Make pod automountServiceAccountToken configurable in the karpenter chart

[yindia]

What problem are you trying to solve?

The controller pod in charts/karpenter hardcodes automountServiceAccountToken: true in the pod spec (charts/karpenter/templates/deployment.yaml):

      automountServiceAccountToken: true
      serviceAccountName: {{ include "karpenter.serviceAccountName" . }}

The ServiceAccount sets automountServiceAccountToken: false (serviceaccount.yaml), but the pod spec re-enables it and there is no chart value to change it.

Clusters that enforce token auto-mount policies — e.g. OPA Gatekeeper K8sPSPAutomountServiceAccountToken, or the Kyverno equivalent — cannot make the Karpenter install compliant through Helm values. Every other relevant Pod Security field (privileged, runAsNonRoot, readOnlyRootFilesystem, dropped capabilities, seccomp, probes, labels) is compliant by default or already configurable; this is the one field with no configuration path. Current workarounds are a namespace-level policy exemption or a post-render patch.

Why the default must stay true

Karpenter uses the in-cluster config to reach the Kubernetes API (pkg/operator/operator.go), so it needs the mounted SA token. IRSA / EKS Pod Identity does not replace it — those cover the AWS API only; the Kubernetes API still needs the SA token. So automountServiceAccountToken must default to true, and setting it false only works if the token is projected back at /var/run/secrets/kubernetes.io/serviceaccount another way.

The chart already supports that path via extraVolumes + controller.extraVolumeMounts (a serviceAccountToken projected volume). This request does not add that wiring; it only exposes the field so operators who project the token themselves — or who need an explicit, documented value to satisfy a policy — can manage it.

Proposed change

Template the field against a new value, defaulting to current behavior:

# deployment.yaml
      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}

# values.yaml
# -- Auto-mount the ServiceAccount token into the controller pod. Karpenter uses
# the in-cluster config to reach the Kubernetes API, so it needs this token; note
# IRSA / EKS Pod Identity does not replace it. Keep this true unless you project
# the token yourself via extraVolumes and controller.extraVolumeMounts.
automountServiceAccountToken: true

No behavior change on a default install. false is an advanced opt-in that requires projecting the token yourself; documented as such. Verified with helm template / helm lint; a PR is ready.

How important is this feature to you?

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment