The Helm chart preserves existing security settings by default. To opt in to container hardening, use the following values and verify them against your operator image and admission policies:

controllerManager:
  podSecurityContext:
    runAsNonRoot: true
    # UID/GID for the chart default image streamnative/function-mesh:v0.29.0.
    # Verify these IDs before using a different image.
    runAsUser: 10000
    runAsGroup: 10001
    seccompProfile:
      type: RuntimeDefault
  securityContext:
    allowPrivilegeEscalation: false
    readOnlyRootFilesystem: true
    capabilities:
      drop: [ALL]

These settings affect only the controller manager, not Function, Source or Sink pods. The chart default image declares USER pulsar. With only runAsNonRoot: true, kubelet cannot verify that this non-numeric image user is non-root and refuses to start the container. Set an image-appropriate numeric runAsUser, as shown above. Do not assume every operator image uses the same UID/GID; these values are opt-in, not new chart defaults.

controllerManager.automountServiceAccountToken optionally sets the field on the chart-managed ServiceAccount; its default null omits the field. It has no effect on externally managed ServiceAccounts when rbac.create: false. The controller needs Kubernetes API credentials for reconciliation and leader election. Setting this value to false alone breaks the default in-cluster authentication for new pods. Prefer a narrowly scoped policy exception when token access is required; this setting does not provision alternative credentials.

The operator serves HTTPS metrics with Kubernetes authentication and authorization. The chart grants its ServiceAccount create on tokenreviews.authentication.k8s.io and subjectaccessreviews.authorization.k8s.io so it can validate scrape requests. When rbac.create: false, include these permissions in the externally managed ClusterRole and bind it to the operator ServiceAccount. Missing permissions cause authenticated scrapes to return HTTP 500.

The scraping client (for example, Prometheus) separately needs a ClusterRole with:

rules:
  - nonResourceURLs: ["/metrics"]
    verbs: ["get"]

Bind that role to the actual scraping ServiceAccount using a ClusterRoleBinding and configure the client to send its bearer token over HTTPS with the appropriate TLS trust configuration. The chart does not grant metrics access to arbitrary clients. Requests without a bearer token return HTTP 401; authenticated clients without permission return HTTP 403; authorized requests return HTTP 200. The current controller-runtime filter reports authentication errors, including invalid bearer token errors, as HTTP 500; check the operator logs to distinguish these from missing RBAC permissions.

Function Mesh does not create runtime ServiceAccounts. A user-managed account with automountServiceAccountToken: false disables automatic mounting but still allows explicit projected tokens. No additional CRD field is required.

For a ServiceAccount named pulsar-sink-job-sac in the Sink namespace, merge the following fields into the existing Sink spec. Preserve any existing volumes and volume mounts. This example supplies the standard Kubernetes in-cluster client paths:

spec:
  pod:
    serviceAccountName: pulsar-sink-job-sac
    volumes:
      - name: explicit-kube-api-access
        projected:
          sources:
            - serviceAccountToken:
                path: token
                expirationSeconds: 3600
            - configMap:
                name: kube-root-ca.crt
                items:
                  - key: ca.crt
                    path: ca.crt
            - downwardAPI:
                items:
                  - path: namespace
                    fieldRef:
                      fieldPath: metadata.namespace
  volumeMounts:
    - name: explicit-kube-api-access
      mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      readOnly: true

The token identifies the Pod ServiceAccount; its Kubernetes API permissions still depend on RBAC. Omitting audience uses the API server default. For another service, set its expected audience and adjust the mount path as needed.

Kubelet rotates projected tokens. Do not use subPath for the token mount, and ensure the client reloads the token. Custom spec.volumeMounts also propagate to built-in downloader, filebeat and cleanup containers when enabled; the mount is not necessarily exclusive to the sink main container. Verify that the admission policy permits explicit token projection. This does not satisfy a policy that separately requires an explicit Pod-level automountServiceAccountToken: false field.