fix(chart): mount the service account token when automountServiceAccountToken is false by ashokpariya0 · Pull Request #6814 · kubernetes-sigs/external-dns

ashokpariya0 · 2026-10-16T10:35:28Z

What does it do ?

When automountServiceAccountToken is false, the chart now mounts a projected service account token into the external-dns container. It’s the same layout the kubelet uses: token, ca.crt from kube-root-ca.crt, and namespace. The webhook sidecar doesn’t get the token. If extraVolumeMounts already mounts /var/run/secrets/kubernetes.io/serviceaccount, the chart adds nothing, so existing workarounds keep working.

Motivation

Fixes #6704

With automountServiceAccountToken set to false, the pod crashes with “open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory”, because ExternalDNS always talks to the Kubernetes API. People turn automounting off to keep the token away from the webhook sidecar, but it broke external-dns itself.

Tested on a v1.36 cluster (s390x, inmemory provider, automountServiceAccountToken=false):

master branch: pod in CrashLoopBackOff with the token error above
this branch: pod Running, log shows “Created Kubernetes client” and “All records are already up to date”

More

Yes, this PR title follows Conventional Commits
Yes, I added unit tests
Yes, I updated end user documentation accordingly

kubernetes-prow · 2026-10-16T10:35:36Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign stevehipwell for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

charts/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

kubernetes-prow · 2026-10-16T10:35:38Z

Welcome @ashokpariya0!

It looks like this is your first PR to kubernetes-sigs/external-dns 🎉. Please refer to our pull request process documentation to help your PR have a smooth ride to approval.

You will be prompted by a bot to use commands during the review process. Do not be afraid to follow the prompts! It is okay to experiment. Here is the bot commands documentation.

You can also check if kubernetes-sigs/external-dns has its own contribution guidelines.

You may want to refer to our testing guide if you run into trouble with your tests not passing.

If you are having difficulty getting your pull request seen, please follow the recommended escalation practices. Also, for tips and tricks in the contribution process you may want to read the Kubernetes contributor cheat sheet. We want to make sure your contribution gets all the attention it needs!

Thank you, and welcome to Kubernetes. 😃

kubernetes-prow · 2026-10-16T10:35:39Z

Hi @ashokpariya0. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

stevehipwell · 2026-11-12T16:07:36Z

@ashokpariya0 please can you rebase this PR?

…untToken is false Setting automountServiceAccountToken to false removes the token from the pod, but ExternalDNS always talks to the Kubernetes API, so the pod crashes with "open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory". When the value is false, mount a projected token (token, kube-root-ca.crt and namespace, same layout as the kubelet) into the external-dns container only. The webhook sidecar does not get it, which is the usual reason to turn automounting off. If extraVolumeMounts already mounts that path, the chart leaves it alone so existing workarounds keep working. Signed-off-by: Ashok Pariya <ashok.pariya@ibm.com>

ashokpariya0 · 2026-11-13T12:29:10Z

@ashokpariya0 please can you rebase this PR?

Done.

mloiseleur · 2026-11-13T14:05:55Z

/ok-to-test

stevehipwell · 2026-11-13T14:15:07Z

/lgtm

coveralls · 2026-11-13T14:15:27Z

Coverage Report for CI Build 43425169554

Coverage increased (+0.005%) to 83.476%

Details

Coverage increased (+0.005%) from the base build.
Patch coverage: No coverable lines changed in this PR.
No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	19838
Covered Lines:	16560
Line Coverage:	83.48%
Coverage Strength:	1466.14 hits per line

💛 - Coveralls

mloiseleur

Thanks, the fix is sound. Small points inline.

mloiseleur · 2026-11-13T14:20:51Z

+{{- /* ExternalDNS always needs the Kubernetes API. With automounting disabled, mount the token
+     into the external-dns container only (not the webhook sidecar), unless the user already
+     mounts that path through extraVolumeMounts. */}}


The extraVolumeMounts part restates the loop below.

