel-vpu-plugin.yaml
@@ -13,6 +13,7 @@ spec:
       labels:
         app: intel-vpu-plugin
     spec:
+      automountServiceAccountToken: false
       containers:
       - name: intel-vpu-plugin
         env:


Test patch:
diff --git a/pkg/controllers/dlb/controller_test.go b/pkg/controllers/dlb/controller_test.go
index 2d4b50ef..a93ac487 100644
--- a/pkg/controllers/dlb/controller_test.go
+++ b/pkg/controllers/dlb/controller_test.go
@@ -60,6 +60,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
+					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name: appLabel,
diff --git a/pkg/controllers/dsa/controller_test.go b/pkg/controllers/dsa/controller_test.go
index 535fee1a..42fe129c 100644
--- a/pkg/controllers/dsa/controller_test.go
+++ b/pkg/controllers/dsa/controller_test.go
@@ -61,6 +61,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
+					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name: appLabel,
diff --git a/pkg/controllers/iaa/controller_test.go b/pkg/controllers/iaa/controller_test.go
new file mode 100644
index 00000000..76ec2074
--- /dev/null
+++ b/pkg/controllers/iaa/controller_test.go
@@ -0,0 +1,168 @@
+// Copyright 2022 Intel Corporation. All Rights Reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package iaa
+
+import (
+	"reflect"
+	"testing"
+
+	apps "k8s.io/api/apps/v1"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/diff"
+	"sigs.k8s.io/controller-runtime/pkg/client"
+
+	devicepluginv1 "github.com/intel/intel-device-plugins-for-kubernetes/pkg/apis/deviceplugin/v1"
+)
+
+const appLabel = "intel-iaa-plugin"
+
+// newDaemonSetExpected creates plugin daemonset
+// it's copied from the original controller code (before the usage of go:embed).
+func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet {
+	devicePlugin := rawObj.(*devicepluginv1.IaaDevicePlugin)
+
+	yes := true
+	no := false
+	daemonSet := apps.DaemonSet{
+		TypeMeta: metav1.TypeMeta{
+			Kind:       "DaemonSet",
+			APIVersion: "apps/v1",
+		},
+		ObjectMeta: metav1.ObjectMeta{
+			Namespace: c.ns,
+			Name:      appLabel,
+			Labels: map[string]string{
+				"app": appLabel,
+			},
+		},
+		Spec: apps.DaemonSetSpec{
+			Selector: &metav1.LabelSelector{
+				MatchLabels: map[string]string{
+					"app": appLabel,
+				},
+			},
+			Template: v1.PodTemplateSpec{
+				ObjectMeta: metav1.ObjectMeta{
+					Labels: map[string]string{
+						"app": appLabel,
+					},
+				},
+				Spec: v1.PodSpec{
+					AutomountServiceAccountToken: &no,
+					Containers: []v1.Container{
+						{
+							Name: appLabel,
+							Env: []v1.EnvVar{
+								{
+									Name: "NODE_NAME",
+									ValueFrom: &v1.EnvVarSource{
+										FieldRef: &v1.ObjectFieldSelector{
+											FieldPath: "spec.nodeName",
+										},
+									},
+								},
+							},
+							Args:            getPodArgs(devicePlugin),
+							Image:           devicePlugin.Spec.Image,
+							ImagePullPolicy: "IfNotPresent",
+							SecurityContext: &v1.SecurityContext{
+								ReadOnlyRootFilesystem:   &yes,
+								AllowPrivilegeEscalation: &no,
+							},
+							VolumeMounts: []v1.VolumeMount{
+								{
+									Name:      "devfs",
+									MountPath: "/dev/iax",
+									ReadOnly:  true,
+								},
+								{
+									Name:      "chardevs",
+									MountPath: "/dev/char",
+									ReadOnly:  true,
+								},
+								{
+									Name:      "sysfs",
+									MountPath: "/sys/bus/dsa/devices",
+									ReadOnly:  true,
+								},
+								{
+									Name:      "kubeletsockets",
+									MountPath: "/var/lib/kubelet/device-plugins",
+								},
+							},
+						},
+					},
+					NodeSelector: map[string]string{"kubernetes.io/arch": "amd64"},
+					Volumes: []v1.Volume{
+						{
+							Name: "devfs",
+							VolumeSource: v1.VolumeSource{
+								HostPath: &v1.HostPathVolumeSource{
+									Path: "/dev/iax",
+								},
+							},
+						},
+						{
+							Name: "chardevs",
+							VolumeSource: v1.VolumeSource{
+								HostPath: &v1.HostPathVolumeSource{
+									Path: "/dev/char",
+								},
+							},
+						},
+						{
+							Name: "sysfs",
+							VolumeSource: v1.VolumeSource{
+								HostPath: &v1.HostPathVolumeSource{
+									Path: "/sys/bus/dsa/devices",
+								},
+							},
+						},
+						{
+							Name: "kubeletsockets",
+							VolumeSource: v1.VolumeSource{
+								HostPath: &v1.HostPathVolumeSource{
+									Path: "/var/lib/kubelet/device-plugins",
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+
+	// add the optional init container
+	if devicePlugin.Spec.InitImage != "" {
+		addInitContainer(&daemonSet, devicePlugin)
+	}
+
+	return &daemonSet
+}
+
+// Test that IAA daemonset created by using go:embed is
+// equal to the expected daemonset.
+func TestNewDaemonSetIAA(t *testing.T) {
+	plugin := &devicepluginv1.IaaDevicePlugin{}
+	c := &controller{}
+
+	expected := c.newDaemonSetExpected(plugin)
+	actual := c.NewDaemonSet(plugin)
+
+	if !reflect.DeepEqual(expected, actual) {
+		t.Errorf("expected and actuall daemonsets differ: %+s", diff.ObjectGoPrintDiff(expected, actual))
+	}
+}
diff --git a/pkg/controllers/qat/controller_test.go b/pkg/controllers/qat/controller_test.go
index 0cea46ea..3b7a4905 100644
--- a/pkg/controllers/qat/controller_test.go
+++ b/pkg/controllers/qat/controller_test.go
@@ -65,6 +65,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					Annotations: pluginAnnotations,
 				},
 				Spec: v1.PodSpec{
+					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name:            appLabel,
diff --git a/pkg/controllers/sgx/controller_test.go b/pkg/controllers/sgx/controller_test.go
index 2dd184ce..f4a7b20d 100644
--- a/pkg/controllers/sgx/controller_test.go
+++ b/pkg/controllers/sgx/controller_test.go
@@ -63,6 +63,7 @@ func (c *controller) newDaemonSetExpected(rawObj client.Object) *apps.DaemonSet
 					},
 				},
 				Spec: v1.PodSpec{
+					AutomountServiceAccountToken: &no,
 					Containers: []v1.Container{
 						{
 							Name:            appLabel,