Support serverPod.automountServiceAccountToken

rjeberhard · rjeberhard · commit 9fdf7a433303 · 2025-04-02T09:49:21.000-04:00
diff --git a/documentation/domains/Cluster.json b/documentation/domains/Cluster.json
@@ -234,6 +234,10 @@
             "$ref": "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.28.2/_definitions.json#/definitions/io.k8s.api.core.v1.Toleration"
           }
         },
+        "automountServiceAccountToken": {
+          "description": "Indicates whether a service account token should be automatically mounted on the pod. Defaults to true if not set. See `kubectl explain pods.spec.automountServiceAccountToken`.",
+          "type": "boolean"
+        },
         "readinessProbe": {
           "description": "Settings for the readiness probe associated with a WebLogic Server instance. If not specified, the operator will create an HTTP probe accessing the /weblogic/ready path. If an HTTP probe is specified then the operator will fill in `path`, `port`, and `scheme`, if they are missing. The operator will also fill in any missing tuning-related fields if they are unspecified. Tuning-related fields will be inherited from the domain and cluster scopes unless a more specific scope defines a different action, such as a different HTTP path to access.",
           "$ref": "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.28.2/_definitions.json#/definitions/io.k8s.api.core.v1.Probe"
diff --git a/documentation/domains/Cluster.md b/documentation/domains/Cluster.md
@@ -55,6 +55,7 @@ The specification of the operation of the WebLogic cluster. Required.
 | --- | --- | --- |
 | `affinity` | [Affinity](k8s1.28.2.md#affinity) | The Pod's scheduling constraints. More info: https://oracle.github.io/weblogic-kubernetes-operator/faq/node-heating/.  See `kubectl explain pods.spec.affinity`. |
 | `annotations` | Map | The annotations to be added to generated resources. |
+| `automountServiceAccountToken` | Boolean | Indicates whether a service account token should be automatically mounted on the pod. Defaults to true if not set. See `kubectl explain pods.spec.automountServiceAccountToken`. |
 | `containers` | Array of [Container](k8s1.28.2.md#container) | Additional containers to be included in the server Pod. See `kubectl explain pods.spec.containers`. |
 | `containerSecurityContext` | [Security Context](k8s1.28.2.md#security-context) | Container-level security attributes. Will override any matching Pod-level attributes. See `kubectl explain pods.spec.containers.securityContext`. If no value is specified for this field, the operator will use default content for container-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/. |
 | `env` | Array of [Env Var](k8s1.28.2.md#env-var) | A list of environment variables to set in the container running a WebLogic Server instance. More info: https://oracle.github.io/weblogic-kubernetes-operator/userguide/managing-domains/domain-resource/#jvm-memory-and-java-option-environment-variables. See `kubectl explain pods.spec.containers.env`. |
diff --git a/documentation/domains/Domain.json b/documentation/domains/Domain.json
@@ -1107,6 +1107,10 @@
             "$ref": "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.28.2/_definitions.json#/definitions/io.k8s.api.core.v1.Toleration"
           }
         },
+        "automountServiceAccountToken": {
+          "description": "Indicates whether a service account token should be automatically mounted on the pod. Defaults to true if not set. See `kubectl explain pods.spec.automountServiceAccountToken`.",
+          "type": "boolean"
+        },
         "readinessProbe": {
           "description": "Settings for the readiness probe associated with a WebLogic Server instance. If not specified, the operator will create an HTTP probe accessing the /weblogic/ready path. If an HTTP probe is specified then the operator will fill in `path`, `port`, and `scheme`, if they are missing. The operator will also fill in any missing tuning-related fields if they are unspecified. Tuning-related fields will be inherited from the domain and cluster scopes unless a more specific scope defines a different action, such as a different HTTP path to access.",
           "$ref": "https://raw.githubusercontent.com/yannh/kubernetes-json-schema/master/v1.28.2/_definitions.json#/definitions/io.k8s.api.core.v1.Probe"
diff --git a/documentation/domains/Domain.md b/documentation/domains/Domain.md
@@ -156,6 +156,7 @@ The current status of the operation of the WebLogic domain. Updated automaticall
 | --- | --- | --- |
 | `affinity` | [Affinity](k8s1.28.2.md#affinity) | The Pod's scheduling constraints. More info: https://oracle.github.io/weblogic-kubernetes-operator/faq/node-heating/.  See `kubectl explain pods.spec.affinity`. |
 | `annotations` | Map | The annotations to be added to generated resources. |
+| `automountServiceAccountToken` | Boolean | Indicates whether a service account token should be automatically mounted on the pod. Defaults to true if not set. See `kubectl explain pods.spec.automountServiceAccountToken`. |
 | `containers` | Array of [Container](k8s1.28.2.md#container) | Additional containers to be included in the server Pod. See `kubectl explain pods.spec.containers`. |
 | `containerSecurityContext` | [Security Context](k8s1.28.2.md#security-context) | Container-level security attributes. Will override any matching Pod-level attributes. See `kubectl explain pods.spec.containers.securityContext`. If no value is specified for this field, the operator will use default content for container-level `securityContext`. More info: https://oracle.github.io/weblogic-kubernetes-operator/security/domain-security/pod-and-container/. |
 | `env` | Array of [Env Var](k8s1.28.2.md#env-var) | A list of environment variables to set in the container running a WebLogic Server instance. More info: https://oracle.github.io/weblogic-kubernetes-operator/userguide/managing-domains/domain-resource/#jvm-memory-and-java-option-environment-variables. See `kubectl explain pods.spec.containers.env`. |
diff --git a/integration-tests/src/test/java/oracle/weblogic/domain/ServerPod.java b/integration-tests/src/test/java/oracle/weblogic/domain/ServerPod.java
@@ -1,4 +1,4 @@
-// Copyright (c) 2020, 2022, Oracle and/or its affiliates.
+// Copyright (c) 2020, 2025, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package oracle.weblogic.domain;
@@ -96,6 +96,11 @@ public class ServerPod {
           + "ServiceAccount will be used. The ServiceAccount has to exist at the time the pod is created.")
   private String serviceAccountName;
 