Suggested change

{{- /* ExternalDNS always needs the Kubernetes API. With automounting disabled, mount the token

into the external-dns container only (not the webhook sidecar), unless the user already

mounts that path through extraVolumeMounts. */}}

{{- /* ExternalDNS always needs the API: mount the token into the external-dns container only, not the webhook sidecar. */}}

mloiseleur · 2026-11-13T14:20:51Z

+            sources:
+              - serviceAccountToken:
+                  path: token
+                  expirationSeconds: 3607


3607 looks arbitrary, but it is the value the ServiceAccount admission plugin injects (WarnOnlyBoundTokenExpirationSeconds), and the API server extends exactly this value.
Could you add a short comment so nobody "fixes" it to 3600?

Suggested change

expirationSeconds: 3607

{{- /* 3607 like the auto-mounted token: the API server extends this exact value. */}}

expirationSeconds: 3607

kubernetes-prow Bot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Oct 16, 2026

kubernetes-prow Bot added the chart label Oct 16, 2026

kubernetes-prow Bot requested review from stevehipwell and u-kai October 16, 2026 10:35

kubernetes-prow Bot added cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Oct 16, 2026

kubernetes-prow Bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Oct 16, 2026

mloiseleur mentioned this pull request Nov 11, 2026

automountServiceAccountToken: false fatally crashes the pod despite being a documented option #6704

Open

1 of 6 tasks

stevehipwell mentioned this pull request Nov 12, 2026

Helm chart for release v0.24.0 #6840

Open

ashokpariya0 force-pushed the chart-mount-sa-token-when-automount-disabled branch from 9b12124 to 80e22ce Compare November 13, 2026 12:26

kubernetes-prow Bot removed do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Nov 13, 2026

kubernetes-prow Bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Nov 13, 2026

kubernetes-prow Bot assigned stevehipwell Nov 13, 2026

kubernetes-prow Bot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Nov 13, 2026

mloiseleur reviewed Nov 13, 2026

View reviewed changes

Navigation Menu

Repository navigation

fix(chart): mount the service account token when automountServiceAccountToken is false - #6814

fix(chart): mount the service account token when automountServiceAccountToken is false#6814
ashokpariya0 wants to merge 1 commit into
kubernetes-sigs:masterfrom
ashokpariya0:chart-mount-sa-token-when-automount-disabled

ashokpariya0 commented Oct 16, 2026

Uh oh!

kubernetes-prow Bot commented Oct 16, 2026

Uh oh!

kubernetes-prow Bot commented Oct 16, 2026

Uh oh!

kubernetes-prow Bot commented Oct 16, 2026

Uh oh!

stevehipwell commented Nov 12, 2026

Uh oh!

ashokpariya0 commented Nov 13, 2026

Uh oh!

mloiseleur commented Nov 13, 2026

Uh oh!

stevehipwell commented Nov 13, 2026

Uh oh!

coveralls commented Nov 13, 2026

Uh oh!

mloiseleur left a comment

Uh oh!

mloiseleur Nov 13, 2026

Uh oh!

mloiseleur Nov 13, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

	expirationSeconds: 3607
	{{- /* 3607 like the auto-mounted token: the API server extends this exact value. */}}
	expirationSeconds: 3607

Conversation

ashokpariya0 commented Oct 16, 2026

What does it do ?

Motivation

More

Uh oh!

kubernetes-prow Bot commented Oct 16, 2026

Uh oh!

kubernetes-prow Bot commented Oct 16, 2026

Uh oh!

kubernetes-prow Bot commented Oct 16, 2026

Uh oh!

stevehipwell commented Nov 12, 2026

Uh oh!

ashokpariya0 commented Nov 13, 2026

Uh oh!

mloiseleur commented Nov 13, 2026

Uh oh!

stevehipwell commented Nov 13, 2026

Uh oh!

coveralls commented Nov 13, 2026

Coverage Report for CI Build 43425169554

Coverage increased (+0.005%) to 83.476%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

mloiseleur left a comment

Choose a reason for hiding this comment

Uh oh!

mloiseleur Nov 13, 2026

Choose a reason for hiding this comment

Uh oh!

mloiseleur Nov 13, 2026

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants