Discussion around removal the Kyverno Policy for automountServiceAccountToken

[cmwylie19]

Hi all 👋,

Discussion - There was recently an issue opened on Pepr around adding sane security defaults to the Kubernetes manifests that Pepr generates. In part, this is because it is a best practice and the secure thing to do, and in part to pass the Kyverno policies used in dubbd. After deliberation we decided to exclude the bit around automountServiceAccountToken, but, this creates a flag in the Kyverno policy disallow-auto-mount-service-account-token.

The purpose of this issue to is open up a dialog to see if it makes sense to keep this policy in DUBBD as it creates overhead for engineers to have to go in and customize policies.

[RothAndrew]

it creates overhead for engineers to have to go in and customize policies.

More importantly, it creates divergence from baseline DUBBD, which as an objective I think is something we want to avoid when possible.