Remove token from job pods

tapis-project · Sep 5, 2024 · c836db3 · c836db3
1 parent 7dabe07
commit c836db3
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 1 deletion.
diff --git a/src/engine/src/core/tasks/executors/Application.py b/src/engine/src/core/tasks/executors/Application.py
@@ -43,6 +43,7 @@ def execute(self):
         # Pod template and pod template spec
         template = client.V1PodTemplateSpec(
             spec=client.V1PodSpec(
+                automount_service_account_token=False,
                 containers=[container],
                 restart_policy="Never",
                 volumes=volumes

diff --git a/src/engine/src/core/tasks/executors/Function.py b/src/engine/src/core/tasks/executors/Function.py
@@ -76,6 +76,7 @@ def execute(self):
                 backoff_limit=0 if self.task.execution_profile.max_retries < 0 else self.task.execution_profile.max_retries,
                 template=client.V1PodTemplateSpec(
                     spec=client.V1PodSpec(
+                        automount_service_account_token=False,
                         containers=[
                             client.V1Container(
                                 name=job_name,

diff --git a/src/engine/src/core/tasks/executors/builders/kaniko/Kaniko.py b/src/engine/src/core/tasks/executors/builders/kaniko/Kaniko.py
@@ -164,7 +164,10 @@ def _create_job(self):
         # Pod template and pod template spec
         template = client.V1PodTemplateSpec(
             spec=client.V1PodSpec(
-                containers=[container], restart_policy="Never", volumes=volumes
+                automount_service_account_token=False,
+                containers=[container],
+                restart_policy="Never",
+                volumes=volumes
             )
         )
 

diff --git a/src/engine/src/core/tasks/executors/builders/singularity/Singularity.py b/src/engine/src/core/tasks/executors/builders/singularity/Singularity.py
@@ -123,6 +123,7 @@ def _create_job(self):
         # Pod template and pod template spec
         template = V1PodTemplateSpec(
             spec=V1PodSpec(
+                automount_service_account_token=False,
                 containers=[container],
                 restart_policy="Never",
                 volumes=volumes