add bound serviceaccount token to machine-controller
@@ -556,6 +556,21 @@ func newPodTemplateSpec(config *OperatorConfig, features map[string]bool) *corev
},
},
},
+ {
+ Name: "bound-sa-token",
+ VolumeSource: corev1.VolumeSource{
+ Projected: &corev1.ProjectedVolumeSource{
+ Sources: []corev1.VolumeProjection{
+ {
+ ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
+ Audience: "openshift",
+ Path: "token",
+ },
+ },
+ },
+ },
+ },
+ },
}
volumes = append(volumes, newRBACConfigVolumes()...)
@@ -675,6 +690,11 @@ func newContainers(config *OperatorConfig, features map[string]bool) []corev1.Co
Name: "trusted-ca",
ReadOnly: true,
},
+ {
+ MountPath: "/var/run/secrets/openshift/serviceaccount",
+ Name: "bound-sa-token",
+ ReadOnly: true,
+ },
},
},
{
