Allow configuring AutomountServiceAccountToken for DevicePlugin

yevgeny-shnaidman · ybettan · commit 2ff4d634323f · 2026-02-16T16:31:03.000+02:00
AutomountServiceAccountToken is used to disable the auto-mounting of the projected volume
into device plugin pod. This volume includes as files: SA token, CAs' file etc'.
K8s automatically mounts the SA token, root CAs into the
/var/run/secrets/kubernetes.io/serviceaccount using projected volumes.As
a result, mounting/overriding additional files into that directory is not allowed.
setting AutomountServiceAccountToken to false, will disale auto-mounting, and will allow user to mount
whatever configmaps and tokens he deems necessary for the device plugin application.
diff --git a/api/v1beta1/module_types.go b/api/v1beta1/module_types.go
@@ -313,6 +313,12 @@ type DevicePluginSpec struct {
 	ServiceAccountName string `json:"serviceAccountName,omitempty"`
 
 	Volumes []v1.Volume `json:"volumes,omitempty"`
+
+	// AutomountServiceAccountToken is used to disable the auto-mounting of the projected volume
+	// into device plugin pod. This volume includes as files: SA token, CAs' file etc'
+	// setting AutomountServiceAccountToken to false, will disale auto-mounting, and will allow user to mount
+	// whatever configmaps and tokens he deems necessary for the device plugin application
+	AutomountServiceAccountToken *bool `json:"automountServiceAccountToken,omitempty"`
 }
 
