Disable service account token mounting in test pods

[kstrenkova]

Set AutomountServiceAccountToken to false unconditionally in test pod spec. Test pods that need cluster access authenticate with a kubeconfig mounted via spec.kubeconfigSecretName, not the service account token. No test framework uses in-cluster credentials.

This change reduces attack surface and follows Jobs-to-Pods migration that eliminated ServiceAccount usage.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kstrenkova

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [kstrenkova]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: b82f2646-241e-46f0-9e11-2fc0711dd8e0

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: 2165ad79-8eae-4167-9162-53b72d465047

📥 Commits

Reviewing files that changed from the base of the PR and between 6fd3caa and 73971d8.

📒 Files selected for processing (12)

• api/bases/test.openstack.org_ansibletests.yaml
• api/bases/test.openstack.org_horizontests.yaml
• api/bases/test.openstack.org_tempests.yaml
• api/bases/test.openstack.org_tobikoes.yaml
• api/v1beta1/common.go
• api/v1beta1/common_webhook.go
• config/crd/bases/test.openstack.org_ansibletests.yaml
• config/crd/bases/test.openstack.org_horizontests.yaml
• config/crd/bases/test.openstack.org_tempests.yaml
• config/crd/bases/test.openstack.org_tobikoes.yaml
• config/manifests/bases/test-operator.clusterserviceversion.yaml
• internal/util/common.go

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• Security

  • Test pods now have service-account token automounting disabled in all modes, including privileged mode.

• Documentation

  • Updated privileged-mode descriptions and warnings to accurately reflect pod security settings across supported test resources.
  • Clarified that privileged pods retain the required networking capabilities and default capabilities without automatically mounting service-account tokens.

Walkthrough

BuildTestPod now disables service-account token automounting for every pod. Privileged-mode descriptions and warnings no longer document token automounting as an enabled setting.

Changes

Privileged pod token handling

Layer / File(s)	Summary
Disable service-account token automounting internal/util/common.go	BuildTestPod sets AutomountServiceAccountToken to false for all pods.
Synchronize privileged-mode descriptions api/v1beta1/common.go, api/v1beta1/common_webhook.go, api/bases/*, config/crd/bases/*, config/manifests/bases/test-operator.clusterserviceversion.yaml	Privileged-mode documentation removes the previous automountServiceAccountToken: true statement and retains the other documented pod settings.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 73971

Test pods will no longer mount service-account tokens, reducing unnecessary Kubernetes access without identified functional impact. The change is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 3 files. (9 skipped: 9 …
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the change to disable service account token mounting in test pods.
Description check	✅ Passed	The description explains the unconditional setting, how test pods authenticate, and the security rationale.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[centosinfra-prod-github-app]

Build failed (check pipeline). Post recheck (without leading slash)
to rerun all jobs. Make sure the failure cause has been resolved before
you rerun jobs.

https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/1e5a1cb3914947088ce963076c56ace6

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 40m 56s
✔️ test-operator-kuttl SUCCESS in 36m 00s
❌ podified-multinode-edpm-deployment-crc-test-operator FAILURE in 2h 31m 19s
✔️ tempest-s2i-content-provider SUCCESS in 4h 15m 59s (non-voting)
✔️ test-operator-kuttl-s2i SUCCESS in 38m 41s (non-voting)
❌ tempest-s2i-tempest FAILURE in 2h 25m 56s (non-voting)

[kstrenkova]

recheck

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/d6b9be97f9a6416cb3595f7b0800bd15

✔️ openstack-k8s-operators-content-provider SUCCESS in 6h 59m 18s
✔️ test-operator-kuttl SUCCESS in 39m 59s
✔️ podified-multinode-edpm-deployment-crc-test-operator SUCCESS in 2h 36m 33s
✔️ tempest-s2i-content-provider SUCCESS in 7h 25m 51s (non-voting)
✔️ test-operator-kuttl-s2i SUCCESS in 39m 53s (non-voting)
✔️ tempest-s2i-tempest SUCCESS in 2h 14m 50s (non-voting)

[centosinfra-prod-github-app]

Build succeeded (check pipeline).
https://gateway-cloud-softwarefactory.apps.ocp.cloud.ci.centos.org/zuul/t/rdoproject.org/buildset/dcbeb22fdb534cda8eb21a301f9b5458

✔️ openstack-k8s-operators-content-provider SUCCESS in 3h 41m 25s
✔️ test-operator-kuttl SUCCESS in 38m 06s
✔️ podified-multinode-edpm-deployment-crc-test-operator SUCCESS in 2h 25m 55s
✔️ test-operator-s2i-content-provider SUCCESS in 5h 26m 05s (non-voting)
✔️ test-operator-kuttl-s2i SUCCESS in 38m 33s (non-voting)
✔️ test-operator-s2i-test SUCCESS in 2h 41m 57s (non-voting)