feat(fluent-bit): Add automountServiceAccountToken override at pod level

charts/fluent-bit/CHANGELOG.md

@@ -14,6 +14,14 @@
 
 ## [UNRELEASED]
 
+### Changed
+
+- Added support for serviceAccount.automountToken to service account and pod spec. ([#633](https://github.com/fluent/helm-charts/pull/633)) _@gsmith-sas_
+- Added support for automountServiceAccountToken (pod-level override) to pod spec. ([#633](https://github.com/fluent/helm-charts/pull/633)) _@gsmith-sas_
+
+### Deprecated
+
+- Deprecated serviceAccount.automountServiceAccountToken (use serviceAccount.automountToken instead). ([#633](https://github.com/fluent/helm-charts/pull/633)) _@gsmith-sas_
 ## [v0.57.3] - 2026-04-17
 
 ### Changed

charts/fluent-bit/templates/_pod.tpl

@@ -1,8 +1,10 @@
 {{- define "fluent-bit.pod" -}}
-{{- if ne .Values.serviceAccount.automountServiceAccountToken nil }}
+serviceAccountName: {{ include "fluent-bit.serviceAccountName" . }}
+{{- if ne .Values.automountServiceAccountToken nil }}
+automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+{{- else if ne .Values.serviceAccount.automountServiceAccountToken nil }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- end }}
-serviceAccountName: {{ include "fluent-bit.serviceAccountName" . }}
 {{- with .Values.imagePullSecrets }}
 imagePullSecrets:
   {{- toYaml . | nindent 2 }}

charts/fluent-bit/templates/serviceaccount.yaml

@@ -10,7 +10,9 @@ metadata:
   annotations:
     {{- toYaml . | nindent 4 }}
   {{- end }}
-{{- if ne .Values.serviceAccount.automountServiceAccountToken nil }}
+{{- if ne .Values.serviceAccount.automountToken nil }}
+automountServiceAccountToken: {{ .Values.serviceAccount.automountToken }}
+{{- else if ne .Values.serviceAccount.automountServiceAccountToken nil }}
 automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
 {{- end }}
 {{- end -}}

charts/fluent-bit/values.yaml

@@ -31,7 +31,18 @@ serviceAccount:
   create: true
   annotations: {}
   name:
+  # DEPRECATED: use serviceAccount.automountToken instead
   automountServiceAccountToken:
+  # Automatically mount the ServiceAccount token
+  # on *all* pods using this ServiceAccount unless
+  # they explicitly opt out.
+  automountToken:
+
+# Automatically mount the ServiceAccount token
+# on the Fluent Bit pod(s).  NOTE: This setting
+# overrides serviceAccount.automountToken for
+# the Fluent Bit pod(s).
+automountServiceAccountToken:
 
 rbac:
   create: true