+  @ApiModelProperty(
+      "Indicates whether a service account token should be automatically mounted on the pod. "
+          + "Defaults to true if not set. See `kubectl explain pods.spec.automountServiceAccountToken`.")
+  private Boolean automountServiceAccountToken = null;
+
   @ApiModelProperty("Memory and CPU minimum requirements and limits for the server.")
   private V1ResourceRequirements resources;
 
@@ -462,6 +467,23 @@ public void setServiceAccountName(String serviceAccountName) {
     this.serviceAccountName = serviceAccountName;
   }
 
+  public ServerPod automountServiceAccountToken(Boolean automountServiceAccountToken) {
+    this.automountServiceAccountToken = automountServiceAccountToken;
+    return this;
+  }
+
+  public Boolean automountServiceAccountToken() {
+    return automountServiceAccountToken;
+  }
+
+  public Boolean getAutomountServiceAccountToken() {
+    return automountServiceAccountToken;
+  }
+
+  public void setAutomountServiceAccountToken(Boolean automountServiceAccountToken) {
+    this.automountServiceAccountToken = automountServiceAccountToken;
+  }
+
   public ServerPod resources(V1ResourceRequirements resources) {
     this.resources = resources;
     return this;
diff --git a/kubernetes/crd/cluster-crd.yaml b/kubernetes/crd/cluster-crd.yaml
@@ -5,7 +5,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    weblogic.sha256: 34ed6e0ff57580da665db440dce607569f175d0d93934c0e31b2ab26e7ede28d
+    weblogic.sha256: 251af6bc71a6c64c9f40bf8b60f5eee1a82dbf32a3439f7fe035c0baa89280bd
   name: clusters.weblogic.oracle
 spec:
   group: weblogic.oracle
@@ -329,6 +329,11 @@ spec:
                         operator:
                           type: string
                     type: array
+                  automountServiceAccountToken:
+                    description: Indicates whether a service account token should
+                      be automatically mounted on the pod. Defaults to true if not
+                      set. See `kubectl explain pods.spec.automountServiceAccountToken`.
+                    type: boolean
                   readinessProbe:
                     description: Settings for the readiness probe associated with
                       a WebLogic Server instance. If not specified, the operator will
diff --git a/kubernetes/crd/domain-crd.yaml b/kubernetes/crd/domain-crd.yaml
@@ -5,7 +5,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    weblogic.sha256: 3c9cb1077e51677d24c80535ad61c7b524c415e44dda7eda48e9e344f4bb3809
+    weblogic.sha256: d5781dca31795f836ae89e7139d88fce344b88395f61659d8c7c912467c70a98
   name: domains.weblogic.oracle
 spec:
   group: weblogic.oracle
@@ -1433,6 +1433,11 @@ spec:
                             operator:
                               type: string
                         type: array
+                      automountServiceAccountToken:
+                        description: Indicates whether a service account token should
+                          be automatically mounted on the pod. Defaults to true if
+                          not set. See `kubectl explain pods.spec.automountServiceAccountToken`.
+                        type: boolean
                       readinessProbe:
                         description: Settings for the readiness probe associated with
                           a WebLogic Server instance. If not specified, the operator
@@ -5216,6 +5221,11 @@ spec:
                         operator:
