Scan Job has automountServiceAccountToken: false, doesn't work with Vault

[Madi Anas]

What steps did you take and what happened:

Deployed starboard-operator with a helm chart with these values overrides:

    trivy:
      githubToken: "vault:secret/data/starboard-system/starboard-operator#GITHUB_TOKEN"
    starboard:
      scanJobAnnotations: 'vault.security.banzaicloud.io/vault-addr=https://vault.vault:8200,vault.security.banzaicloud.io/vault-role=starboard-system-starboard-operator,vault.security.banzaicloud.io/vault-skip-verify=true'
      scanJobPodTemplateLabels: 'app.kubernetes.io/owner=platform'
    podAnnotations:
      vault.security.banzaicloud.io/vault-addr: https://vault.vault:8200
      vault.security.banzaicloud.io/vault-role: starboard-system-starboard-operator
      vault.security.banzaicloud.io/vault-skip-verify: true

Getting this error in vault-env logs:

level=error msg="failed to read login data" app=vault-env err="open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory" type=jwt

Looking at the scan job yaml file, shows automountServiceAccountToken: false, hence service account token is not being mounted. This token is needed for vault to populate githubToken value before scanjob container launches.

What did you expect to happen:

Expected for Vault to replace the github_token secret env at the container init stage.

Environment:

• Starboard version (use starboard version): 0.14.1
• Kubernetes version (use kubectl version): v1.21.5-eks-9017834
• OS (macOS 10.15, Windows 10, Ubuntu 19.10 etc): Ubuntu 21.04

[Daniel Pacak]

Thank you for the feedback @madianas21 Do you think it makes sense to introduce Trivy plugin config to enable / disable mounting service account token? For users who don't deploy Vault disabling it is still a good thing. WDYT?