Allow Keda to request SA tokens (#728)

* Allow Keda to request SA tokens

Signed-off-by: Bojan Zelic <bnzelic@gmail.com>

* Allow Keda to request SA tokens

Signed-off-by: Bojan Zelic <bnzelic@gmail.com>

* Allow Keda to request SA tokens

Signed-off-by: Bojan Zelic <bnzelic@gmail.com>

---------

Signed-off-by: Bojan Zelic <bnzelic@gmail.com>

keda/README.md

@@ -145,6 +145,7 @@ their default values.
 | `operator.revisionHistoryLimit` | int | `10` | ReplicaSets for this Deployment you want to retain (Default: 10) |
 | `permissions.operator.restrict.namesAllowList` | list | `[]` | Array of strings denoting what secrets the KEDA operator will be able to read, this takes into account also the configured `watchNamespace`. the default is an empty array -> no restriction on the secret name |
 | `permissions.operator.restrict.secret` | bool | `false` | Restrict Secret Access for KEDA operator if true, KEDA operator will be able to read only secrets in {{ .Release.Namespace }} namespace |
+| `permissions.operator.restrict.allowAllServiceAccountTokenCreation` | bool | `false` | Restrict Service Account Token Creation Access for KEDA operator |
 | `permissions.operator.restrict.serviceAccountTokenCreationRoles` | list | `[]` | Creates roles and rolebindings from namespaced service accounts in the array which allow the KEDA operator to request service account tokens for use with the boundServiceAccountToken trigger source. If the namespace does not exist, this will cause the helm chart installation to fail. |
 | `podAnnotations.keda` | object | `{}` | Pod annotations for KEDA operator |
 | `podDisruptionBudget.operator` | object | `{}` | Capability to configure [Pod Disruption Budget] |

keda/templates/manager/clusterrole.yaml

@@ -24,6 +24,14 @@ rules:
   - get
   - list
   - watch
+{{- if eq .Values.permissions.operator.restrict.allowAllServiceAccountTokenCreation true }}
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
+{{- end }}
 - apiGroups:
   - ""
   resources:

keda/values.yaml

@@ -872,6 +872,8 @@ permissions:
       serviceAccountTokenCreationRoles: []
       # - name: myServiceAccount
       #   namespace: myServiceAccountNamespace
+      # -- Allow Keda to access all Service Token for KEDA operator
+      allowAllServiceAccountTokenCreation: false
 
 # -- Array of extra K8s manifests to deploy
 extraObjects: []