                           type: string
                     type: array
+                  automountServiceAccountToken:
+                    description: Indicates whether a service account token should
+                      be automatically mounted on the pod. Defaults to true if not
+                      set. See `kubectl explain pods.spec.automountServiceAccountToken`.
+                    type: boolean
                   readinessProbe:
                     description: Settings for the readiness probe associated with
                       a WebLogic Server instance. If not specified, the operator will
@@ -8107,6 +8117,11 @@ spec:
                                 type: string
                               operator:
                                 type: string
+                        automountServiceAccountToken:
+                          description: Indicates whether a service account token should
+                            be automatically mounted on the pod. Defaults to true
+                            if not set. See `kubectl explain pods.spec.automountServiceAccountToken`.
+                          type: boolean
                         readinessProbe:
                           description: Settings for the readiness probe associated
                             with a WebLogic Server instance. If not specified, the
diff --git a/operator/src/main/java/oracle/kubernetes/operator/helpers/BasePodStepContext.java b/operator/src/main/java/oracle/kubernetes/operator/helpers/BasePodStepContext.java
@@ -1,4 +1,4 @@
-// Copyright (c) 2019, 2024, Oracle and/or its affiliates.
+// Copyright (c) 2019, 2025, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package oracle.kubernetes.operator.helpers;
@@ -228,6 +228,7 @@ protected V1PodSpec createPodSpec() {
         .topologySpreadConstraints(getTopologySpreadConstraints())
         .nodeSelector(getServerSpec().getNodeSelectors())
         .serviceAccountName(getServerSpec().getServiceAccountName())
+        .automountServiceAccountToken(getServerSpec().getAutomountServiceAccountToken())
         .nodeName(getServerSpec().getNodeName())
         .schedulerName(getServerSpec().getSchedulerName())
         .priorityClassName(getServerSpec().getPriorityClassName())
diff --git a/operator/src/main/java/oracle/kubernetes/operator/helpers/JobStepContext.java b/operator/src/main/java/oracle/kubernetes/operator/helpers/JobStepContext.java
@@ -584,6 +584,7 @@ protected V1PodSpec createPodSpec() {
             .activeDeadlineSeconds(getActiveDeadlineSeconds())
             .restartPolicy("Never")
             .serviceAccountName(info.getDomain().getSpec().getServiceAccountName())
+            .automountServiceAccountToken(info.getDomain().getSpec().getAutomountServiceAccountToken())
             .addVolumesItem(new V1Volume().name(SECRETS_VOLUME).secret(getSecretsVolume()))
             .addVolumesItem(
                 new V1Volume().name(SCRIPTS_VOLUME).configMap(getConfigMapVolumeSource()))
diff --git a/operator/src/main/java/oracle/kubernetes/operator/processing/EffectiveServerSpec.java b/operator/src/main/java/oracle/kubernetes/operator/processing/EffectiveServerSpec.java
@@ -1,4 +1,4 @@
-// Copyright (c) 2018, 2024, Oracle and/or its affiliates.
+// Copyright (c) 2018, 2025, Oracle and/or its affiliates.
 // Licensed under the Universal Permissive License v 1.0 as shown at https://oss.oracle.com/licenses/upl.
 
