Projected Service Account Token#

Kyverno's Helm chart supports disabling the default Kubernetes automatic service account token mounting (automountServiceAccountToken: false) across all four controllers — admission, background, cleanup, and reports — and substitutes a Kubernetes projected volume that provides a time-limited, audience-bound token in its place. This was introduced in PR #14766 and closes issue #8184.

Why It Exists#

Kubernetes automatically mounts a long-lived service account token secret into every pod unless the feature is disabled. Projected tokens are preferable because:

• They have configurable TTLs (the kubelet rotates them before expiry).
• They can be scoped to a specific audience, so a leaked token cannot be replayed against an unintended service.
• Disabling automounting entirely shrinks the attack surface when the controller manages its own token volume.

How It Works#

Each controller's ServiceAccount resource unconditionally sets automountServiceAccountToken: false at the object level 1. This prevents Kubernetes from auto-mounting the legacy secret-based token.

Each Deployment then uses a Helm template variable to drive conditional behavior 2:

{{- $automountSAToken := .Values.admissionController.rbac.serviceAccount.automountServiceAccountToken }}

The variable is written to spec.automountServiceAccountToken on the pod spec 3. When it is false, an additional serviceaccount-token projected volume is rendered 4 with three sources:

This volume is mounted at /var/run/secrets/kubernetes.io/serviceaccount 5 — the same path used by legacy auto-mounted tokens — so all Go client code that reads from InClusterConfig() continues to work without modification 6.

The same pattern is implemented identically across all four controllers:

• Admission controller: 4
• Background controller: 7
• Cleanup controller: 8
• Reports controller: 9

apiCallToken — A Separate Scoped Token#

All controllers also mount a second projected volume (apicall-token) at /var/run/secrets/kyverno/apicall. This is separate from the service-account token and is injected into outbound APICall and CEL HTTP requests 10. It carries a custom audience (kyverno-svc.kyverno.io by default) so that if the token is leaked to an external service it cannot be replayed against the Kubernetes API server 11.

Configuration Reference#

All values live under <controller>.rbac.serviceAccount in charts/kyverno/values.yaml.

The same projectedServiceAccountToken.* sub-keys apply for backgroundController, cleanupController, and reportsController 12.

Note: automountServiceAccountToken defaults to true in values.yaml 13, meaning the projected fallback volume is not rendered unless you opt in by setting the value to false.

Key Files#