From 6458e6884f59eec030807ce5abe9303d9c709bf4 Mon Sep 17 00:00:00 2001
From: Aman Raj <aman.yug@gmail.com>
Date: Sun, 12 Jul 2026 03:40:49 +0530
Subject: [PATCH] feat(chart): expose automountServiceAccountToken in the
 csi-driver-spiffe chart

Allow disabling automatic mounting of the ServiceAccount token on both the
csi-driver-spiffe node DaemonSet and the approver Deployment pods, matching
the option in the trust-manager chart. Defaults to true, preserving current
behaviour. Regenerated the values schema and README.

Signed-off-by: Aman Raj <aman.yug@gmail.com>
---
 deploy/charts/csi-driver-spiffe/README.md                 | 8 ++++++++
 deploy/charts/csi-driver-spiffe/templates/daemonset.yaml  | 3 +++
 deploy/charts/csi-driver-spiffe/templates/deployment.yaml | 3 +++
 deploy/charts/csi-driver-spiffe/values.schema.json        | 8 ++++++++
 deploy/charts/csi-driver-spiffe/values.yaml               | 4 ++++
 5 files changed, 26 insertions(+)

diff --git a/deploy/charts/csi-driver-spiffe/README.md b/deploy/charts/csi-driver-spiffe/README.md
index e44c10e..7eaa188 100644
--- a/deploy/charts/csi-driver-spiffe/README.md
+++ b/deploy/charts/csi-driver-spiffe/README.md
@@ -587,6 +587,14 @@ resources:
 > ```
 
 Optional priority class to be used for the csi-driver pods.
+#### **automountServiceAccountToken** ~ `bool`
+> Default value:
+> ```yaml
+> true
+> ```
+
+Automounting API credentials for the csi-driver-spiffe pods.
+
 #### **commonLabels** ~ `object`
 > Default value:
 > ```yaml
diff --git a/deploy/charts/csi-driver-spiffe/templates/daemonset.yaml b/deploy/charts/csi-driver-spiffe/templates/daemonset.yaml
index c721075..d12784f 100644
--- a/deploy/charts/csi-driver-spiffe/templates/daemonset.yaml
+++ b/deploy/charts/csi-driver-spiffe/templates/daemonset.yaml
@@ -25,6 +25,9 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "cert-manager-csi-driver-spiffe.name" . }}
+      {{- if hasKey .Values "automountServiceAccountToken" }}
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+      {{- end }}
       containers:
 
         - name: node-driver-registrar
diff --git a/deploy/charts/csi-driver-spiffe/templates/deployment.yaml b/deploy/charts/csi-driver-spiffe/templates/deployment.yaml
index 396063d..5772809 100644
--- a/deploy/charts/csi-driver-spiffe/templates/deployment.yaml
+++ b/deploy/charts/csi-driver-spiffe/templates/deployment.yaml
@@ -21,6 +21,9 @@ spec:
         seccompProfile: { type: RuntimeDefault }
 
       serviceAccountName: {{ include "cert-manager-csi-driver-spiffe.name" . }}-approver
+      {{- if hasKey .Values "automountServiceAccountToken" }}
+      automountServiceAccountToken: {{ .Values.automountServiceAccountToken }}
+      {{- end }}
       containers:
       - name: {{ include "cert-manager-csi-driver-spiffe.name" . }}-approver
         {{- $approverImageConfig := include "approver-image-config" . | fromJson }}
diff --git a/deploy/charts/csi-driver-spiffe/values.schema.json b/deploy/charts/csi-driver-spiffe/values.schema.json
index e386b9b..802be37 100644
--- a/deploy/charts/csi-driver-spiffe/values.schema.json
+++ b/deploy/charts/csi-driver-spiffe/values.schema.json
@@ -12,6 +12,9 @@
         "approverImage": {
           "$ref": "#/$defs/helm-values.approverImage"
         },
+        "automountServiceAccountToken": {
+          "$ref": "#/$defs/helm-values.automountServiceAccountToken"
+        },
         "commonLabels": {
           "$ref": "#/$defs/helm-values.commonLabels"
         },
@@ -572,6 +575,11 @@
       "description": "Override the image tag to deploy by setting this variable. If no value is set, the chart's appVersion is used.",
       "type": "string"
     },
+    "helm-values.automountServiceAccountToken": {
+      "default": true,
+      "description": "Automounting API credentials for the csi-driver-spiffe pods.",
+      "type": "boolean"
+    },
     "helm-values.commonLabels": {
       "default": {},
       "description": "Labels to apply to all resources",
diff --git a/deploy/charts/csi-driver-spiffe/values.yaml b/deploy/charts/csi-driver-spiffe/values.yaml
index f8308ae..1b588a3 100644
--- a/deploy/charts/csi-driver-spiffe/values.yaml
+++ b/deploy/charts/csi-driver-spiffe/values.yaml
@@ -353,6 +353,10 @@ app:
 # Optional priority class to be used for the csi-driver pods.
 priorityClassName: ""
 
+# Automounting API credentials for the csi-driver-spiffe pods.
+# +docs:property
+automountServiceAccountToken: true
+
 # Labels to apply to all resources
 commonLabels: {}