fix: support optional operator security settings

charts/function-mesh-operator/README.md

@@ -30,6 +30,7 @@ function mesh operator Helm chart for Kubernetes
 | controllerManager.addDefaultAffinity | bool | `true` |  |
 | controllerManager.affinity | object | `{}` |  |
 | controllerManager.autoFailover | bool | `true` |  |
+| controllerManager.automountServiceAccountToken | string | `nil` | Optional setting on the chart-managed ServiceAccount. Null preserves the Kubernetes default. The controller requires Kubernetes API credentials; do not disable token mounting without an alternative. |
 | controllerManager.configFile | string | `"/etc/config/config.yaml"` |  |
 | controllerManager.create | bool | `true` |  |
 | controllerManager.enableInitContainers | bool | `false` |  |
@@ -42,11 +43,13 @@ function mesh operator Helm chart for Kubernetes
 | controllerManager.namespacedBackendConfig | string | `"backend-config"` |  |
 | controllerManager.nodeSelector | object | `{}` |  |
 | controllerManager.pauseRollout | bool | `false` |  |
+| controllerManager.podSecurityContext | object | `{}` | Optional controller Pod security context. Empty preserves existing behavior. |
 | controllerManager.pprof.enable | bool | `false` |  |
 | controllerManager.pprof.port | int | `8090` |  |
 | controllerManager.replicas | int | `1` |  |
 | controllerManager.resources.requests.cpu | string | `"80m"` |  |
 | controllerManager.resources.requests.memory | string | `"50Mi"` |  |
+| controllerManager.securityContext | object | `{}` | Optional controller container security context. Empty preserves existing behavior. |
 | controllerManager.selector | list | `[]` |  |
 | controllerManager.serviceAccount | string | `"function-mesh-controller-manager"` |  |
 | controllerManager.tolerations | list | `[]` |  |

charts/function-mesh-operator/templates/controller-manager-deployment.yaml

@@ -32,6 +32,10 @@ spec:
     {{- if .Values.controllerManager.serviceAccount }}
       serviceAccount: {{ .Values.controllerManager.serviceAccount }}
     {{- end }}
+    {{- with .Values.controllerManager.podSecurityContext }}
+      securityContext:
+{{ toYaml . | indent 8 }}
+    {{- end }}
     {{- if .Values.imagePullSecrets }}
       imagePullSecrets:
 {{ toYaml .Values.imagePullSecrets | indent 6 }}
@@ -40,6 +44,10 @@ spec:
       - name: function-mesh-operator
         image: {{ .Values.operatorImage }}
         imagePullPolicy: {{ .Values.imagePullPolicy | default "IfNotPresent" }}
+        {{- with .Values.controllerManager.securityContext }}
+        securityContext:
+{{ toYaml . | indent 10 }}
+        {{- end }}
         {{- if .Values.controllerManager.resources }}
         resources:
 {{ toYaml .Values.controllerManager.resources | indent 12 }}
@@ -105,4 +113,4 @@ spec:
       priorityClassName: {{ .Values.controllerManager.priorityClassName }}
       {{- end }}
       volumes:
-      {{- include "function-mesh-operator.volumes" . | nindent 6 -}}
+      {{- include "function-mesh-operator.volumes" . | nindent 6 -}}

charts/function-mesh-operator/templates/controller-manager-rbac.yaml

@@ -10,6 +10,9 @@ metadata:
     app.kubernetes.io/instance: {{ .Release.Name }}
     app.kubernetes.io/component: controller-manager
     helm.sh/chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+"  "_" }}
+{{- if kindIs "bool" .Values.controllerManager.automountServiceAccountToken }}
+automountServiceAccountToken: {{ .Values.controllerManager.automountServiceAccountToken }}
+{{- end }}
 ---
 kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1

charts/function-mesh-operator/values.yaml

@@ -21,6 +21,12 @@ controllerManager:
   # With rbac.create=true, this service account will be created
   # Also see rbac.create and clusterScoped
   serviceAccount: function-mesh-controller-manager
+  # -- Optional setting on the chart-managed ServiceAccount. Null preserves the Kubernetes default. The controller requires Kubernetes API credentials; do not disable token mounting without an alternative.
+  automountServiceAccountToken: null
+  # -- Optional controller Pod security context. Empty preserves existing behavior.
+  podSecurityContext: {}
+  # -- Optional controller container security context. Empty preserves existing behavior.
+  securityContext: {}
   replicas: 1
   resources:
     requests:

docs/security.md

@@ -0,0 +1,81 @@
+# Security configuration
+
+## Operator
+
+The Helm chart preserves existing security settings by default. To opt in to
+container hardening, use the following values and verify them against your
+operator image and admission policies:
+
+```yaml
+controllerManager:
+  podSecurityContext:
+    runAsNonRoot: true
+    seccompProfile:
+      type: RuntimeDefault
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: [ALL]
+```
+
+These settings affect only the controller manager, not Function, Source or Sink
+pods. Do not assume every operator image uses the same numeric user ID.
+
+`controllerManager.automountServiceAccountToken` optionally sets the field on
+the chart-managed ServiceAccount; its default `null` omits the field. It has no
+effect on externally managed ServiceAccounts when `rbac.create: false`. The
+controller needs Kubernetes API credentials for reconciliation and leader
+election. Setting this value to `false` alone breaks the default in-cluster
+authentication for new pods. Prefer a narrowly scoped policy exception when
+token access is required; this setting does not provision alternative credentials.
+
+## Explicit ServiceAccount token mounting for sinks
+
+Function Mesh does not create runtime ServiceAccounts. A user-managed account
+with `automountServiceAccountToken: false` disables automatic mounting but still
+allows explicit projected tokens. No additional CRD field is required.
+
+For a ServiceAccount named `pulsar-sink-job-sac` in the Sink namespace, merge
+the following fields into the existing Sink spec. Preserve any existing volumes
+and volume mounts. This example supplies the standard Kubernetes in-cluster
+client paths:
+
+```yaml
+spec:
+  pod:
+    serviceAccountName: pulsar-sink-job-sac
+    volumes:
+      - name: explicit-kube-api-access
+        projected:
+          sources:
+            - serviceAccountToken:
+                path: token
+                expirationSeconds: 3600
+            - configMap:
+                name: kube-root-ca.crt
+                items:
+                  - key: ca.crt
+                    path: ca.crt
+            - downwardAPI:
+                items:
+                  - path: namespace
+                    fieldRef:
+                      fieldPath: metadata.namespace
+  volumeMounts:
+    - name: explicit-kube-api-access
+      mountPath: /var/run/secrets/kubernetes.io/serviceaccount
+      readOnly: true
+```
+
+The token identifies the Pod ServiceAccount; its Kubernetes API permissions
+still depend on RBAC. Omitting `audience` uses the API server default. For another
+service, set its expected audience and adjust the mount path as needed.
+
+Kubelet rotates projected tokens. Do not use `subPath` for the token mount, and
+ensure the client reloads the token. Custom `spec.volumeMounts` also propagate
+to built-in downloader, filebeat and cleanup containers when enabled; the mount
+is not necessarily exclusive to the sink main container. Verify that the
+admission policy permits explicit token projection. This does not satisfy a
+policy that separately requires an explicit Pod-level
+`automountServiceAccountToken: false` field.