Mitigate automountServiceAccountToken findings in flux-system and bigbang namespaces

General MR

Summary

Closes #1855 and #1856

This MR hardens all ServiceAccounts present in the flux-system namespace, but overrides this behavior at the pod-spec level since Flux requires heavy access to the Kubernetes API.

The changes are made via Kustomize patches in kustomization.yaml (similar to how we patch in container resource constraints) because the gotk-components.yaml is programmatically generated by Flux and cannot be edited.

This MR also hardens the default ServiceAccount in the flux-system and bigbang namespaces via the mutating Kyverno policy named update-automountserviceaccounttokens-default. This is a minute change, since no resources actually utilize those ServiceAccounts, but it removes two Kyverno policy violations.

Upgrade Notices

N/A

added kindenhancement priority7 statusdoing labels

assigned to @justen.mehl

added 1 commit

• c309580f - add hardening and exceptions

Compare with previous version

changed title from Draft: Resolve "Mitigate automountServiceAccountToken findings in Flux namespace" to Draft: Mitigate automountServiceAccountToken findings in flux-system and bigbang namespaces

changed the description

added bigbang flux labels

marked this merge request as ready

added statusreview label and removed statusdoing label

requested review from @ryan.thompson.44, @chris.oconnell, @michaelmartin, and @ryan.j.garcia

@andrewshoell @rgsjustins : You have been tagged in this merge request for the purpose of conducting secondary review.

added 9 commits

• c309580f...d8c8d1e7 - 8 commits from branch master
• 25d3f193 - add hardening and exceptions

Compare with previous version

added 7 commits

• 25d3f193...f5bbde9e - 6 commits from branch master
• a6031ecb - add hardening and exceptions

Compare with previous version

added 9 commits

• a6031ecb...8c60818f - 8 commits from branch master
• 9cb25843 - add hardening and exceptions

Compare with previous version

changed the description

added 19 commits

• 9cb25843...d7e8f95e - 18 commits from branch master
• 1cd528b9 - add hardening and exceptions

Compare with previous version

added 55 commits

• 1cd528b9...071814bc - 54 commits from branch master
• 92c3d1f6 - Merge remote-tracking branch 'origin/master' into 1855-flux-hardening

Compare with previous version

approved this merge request

enabled an automatic merge when the pipeline for 92c3d1f6 succeeds

changed milestone to %2.19.0

merged