Disable automountServiceAccountToken and support ConfigMap annotations for security hardening

[deepnemesis]

Background

Two small, unrelated gaps found while reviewing this chart's security posture:

1. Neither the ServiceAccount resource nor the Deployment's pod spec set automountServiceAccountToken, so every kafka-ui pod gets a Kubernetes API token mounted by default — even though kafka-ui never calls the Kubernetes API in normal operation.

2. Neither ConfigMap this chart creates (configmap.yaml, configmap_fromValues.yaml) supports custom annotations, which blocks integration with tooling that relies on ConfigMap annotations (e.g. HashiCorp Vault Agent), as reported in Add custom annotations support for ConfigMap in Helm chart #72.

Changes

• Add serviceAccount.automountServiceAccountToken (default false), wired into the Deployment pod spec.

• Add configMap.annotations (default {}), wired into both ConfigMap templates.

• Bump chart version 1.6.5 → 1.6.6 (single patch bump covering both changes)

• Update CONFIGURATION.md accordingly.

Reference

• Closes Disable Default automountServiceAccountToken #73
• Closes Add custom annotations support for ConfigMap in Helm chart #72

Summary by CodeRabbit

• New Features

  • Added support for custom annotations on ConfigMaps created by the Kafka UI Helm chart.
  • Added configuration to control whether service account tokens are automatically mounted, defaulting to disabled.

• Documentation

  • Documented the new ConfigMap annotation and service account token settings.

• Chores

  • Updated the Kafka UI Helm chart version to 1.6.6.

[kapybro]

AI Summary

The GitHub issue addresses two security gaps in a Helm chart: unnecessary Kubernetes API tokens being mounted to pods (due to automountServiceAccountToken not being explicitly disabled) and missing support for ConfigMap annotations (blocking integrations like HashiCorp Vault Agent). The proposed solution adds configurable options to disable the API token mount and include custom annotations in ConfigMaps, with a version bump to 1.6.6.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: a3bc305a-8da8-45e3-be1d-76fa364b65b6

📥 Commits

Reviewing files that changed from the base of the PR and between 9f372e8 and b3fcf80.

📒 Files selected for processing (6)

• charts/kafka-ui/CONFIGURATION.md
• charts/kafka-ui/Chart.yaml
• charts/kafka-ui/templates/configmap.yaml
• charts/kafka-ui/templates/configmap_fromValues.yaml
• charts/kafka-ui/templates/deployment.yaml
• charts/kafka-ui/values.yaml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Kafka UI Helm chart adds configurable ServiceAccount token automount behavior and annotations for generated ConfigMaps. The chart defaults token automounting to disabled, documents both settings, and increments the chart version to 1.6.6.

Changes

Kafka UI chart configuration

Layer / File(s)	Summary
ServiceAccount token policy charts/kafka-ui/values.yaml, charts/kafka-ui/templates/deployment.yaml, charts/kafka-ui/CONFIGURATION.md	Adds serviceAccount.automountServiceAccountToken, defaults it to false, renders it in the pod specification, and documents the setting.
ConfigMap annotations charts/kafka-ui/templates/configmap.yaml, charts/kafka-ui/templates/configmap_fromValues.yaml, charts/kafka-ui/CONFIGURATION.md, charts/kafka-ui/Chart.yaml	Adds configurable annotations for both generated ConfigMaps, documents the setting, and increments the chart version to 1.6.6.

Estimated code review effort: 2 (Simple) | ~10 minutes

Severity of issue fixed: Medium

Suggested reviewers: haarolean

Merge Risk: ⚪ Minimal · up to b3fcf

This patch disables service-account token mounting by default and adds managed annotations for generated ConfigMaps. The supplied implementation shows no material merge-blocking risk, so it is ready for normal Helm checks.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	The changes satisfy both linked issues [#73] and [#72]. The chart disables token automounting by default while allowing opt-in through the new value, and it applies configurable annotations to both ge…
Out of Scope Changes check	✅ Passed	All changes support the linked objectives. The chart version bump and configuration documentation update are appropriate supporting changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes both primary changes: disabling service account token automounting by default and adding ConfigMap annotation support. It is concise and specific.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit hops through charts so neat
New settings make the values complete
Tokens stay off by default
ConfigMaps wear labels well-placed
Version six-six marks the feat
Fluffy paws approve the update}

_{Comment @coderabbitai help to get the list of available commands.}