 // ModuleSpec describes how the KMM operator should deploy a Module on those nodes that need it.
diff --git a/api/v1beta1/zz_generated.deepcopy.go b/api/v1beta1/zz_generated.deepcopy.go
diff --git a/bundle-hub/manifests/hub.kmm.sigs.x-k8s.io_managedclustermodules.yaml b/bundle-hub/manifests/hub.kmm.sigs.x-k8s.io_managedclustermodules.yaml
@@ -53,6 +53,13 @@ spec:
                       DevicePlugin allows overriding some properties of the container that deploys the device plugin on the node.
                       Name is ignored and is set automatically by the KMM Operator.
                     properties:
+                      automountServiceAccountToken:
+                        description: |-
+                          AutomountServiceAccountToken is used to disable the auto-mounting of the projected volume
+                          into device plugin pod. This volume includes as files: SA token, CAs' file etc'
+                          setting AutomountServiceAccountToken to false, will disale auto-mounting, and will allow user to mount
+                          whatever configmaps and tokens he deems necessary for the device plugin application
+                        type: boolean
                       container:
                         properties:
                           args:
diff --git a/bundle-hub/manifests/kernel-module-management-hub.clusterserviceversion.yaml b/bundle-hub/manifests/kernel-module-management-hub.clusterserviceversion.yaml
@@ -37,7 +37,7 @@ metadata:
         }
       ]
     capabilities: Seamless Upgrades
-    createdAt: "2026-02-10T11:50:11Z"
+    createdAt: "2026-02-15T12:41:06Z"
     operatorframework.io/suggested-namespace: openshift-kmm-hub
     operators.operatorframework.io/builder: operator-sdk-v1.41.1
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
diff --git a/bundle/manifests/kernel-module-management.clusterserviceversion.yaml b/bundle/manifests/kernel-module-management.clusterserviceversion.yaml
@@ -47,7 +47,7 @@ metadata:
         }
       ]
     capabilities: Seamless Upgrades
-    createdAt: "2026-02-10T11:50:10Z"
+    createdAt: "2026-02-15T12:40:55Z"
     operatorframework.io/suggested-namespace: openshift-kmm
     operators.operatorframework.io/builder: operator-sdk-v1.41.1
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
diff --git a/bundle/manifests/kmm.sigs.x-k8s.io_modules.yaml b/bundle/manifests/kmm.sigs.x-k8s.io_modules.yaml
@@ -49,6 +49,13 @@ spec:
                   DevicePlugin allows overriding some properties of the container that deploys the device plugin on the node.
                   Name is ignored and is set automatically by the KMM Operator.
                 properties:
+                  automountServiceAccountToken:
+                    description: |-
+                      AutomountServiceAccountToken is used to disable the auto-mounting of the projected volume
+                      into device plugin pod. This volume includes as files: SA token, CAs' file etc'
+                      setting AutomountServiceAccountToken to false, will disale auto-mounting, and will allow user to mount
+                      whatever configmaps and tokens he deems necessary for the device plugin application
+                    type: boolean
                   container:
                     properties:
                       args:
diff --git a/config/crd-hub/bases/hub.kmm.sigs.x-k8s.io_managedclustermodules.yaml b/config/crd-hub/bases/hub.kmm.sigs.x-k8s.io_managedclustermodules.yaml
@@ -49,6 +49,13 @@ spec:
                       DevicePlugin allows overriding some properties of the container that deploys the device plugin on the node.
                       Name is ignored and is set automatically by the KMM Operator.
                     properties:
+                      automountServiceAccountToken:
+                        description: |-
+                          AutomountServiceAccountToken is used to disable the auto-mounting of the projected volume
+                          into device plugin pod. This volume includes as files: SA token, CAs' file etc'
+                          setting AutomountServiceAccountToken to false, will disale auto-mounting, and will allow user to mount
+                          whatever configmaps and tokens he deems necessary for the device plugin application
+                        type: boolean
                       container:
                         properties:
                           args:
diff --git a/config/crd-hub/bases/kmm.sigs.x-k8s.io_modules.yaml b/config/crd-hub/bases/kmm.sigs.x-k8s.io_modules.yaml
@@ -45,6 +45,13 @@ spec:
                   DevicePlugin allows overriding some properties of the container that deploys the device plugin on the node.
                   Name is ignored and is set automatically by the KMM Operator.
                 properties:
+                  automountServiceAccountToken:
+                    description: |-
+                      AutomountServiceAccountToken is used to disable the auto-mounting of the projected volume
+                      into device plugin pod. This volume includes as files: SA token, CAs' file etc'
+                      setting AutomountServiceAccountToken to false, will disale auto-mounting, and will allow user to mount
+                      whatever configmaps and tokens he deems necessary for the device plugin application
+                    type: boolean
                   container:
                     properties:
                       args:
diff --git a/config/crd/bases/kmm.sigs.x-k8s.io_modules.yaml b/config/crd/bases/kmm.sigs.x-k8s.io_modules.yaml
@@ -45,6 +45,13 @@ spec:
                   DevicePlugin allows overriding some properties of the container that deploys the device plugin on the node.
                   Name is ignored and is set automatically by the KMM Operator.
                 properties:
+                  automountServiceAccountToken:
+                    description: |-
+                      AutomountServiceAccountToken is used to disable the auto-mounting of the projected volume
+                      into device plugin pod. This volume includes as files: SA token, CAs' file etc'
+                      setting AutomountServiceAccountToken to false, will disale auto-mounting, and will allow user to mount
+                      whatever configmaps and tokens he deems necessary for the device plugin application
+                    type: boolean
                   container:
                     properties:
                       args:
diff --git a/internal/controllers/device_plugin_reconciler.go b/internal/controllers/device_plugin_reconciler.go
@@ -376,14 +376,15 @@ func (dsci *daemonSetCreatorImpl) setDevicePluginAsDesired(
 				Finalizers: []string{constants.NodeLabelerFinalizer},
 			},
 			Spec: v1.PodSpec{
-				InitContainers:     generatePodContainerSpec(mod.Spec.DevicePlugin.InitContainer, "device-plugin-init", nil),
-				Containers:         generatePodContainerSpec(&mod.Spec.DevicePlugin.Container, "device-plugin", containerVolumeMounts),
-				PriorityClassName:  "system-node-critical",
-				ImagePullSecrets:   getPodPullSecrets(mod.Spec.ImageRepoSecret),
-				NodeSelector:       nodeSelector,
-				ServiceAccountName: serviceAccountName,
-				Volumes:            append([]v1.Volume{devicePluginVolume}, mod.Spec.DevicePlugin.Volumes...),
-				Tolerations:        mod.Spec.Tolerations,
+				InitContainers:               generatePodContainerSpec(mod.Spec.DevicePlugin.InitContainer, "device-plugin-init", nil),
+				Containers:                   generatePodContainerSpec(&mod.Spec.DevicePlugin.Container, "device-plugin", containerVolumeMounts),
+				PriorityClassName:            "system-node-critical",
+				ImagePullSecrets:             getPodPullSecrets(mod.Spec.ImageRepoSecret),
+				NodeSelector:                 nodeSelector,
+				ServiceAccountName:           serviceAccountName,
+				Volumes:                      append([]v1.Volume{devicePluginVolume}, mod.Spec.DevicePlugin.Volumes...),
+				Tolerations:                  mod.Spec.Tolerations,
+				AutomountServiceAccountToken: mod.Spec.DevicePlugin.AutomountServiceAccountToken,
 			},
 		},
 	}
diff --git a/internal/controllers/device_plugin_reconciler_test.go b/internal/controllers/device_plugin_reconciler_test.go
@@ -734,8 +734,9 @@ var _ = Describe("DevicePluginReconciler_setDevicePluginAsDesired", func() {
 							Resources:       resources,
 							VolumeMounts:    []v1.VolumeMount{dpVolMount},
 						},
-						ServiceAccountName: serviceAccountName,
-						Volumes:            []v1.Volume{dpVol},
+						ServiceAccountName:           serviceAccountName,
+						Volumes:                      []v1.Volume{dpVol},
+						AutomountServiceAccountToken: ptr.To(false),
 					},
 					ImageRepoSecret: &repoSecret,
 					Selector:        map[string]string{"has-feature-x": "true"},
@@ -837,7 +838,8 @@ var _ = Describe("DevicePluginReconciler_setDevicePluginAsDesired", func() {
 								},
 								dpVol,
 							},
-							Tolerations: []v1.Toleration{testToleration},
+							Tolerations:                  []v1.Toleration{testToleration},
+							AutomountServiceAccountToken: ptr.To(false),
 						},
 					},
 				},

Original file line number	Diff line number	Diff line change
`@@ -37,7 +37,7 @@ metadata:`
`37`	`37`	`}`
`38`	`38`	`]`
`39`	`39`	`capabilities: Seamless Upgrades`
`40`		`- createdAt: "2026-02-10T11:50:11Z"`
	`40`	`+ createdAt: "2026-02-15T12:41:06Z"`
`41`	`41`	`operatorframework.io/suggested-namespace: openshift-kmm-hub`
`42`	`42`	`operators.operatorframework.io/builder: operator-sdk-v1.41.1`
`43`	`43`	`operators.operatorframework.io/project_layout: go.kubebuilder.io/v4`
Original file line number	Diff line number	Diff line change
`@@ -47,7 +47,7 @@ metadata:`
`47`	`47`	`}`
`48`	`48`	`]`
`49`	`49`	`capabilities: Seamless Upgrades`
`50`		`- createdAt: "2026-02-10T11:50:10Z"`
	`50`	`+ createdAt: "2026-02-15T12:40:55Z"`
`51`	`51`	`operatorframework.io/suggested-namespace: openshift-kmm`
`52`	`52`	`operators.operatorframework.io/builder: operator-sdk-v1.41.1`
`53`	`53`	`operators.operatorframework.io/project_layout: go.kubebuilder.io/v4`