 package oracle.kubernetes.operator.processing;
@@ -162,6 +162,8 @@ public interface EffectiveServerSpec {
 
   String getServiceAccountName();
 
+  Boolean getAutomountServiceAccountToken();
+
   String getSchedulerName();
 
   List<V1Toleration> getTolerations();
diff --git a/operator/src/main/java/oracle/kubernetes/weblogic/domain/model/BaseConfiguration.java b/operator/src/main/java/oracle/kubernetes/weblogic/domain/model/BaseConfiguration.java
@@ -239,6 +239,10 @@ public String getServiceAccountName() {
     return serverPod.getServiceAccountName();
   }
 
+  public Boolean getAutomountServiceAccountToken() {
+    return serverPod.getAutomountServiceAccountToken();
+  }
+
   public void setNodeName(String nodeName) {
     serverPod.setNodeName(nodeName);
   }
diff --git a/operator/src/main/java/oracle/kubernetes/weblogic/domain/model/EffectiveServerSpecCommonImpl.java b/operator/src/main/java/oracle/kubernetes/weblogic/domain/model/EffectiveServerSpecCommonImpl.java
@@ -220,6 +220,11 @@ public String getServiceAccountName() {
     return server.getServiceAccountName();
   }
 
+  @Override
+  public Boolean getAutomountServiceAccountToken() {
+    return server.getAutomountServiceAccountToken();
+  }
+
   @Override
   public String getSchedulerName() {
     return server.getSchedulerName();
diff --git a/operator/src/main/java/oracle/kubernetes/weblogic/domain/model/ServerPod.java b/operator/src/main/java/oracle/kubernetes/weblogic/domain/model/ServerPod.java
@@ -180,6 +180,10 @@ class ServerPod extends KubernetesResource {
       + "See `kubectl explain pods.spec.serviceAccountName`.")
   private String serviceAccountName = null;
 
+  @Description("Indicates whether a service account token should be automatically mounted on the pod. "
+      + "Defaults to true if not set. See `kubectl explain pods.spec.automountServiceAccountToken`.")
+  private Boolean automountServiceAccountToken = null;
+
   @Description("HostAliases is an optional list of hosts and IPs that will be injected into the pod's hosts file "
       + "if specified. This is only valid for non-hostNetwork pods.")
   private List<V1HostAlias> hostAliases = new ArrayList<>();
@@ -576,6 +580,9 @@ void fillInFrom(ServerPod serverPod1) {
     if (serviceAccountName == null) {
       serviceAccountName = serverPod1.serviceAccountName;
     }
+    if (automountServiceAccountToken == null) {
+      automountServiceAccountToken = serverPod1.automountServiceAccountToken;
+    }
     if (schedulerName == null) {
       schedulerName = serverPod1.schedulerName;
     }
@@ -869,6 +876,14 @@ void setServiceAccountName(String serviceAccountName) {
     this.serviceAccountName = serviceAccountName;
   }
 
+  Boolean getAutomountServiceAccountToken() {
+    return automountServiceAccountToken;
+  }
+
+  void setAutomountServiceAccountToken(Boolean automountServiceAccountToken) {
+    this.automountServiceAccountToken = automountServiceAccountToken;
+  }
+
   List<V1Toleration> getTolerations() {
     return tolerations;
   }
@@ -922,6 +937,7 @@ public String toString() {
         .append("tolerations", tolerations)
         .append("hostAliases", hostAliases)
         .append("serviceAccountName", serviceAccountName)
+        .append("automountServiceAccountToken", automountServiceAccountToken)
         .toString();
   }
 
@@ -970,6 +986,7 @@ public boolean equals(Object o) {
         .append(tolerations, that.tolerations)
         .append(hostAliases, that.hostAliases)
         .append(serviceAccountName, that.serviceAccountName)
+        .append(automountServiceAccountToken, that.automountServiceAccountToken)
         .isEquals();
   }
 
@@ -1002,6 +1019,7 @@ public int hashCode() {
         .append(tolerations)
         .append(hostAliases)
         .append(serviceAccountName)
+        .append(automountServiceAccountToken)
         .toHashCode();
   }
 }
