[kibana / elasticsearch] kubernetes service account token is mounted in pod

[jonkerj]

Chart version:

All (7.14.0 currently)

Kubernetes version:

All (1.21.4 in my case)

Kubernetes provider: E.g. GKE (Google Kubernetes Engine)

Talos on bare metal

Helm Version:

3.5.2

helm get release output

n/a

Describe the bug:

The Kibana and ElasticSearch chart mount the Kubernetes ServiceAccount token in the pod by default. Since they do not require access to the Kubernetes API, this is an unneeded attack surface. Potential attackers could access the K8S API on behalf of the Pod.

Steps to reproduce:

1. Install the chart
2. kubectl describe -n <ns> <pod>
3. Observe a mount at /var/run/secrets/kubernetes.io/serviceaccount

Expected behavior:

No mounted SA.

Provide logs and/or server output (if relevant):

n/a

Any additional context:

I've created two PRs to fix this (#1300 and #1301). Maybe someone could look into these.

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[botelastic]

This issue has been automatically closed because it has not had recent activity since being marked as stale.