Draft: 1749-automountServiceAccounts-istio: moving values from package to bb...

Package Merge Request

Package Changes

This MR adds default kyverno-policy values for the new update-automountserviceaccounttokens clusterpolicy. This clusterpolicy

This policy contains two rules, one that applies to the serviceaccount to disable automounting the token and another rule that applies to the pod that will override the serviceaccount setting because the pod truly needs access to the API.

(Describe Package changes here)

Package MR

Kyverno Policy

For Issue

Closes

https://repo1.dso.mil/big-bang/product/packages/istio-operator/-/issues/56

https://repo1.dso.mil/big-bang/product/packages/istio-controlplane/-/issues/115

Closes #50 (closed)

chart/templates/kyverno-policies/values.yaml

@@ -597,6 +597,26 @@ policies:
       {{- end }}
   {{- end }}
 
+  update-automountserviceaccounttokens:
+    enabled: true
+    namespaces:
+      - namespace: istio-system
+        serviceAccounts:
+        - istiod
+        - istio-reader-service-account
+        - public-ingressgateway-service-account
+        - passthrough-ingressgateway-service-account 
+        pods:
+        - istiod-*
+        - passthrough-ingressgateway-*
+        - public-ingressgateway-*
+      - namespace: istio-operator
+        serviceAccounts:
+        - istio-operator
+        pods:
+        - istio-operator-*
+
+
 {{- end }}
 
 {{- /* This function merges defaults in lists from above into overlays */ -}}