Resolve "Mitigate automountServiceAccountToken findings in promtail"

General MR

Mitigate automountServiceAccountToken findings in promtail

Summary

Automounting of service account token presents a risk to the cluster. This MR seeks to remedy this by disabling automounting on the service account while ignoring the finding on the pod to allow full functionality.

Closes https://repo1.dso.mil/big-bang/bigbang/-/issues/1831

added kindenhancement priority7 statusdoing labels

assigned to @samvongsay

added 3 commits

• 0213e9b2 - fortify update to 1.1.2311007-bb.7
• d62118c5 - gitlabRunner update to 0.58.1-bb.0
• 5b4ce4c0 - gitlab update to 7.5.1-bb.1

Compare with previous version

added 6 commits

• cbc56c34 - kiali update to 1.76.0-bb.3
• 49fd591f - kyverno update to 3.0.0-bb.12
• 63a16719 - harbor update to 1.13.1-bb.2
• 705ef07c - loki update to 5.31.0-bb.7
• 66c0087d - vault update to 0.25.0-bb.5
• 4ee50b4e - promtail update to 6.15.3-bb.1

Compare with previous version

added 57 commits

• 4ee50b4e...ca934c2c - 56 commits from branch master
• d3c51be1 - Merge branch 'master' into '1831-mitigate-automountSAT-promtail'

Compare with previous version

marked this merge request as ready

added statusreview label and removed statusdoing label

requested review from @michaelmartin, @chris.oconnell, @ryan.j.garcia, and @ryan.thompson.44

@rgsjustins @andrewshoell : You have been tagged in this merge request for the purpose of conducting secondary review.

lgtm, this worked. You are probably already aware, but we are seeing similar issues with Kiali.

approved this merge request

Going to put this on hold for a bit and resume the review after this MR gets merged so multiple changes won't have to happen.

added statusdoing label and removed statusreview label

added 46 commits

• d3c51be1...5ff70e33 - 36 earlier commits
• e9775234 - SKIP UPGRADE kyvernoPolicies update to 3.0.4-bb.15
• ebb9a8b1 - gitlab update to 7.6.0-bb.0
• 149613f1 - Velero: disabled automountserviceaccounttoken in the velero namespace
• 70c72694 - anchore update to 1.27.4-bb.5
• 9d7b416d - mattermost update to v9.2.3-bb.0
• c6d67ffe - feat: re-enable `require-image-signature` policy
• bb06aabb - monitoring update to 55.0.0-bb.1
• db264399 - Neuvector: disabled automountserviceaccounttoken in the neuvector namespace
• 5b697097 - loki update to 5.31.0-bb.7
• b7e42328 - Add promtail default SA to exception

Compare with previous version

added 4 commits

• a160ee74 - Resolve merge conflict
• 388d3511 - loki update to 5.31.0-bb.7
• 6accb464 - loki update to 5.31.0-bb.7
• 688589cb - Add promtail default SA to exception

Compare with previous version

added 92 commits

• 688589cb...1e8e0cb8 - 88 commits from branch master
• d691f688 - Harden automountServiceAccountToken findings in Twistlock
• bbfd0440 - loki update to 5.31.0-bb.7
• 2d5a9a75 - loki update to 5.31.0-bb.7
• cf1b499c - loki update to 5.31.0-bb.7

Compare with previous version

added 1 commit

• a0e9cd66 - Add promtail to SA Token exception

Compare with previous version

added 12 commits

• a0e9cd66...cdf4f318 - 10 commits from branch master
• 5cc447b2 - Harden automountServiceAccountToken findings in Twistlock
• 2fdf18ed - Add promtail to SA Token exception

Compare with previous version

added 1 commit

• 65c3a039 - Allow promtail pod SA Token

Compare with previous version

added 6 commits

• 65c3a039...da73a539 - 4 commits from branch master
• 80198e9b - Add promtail to SA Token exception
• 77c2b500 - Allow promtail pod SA Token

Compare with previous version

added 6 commits

• 77c2b500...9012e31e - 4 commits from branch master
• eae33645 - Add promtail to SA Token exception
• 9a7df0ef - Allow promtail pod SA Token

Compare with previous version

added 6 commits

• 9a7df0ef...94103278 - 4 commits from branch master
• 7655b8bf - Add promtail to SA Token exception
• 4c0033aa - Allow promtail pod SA Token

Compare with previous version

This MR is ready to be merged. Fixed all merge conflicts and switched to new method to handle default SA in the respective namespaces.

added 45 commits

• 4c0033aa...ddf23e20 - 42 commits from branch master
• afc83c56 - Add promtail to SA Token exception
• ea9040b7 - Allow promtail pod SA Token
• d3a69046 - Disable SA mount

Compare with previous version

added 11 commits

• d3a69046...eabbc458 - 8 commits from branch master
• cad7b5ad - Add promtail to SA Token exception
• d3f773a4 - Allow promtail pod SA Token
• b19d6e96 - Disable SA mount

Compare with previous version

removed statusdoing label

added statusreview label

changed milestone to %2.18.0

added 1 commit

• ec054ca8 - restore spacing

Compare with previous version

changed the description

approved this merge request

resolved all threads

enabled an automatic merge when the pipeline for ec054ca8 succeeds

merged

mentioned in commit bc3beec4