automountServiceAccountToken: false fatally crashes the pod despite being a documented option #6704

What happened:

Setting automountServiceAccountToken: false, a documented Helm configuration option, causes the external-dns pod to enter CrashLoopBackOff.

The pod fails to start because the service account token is unavailable:

level=fatal msg="open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory"

As a result, external-dns cannot authenticate to the Kubernetes API and does not become functional.

What you expected to happen:

automountServiceAccountToken is exposed as a user-configurable option in the chart's values.yaml. The option is documented as:

Set this to 'false' to opt out of API credential automounting for the Pod.

Setting this documented option to false should not cause external-dns to crash because the service account token is unavailable.

How to reproduce it (as minimally and precisely as possible):

1. Install external-dns with automountServiceAccountToken disabled:

helm upgrade --install external-dns external-dns/external-dns \
  --version 1.21.1 \
  --namespace external-dns-test \
  --create-namespace \
  --set automountServiceAccountToken=false

2. Check the pod status:

kubectl -n external-dns-test get pods

The external-dns pod enters CrashLoopBackOff.

3. Check the logs:

kubectl -n external-dns-test logs <external-dns-pod>

The pod fails with:

level=fatal msg="open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory"

Anything else we need to know?:

The issue was reproduced independently with an isolated change to automountServiceAccountToken.

The configuration is defined in the chart's values.yaml with a default value of true:

automountServiceAccountToken: true

The chart documents this option as:

Set this to 'false' to opt out of API credential automounting for the Pod.

The value is passed directly to the Deployment pod specification in templates/deployment.yaml.

Disabling this option prevents external-dns from starting, making DNS synchronization unavailable.

Environment:

• External-DNS version (use external-dns --version): v0.21.0
• DNS provider: aws
• Others:
  • Helm chart: 1.21.1
  • Installation method: Helm
  • Kubernetes server: v1.35.5+k3s1
  • kubectl client: v1.36.1
  • Platform: k3d

Checklist

• I have searched existing issues and tried to find a fix myself
• I am using the latest release, or have checked the staging image to confirm the bug is still reproducible
• I have provided the actual process flags (not Helm values)
• I have provided kubectl get <resource> -o yaml output including status
• I have provided full external-dns debug logs
• I have described what DNS records exist and what I expected