allow to turn off automount on SA

library/common-test/tests/serviceAccount/serviceAccount_test.yaml

@@ -40,6 +40,24 @@ tests:
       - equal:
           path: metadata.name
           value: RELEASE-NAME-common-test
+      - equal:
+          path: automountServiceAccountToken
+          value: true
+
+  - it: should pass with service account enabled
+    documentIndex: *serviceAccountDoc
+    set:
+      serviceAccount:
+        main:
+          enabled: true
+          automountServiceAccountToken: false
+    asserts:
+      - equal:
+          path: metadata.name
+          value: RELEASE-NAME-common-test
+      - equal:
+          path: automountServiceAccountToken
+          value: false
 
   - it: should pass with primary service account enabled and nameOverride defined
     documentIndex: *serviceAccountDoc

library/common/1.0.0/templates/class/_serviceAccount.tpl

@@ -3,6 +3,13 @@
 {{- define "ix.v1.common.class.serviceAccount" -}}
   {{- $saValues := .serviceAccount -}}
   {{- $root := .root -}}
+  {{- if hasKey $saValues "automountServiceAccountToken" -}}
+    {{- if not (kindIs "bool" $saValues.automountServiceAccountToken) -}}
+      {{- fail (printf "<automountServiceAccountToken> value (%s) must be boolean" $saValues.automountServiceAccountToken ) -}}
+    {{- end -}}
+  {{- else -}}
+    {{- $_ := set $saValues "automountServiceAccountToken" true -}}
+  {{- end -}}
 
   {{- $saName := include "ix.v1.common.names.serviceAccount" (dict "root" $root "saValues" $saValues) }}
 ---
@@ -19,5 +26,6 @@ metadata:
   {{- with (include "ix.v1.common.util.annotations.render" (dict "root" $root "annotations" $annotations) | trim) }}
   annotations:
     {{- . | nindent 4 }}
-  {{- end -}}
+  {{- end }}
+automountServiceAccountToken: {{ $saValues.automountServiceAccountToken }}
 {{- end }}