Disable automountServiceAccountToken and support ConfigMap annotations for security hardening

charts/kafka-ui/CONFIGURATION.md

@@ -20,12 +20,14 @@
 | `serviceAccount.name`        | The name of the ServiceAccount to use.               | `""`   |
 | `serviceAccount.create`      | Specifies whether a ServiceAccount should be created | `true` |
 | `serviceAccount.annotations` | Additional Service Account annotations               | `{}`   |
+| `serviceAccount.automountServiceAccountToken` | Specifies whether the ServiceAccount token should be automatically mounted into the Kafka-UI pod. Kafka-UI does not call the Kubernetes API by default, so this is disabled to reduce attack surface. | `false` |
 
 ### Application configuration
 
 | Name                             | Description                                                                                                                                        | Value |
 | -------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | ----- |
 | `existingConfigMap`              | Name of the existing ConfigMap with kafbat-ui environment variables                                                                                | `""`  |
+| `configMap.annotations`          | Additional annotations for the ConfigMap(s) created by this chart (e.g. for Vault Agent or other controllers that rely on ConfigMap annotations)   | `{}`  |
 | `yamlApplicationConfig`          | Kafbat-UI config in Yaml format                                                                                                                    | `{}`  |
 | `yamlApplicationConfigConfigMap` | Map with name and keyName keys, name refers to the existing ConfigMap, keyName refers to the ConfigMap key with Kafbat-UI config in Yaml format    | `{}`  |
 | `yamlApplicationConfigSecret`    | Secret with name and keyName keys, name refers to the existing ConfigMap, keyName refers to the ConfigMap key with Kafbat-UI config in Yaml format | `{}`  |

charts/kafka-ui/Chart.yaml

@@ -2,6 +2,6 @@ apiVersion: v2
 name: kafka-ui
 description: A Helm chart for kafka-UI
 type: application
-version: 1.6.5
+version: 1.6.6
 appVersion: v1.5.0
 icon: https://raw.githubusercontent.com/kafbat/kafka-ui/main/documentation/images/logo_new.png

charts/kafka-ui/templates/configmap.yaml

@@ -6,6 +6,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "kafka-ui.labels" . | nindent 4 }}
+  {{- with .Values.configMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   {{- toYaml .Values.envs.config | nindent 2 }}
 {{- end -}}

charts/kafka-ui/templates/configmap_fromValues.yaml

@@ -6,6 +6,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "kafka-ui.labels" . | nindent 4 }}
+  {{- with .Values.configMap.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 data:
   config.yml: |-
     {{- tpl (toYaml .Values.yamlApplicationConfig) . | nindent 4}}

charts/kafka-ui/templates/deployment.yaml

@@ -46,6 +46,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       serviceAccountName: {{ include "kafka-ui.serviceAccountName" . }}
+      automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }}
       securityContext:
         {{- toYaml .Values.podSecurityContext | nindent 8 }}
       containers:

charts/kafka-ui/values.yaml

@@ -28,12 +28,17 @@ serviceAccount:
   create: true
   ## @param serviceAccount.annotations Additional Service Account annotations
   annotations: {}
+  ## @param serviceAccount.automountServiceAccountToken Specifies whether the ServiceAccount token should be automatically mounted into the Kafka-UI pod. Kafka-UI does not call the Kubernetes API by default, so this is disabled to reduce attack surface.
+  automountServiceAccountToken: false
   # The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
 
 ## @section Application configuration
 ## @param existingConfigMap [string] Name of the existing ConfigMap with kafbat-ui environment variables
 existingConfigMap: ""
+## @param configMap.annotations Additional annotations for the ConfigMap(s) created by this chart (e.g. for Vault Agent or other controllers that rely on ConfigMap annotations)
+configMap:
+  annotations: {}
 ## @param yamlApplicationConfig Kafbat-UI config in Yaml format
 yamlApplicationConfig:
   {}