OLS-3089 Disable SA token automount for non-API pods

[xrajesh]

Summary

• OLS-3089: Set automountServiceAccountToken=false on PostgreSQL, console, agentic-console, and OTEL collector PodSpecs. These pods serve static files or run databases and do not make Kubernetes API calls, so they should not mount service account tokens.

Test plan

• Verify PostgreSQL deployment starts without SA token mounted
• Verify console and agentic-console deployments serve UI correctly
• Verify OTEL collector starts and collects telemetry without SA token

🤖 Generated with Claude Code

Summary by CodeRabbit

• Security
  • Disabled automatic service account token mounting for OTEL Collector, Postgres, and console plugin workloads.
  • Existing service account assignments remain unchanged.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bcfeb654-af68-4e10-9aed-4d0c2530d37b

📥 Commits

Reviewing files that changed from the base of the PR and between 369dc0a and c5f5cec.

📒 Files selected for processing (3)

• internal/controller/otelcollector/deployment.go
• internal/controller/postgres/deployment.go
• internal/controller/utils/utils.go

---

📝 Walkthrough

Walkthrough

The pod templates generated for the OTEL Collector, Postgres, and console plugin now explicitly disable automatic service account token mounting while retaining existing service account configuration.

Changes

Service account token automounting

Layer / File(s)	Summary
Disable token automounting internal/controller/otelcollector/deployment.go, internal/controller/postgres/deployment.go, internal/controller/utils/utils.go	The OTEL Collector, Postgres, and console plugin pod specifications set AutomountServiceAccountToken to false.

Estimated code review effort: 1 (Trivial) | ~5 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: disabling service account token automount for non-API pods.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign xrajesh for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@xrajesh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/bundle-e2e-4-21	c5f5cec	link	true	/test bundle-e2e-4-21

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.