fix(deploy) rework serviceaccount token

config/base/kong-ingress-dbless.yaml

@@ -30,12 +30,8 @@ spec:
             path: token
           - key: ca.crt
             path: ca.crt
-      - name: podinfo
-        downwardAPI:
-          items:
-          - path: "namespace"
-            fieldRef:
-              fieldPath: metadata.namespace
+          - key: namespace
+            path: namespace
       containers:
       - name: proxy
         image: kong-placeholder:placeholder # This is replaced by the config/image.yaml component
@@ -149,15 +145,6 @@ spec:
           failureThreshold: 3
         volumeMounts:
         - name: kong-serviceaccount-token
-          mountPath: /var/run/secrets/kubernetes.io/serviceaccount/token
-          subPath: token
-          readOnly: true
-        - name: kong-serviceaccount-token
-          mountPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          subPath: ca.crt
-          readOnly: true
-        - name: podinfo
-          mountPath: /var/run/secrets/kubernetes.io/serviceaccount/namespace
-          subPath: namespace
+          mountPath: /var/run/secrets/kubernetes.io/serviceaccount
           readOnly: true
 

deploy/single/all-in-one-dbless-k4k8s-enterprise.yaml

@@ -1571,18 +1571,9 @@ spec:
           successThreshold: 1
           timeoutSeconds: 1
         volumeMounts:
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/token
+        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
           name: kong-serviceaccount-token
           readOnly: true
-          subPath: token
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          name: kong-serviceaccount-token
-          readOnly: true
-          subPath: ca.crt
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/namespace
-          name: podinfo
-          readOnly: true
-          subPath: namespace
       imagePullSecrets:
       - name: kong-enterprise-edition-docker
       serviceAccountName: kong-serviceaccount
@@ -1594,13 +1585,9 @@ spec:
             path: token
           - key: ca.crt
             path: ca.crt
-          secretName: kong-serviceaccount-token
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.namespace
+          - key: namespace
             path: namespace
-        name: podinfo
+          secretName: kong-serviceaccount-token
 ---
 apiVersion: networking.k8s.io/v1
 kind: IngressClass

deploy/single/all-in-one-dbless.yaml

@@ -1566,18 +1566,9 @@ spec:
           successThreshold: 1
           timeoutSeconds: 1
         volumeMounts:
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/token
+        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
           name: kong-serviceaccount-token
           readOnly: true
-          subPath: token
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          name: kong-serviceaccount-token
-          readOnly: true
-          subPath: ca.crt
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/namespace
-          name: podinfo
-          readOnly: true
-          subPath: namespace
       serviceAccountName: kong-serviceaccount
       volumes:
       - name: kong-serviceaccount-token
@@ -1587,13 +1578,9 @@ spec:
             path: token
           - key: ca.crt
             path: ca.crt
-          secretName: kong-serviceaccount-token
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.namespace
+          - key: namespace
             path: namespace
-        name: podinfo
+          secretName: kong-serviceaccount-token
 ---
 apiVersion: networking.k8s.io/v1
 kind: IngressClass

deploy/single/all-in-one-postgres-enterprise.yaml

@@ -1640,18 +1640,9 @@ spec:
           successThreshold: 1
           timeoutSeconds: 1
         volumeMounts:
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/token
+        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
           name: kong-serviceaccount-token
           readOnly: true
-          subPath: token
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          name: kong-serviceaccount-token
-          readOnly: true
-          subPath: ca.crt
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/namespace
-          name: podinfo
-          readOnly: true
-          subPath: namespace
       imagePullSecrets:
       - name: kong-enterprise-edition-docker
       initContainers:
@@ -1681,13 +1672,9 @@ spec:
             path: token
           - key: ca.crt
             path: ca.crt
-          secretName: kong-serviceaccount-token
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.namespace
+          - key: namespace
             path: namespace
-        name: podinfo
+          secretName: kong-serviceaccount-token
 ---
 apiVersion: apps/v1
 kind: StatefulSet

deploy/single/all-in-one-postgres.yaml

@@ -1584,18 +1584,9 @@ spec:
           successThreshold: 1
           timeoutSeconds: 1
         volumeMounts:
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/token
+        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
           name: kong-serviceaccount-token
           readOnly: true
-          subPath: token
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
-          name: kong-serviceaccount-token
-          readOnly: true
-          subPath: ca.crt
-        - mountPath: /var/run/secrets/kubernetes.io/serviceaccount/namespace
-          name: podinfo
-          readOnly: true
-          subPath: namespace
       initContainers:
       - command:
         - /bin/sh
@@ -1618,13 +1609,9 @@ spec:
             path: token
           - key: ca.crt
             path: ca.crt
-          secretName: kong-serviceaccount-token
-      - downwardAPI:
-          items:
-          - fieldRef:
-              fieldPath: metadata.namespace
+          - key: namespace
             path: namespace
-        name: podinfo
+          secretName: kong-serviceaccount-token
 ---
 apiVersion: apps/v1
 kind: StatefulSet