Add projected SA token volume helpers to serviceaccount package

Add KubeAPIAccessVolume() and KubeAPIAccessVolumeMount() helpers that
create a projected volume replacing the default automounted SA token
with a time-limited one (1h expiry). Use together with
AutomountServiceAccountToken=false on the PodSpec.

This enables operators to harden workloads by disabling the default
long-lived automounted token while still providing K8s API access
via a short-lived projected token at the standard mount path.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: lmiccini

modules/common/serviceaccount/projected_token.go

@@ -0,0 +1,94 @@
+/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serviceaccount
+
+import (
+	corev1 "k8s.io/api/core/v1"
+	"k8s.io/utils/ptr"
+)
+
+const (
+	// KubeAPIAccessVolumeName is the name of the projected volume that
+	// replaces the default automounted service account token.
+	KubeAPIAccessVolumeName = "kube-api-access"
+
+	// KubeAPIAccessMountPath is the standard mount path for the projected
+	// service account token volume, matching the default automount path.
+	KubeAPIAccessMountPath = "/var/run/secrets/kubernetes.io/serviceaccount"
+
+	// DefaultTokenExpirationSeconds is the default expiration for the
+	// projected service account token (1 hour).
+	DefaultTokenExpirationSeconds int64 = 3600
+)
+
+// KubeAPIAccessVolume returns a projected Volume that provides a
+// time-limited service account token, the cluster CA certificate, and
+// the pod namespace.  Use it together with AutomountServiceAccountToken=false
+// on the PodSpec to replace the default long-lived automounted token with a
+// short-lived one.
+func KubeAPIAccessVolume() corev1.Volume {
+	return corev1.Volume{
+		Name: KubeAPIAccessVolumeName,
+		VolumeSource: corev1.VolumeSource{
+			Projected: &corev1.ProjectedVolumeSource{
+				DefaultMode: ptr.To[int32](0o444),
+				Sources: []corev1.VolumeProjection{
+					{
+						ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
+							Path:              "token",
+							ExpirationSeconds: ptr.To(DefaultTokenExpirationSeconds),
+						},
+					},
+					{
+						ConfigMap: &corev1.ConfigMapProjection{
+							LocalObjectReference: corev1.LocalObjectReference{
+								Name: "kube-root-ca.crt",
+							},
+							Items: []corev1.KeyToPath{
+								{
+									Key:  "ca.crt",
+									Path: "ca.crt",
+								},
+							},
+						},
+					},
+					{
+						DownwardAPI: &corev1.DownwardAPIProjection{
+							Items: []corev1.DownwardAPIVolumeFile{
+								{
+									Path: "namespace",
+									FieldRef: &corev1.ObjectFieldSelector{
+										APIVersion: "v1",
+										FieldPath:  "metadata.namespace",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+// KubeAPIAccessVolumeMount returns a read-only VolumeMount for the
+// projected service account token volume at the standard automount path.
+func KubeAPIAccessVolumeMount() corev1.VolumeMount {
+	return corev1.VolumeMount{
+		Name:      KubeAPIAccessVolumeName,
+		MountPath: KubeAPIAccessMountPath,
+		ReadOnly:  true,
+	}
+}

modules/common/serviceaccount/projected_token_test.go

@@ -0,0 +1,58 @@
+/*
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package serviceaccount
+
+import (
+	"testing"
+
+	. "github.com/onsi/gomega" //revive:disable:dot-imports
+)
+
+func TestKubeAPIAccessVolume(t *testing.T) {
+	g := NewWithT(t)
+
+	vol := KubeAPIAccessVolume()
+
+	g.Expect(vol.Name).To(Equal(KubeAPIAccessVolumeName))
+	g.Expect(vol.Projected).NotTo(BeNil())
+	g.Expect(*vol.Projected.DefaultMode).To(Equal(int32(0o444)))
+
+	sources := vol.Projected.Sources
+	g.Expect(sources).To(HaveLen(3))
+
+	g.Expect(sources[0].ServiceAccountToken).NotTo(BeNil())
+	g.Expect(sources[0].ServiceAccountToken.Path).To(Equal("token"))
+	g.Expect(*sources[0].ServiceAccountToken.ExpirationSeconds).To(Equal(DefaultTokenExpirationSeconds))
+
+	g.Expect(sources[1].ConfigMap).NotTo(BeNil())
+	g.Expect(sources[1].ConfigMap.Name).To(Equal("kube-root-ca.crt"))
+	g.Expect(sources[1].ConfigMap.Items).To(HaveLen(1))
+	g.Expect(sources[1].ConfigMap.Items[0].Key).To(Equal("ca.crt"))
+
+	g.Expect(sources[2].DownwardAPI).NotTo(BeNil())
+	g.Expect(sources[2].DownwardAPI.Items).To(HaveLen(1))
+	g.Expect(sources[2].DownwardAPI.Items[0].Path).To(Equal("namespace"))
+	g.Expect(sources[2].DownwardAPI.Items[0].FieldRef.FieldPath).To(Equal("metadata.namespace"))
+}
+
+func TestKubeAPIAccessVolumeMount(t *testing.T) {
+	g := NewWithT(t)
+
+	mount := KubeAPIAccessVolumeMount()
+
+	g.Expect(mount.Name).To(Equal(KubeAPIAccessVolumeName))
+	g.Expect(mount.MountPath).To(Equal(KubeAPIAccessMountPath))
+	g.Expect(mount.ReadOnly).To(BeTrue())
+}