fix: harden sn-operator service account token mount

[tuteng]

Summary

• add serviceAccount.automountServiceAccountToken to the sn-operator chart
• preserve the existing behavior by defaulting the option to true
• document how to manually project the credentials required by sn-operator when automatic mounting is disabled
• keep the chart version at 0.20.1

Refs streamnative/eng-support-tickets#4974.

Manual token mount example

The operator uses in-cluster Kubernetes API credentials. When disabling automatic token mounting, provide the projected token, cluster CA, and namespace at the standard in-cluster path:

serviceAccount:
  automountServiceAccountToken: false

volumeMounts:
  - name: kube-api-access
    mountPath: /var/run/secrets/kubernetes.io/serviceaccount
    readOnly: true

volumes:
  - name: kube-api-access
    projected:
      defaultMode: 420
      sources:
        - serviceAccountToken:
            expirationSeconds: 3607
            path: token
        - configMap:
            name: kube-root-ca.crt
            items:
              - key: ca.crt
                path: ca.crt
        - downwardAPI:
            items:
              - path: namespace
                fieldRef:
                  apiVersion: v1
                  fieldPath: metadata.namespace

Validation

• helm lint charts/sn-operator
• rendered the default configuration and confirmed automatic mounting remains enabled
• rendered the manual-mount example and confirmed the projected volume and mount are present

[Copilot]

Copilot review overview

🟢 Approval recommended

The reviewed changes implement the intended hardening with no unresolved issues.

Review effort: Lite
Findings: None

What changed in this PR

Hardens the operator service account token mounting with a secure default while preserving access for the operator pod.

Changes:

• Defaults service account token automounting to false.
• Explicitly enables token mounting for the operator deployment.
• Bumps the chart version to 0.20.2.

File	Description
charts/​sn-operator/​values.yaml	Adds the token automount setting.
charts/​sn-operator/​templates/​sa.yaml	Applies the setting to the ServiceAccount.
charts/​sn-operator/​templates/​deployment.yaml	Enables token mounting for the operator pod.
charts/​sn-operator/​Chart.yaml	Updates the chart version.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.