fix: field indentation / enable-disable auto-mounting of service account K8S token

[rodageve]

Description:

• Fix static scan issue / last PR had a templating issue, the automountServiceAccountToken field is now being defined (value from value.yaml) in the ServiceAccount, default this to 'false' when there are no RBAC roles associated with the SA.

Summary by CodeRabbit

• New Features
  • Added a Helm value to control whether a ServiceAccount mounts its token (automountServiceAccountToken). When set, the rendered ServiceAccount includes this setting regardless of annotations, giving operators explicit control over token automounting in generated manifests.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 93113b7b-8d60-4301-b700-0dfb6038d031

📥 Commits

Reviewing files that changed from the base of the PR and between 8d03389 and ea40169.

📒 Files selected for processing (1)

• kubernetes/helm/openrag/templates/serviceaccount.yaml

🚧 Files skipped from review as they are similar to previous changes (1)

• kubernetes/helm/openrag/templates/serviceaccount.yaml

---

Walkthrough

The PR adds conditional rendering of the automountServiceAccountToken field in the Kubernetes ServiceAccount Helm template, sourcing its value from .Values.serviceAccount.automount.

Changes

ServiceAccount Token Auto-mounting Configuration

Layer / File(s)	Summary
ServiceAccount token mount configuration kubernetes/helm/openrag/templates/serviceaccount.yaml	Adds automountServiceAccountToken field to the rendered ServiceAccount manifest metadata, sourcing the value from .Values.serviceAccount.automount to enable conditional control of service account token auto-mounting.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~5 minutes

Possibly related PRs

• langflow-ai/openrag#1655: Both PRs center on Helm's ServiceAccount token auto-mounting: the related PR sets serviceAccount.automount, and this PR renders automountServiceAccountToken from that value in the template.

Suggested labels

bug

Suggested reviewers

• edwinjosechittilappilly
• zzzming

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately reflects the main changes: fixing indentation and adding the automountServiceAccountToken field to control service account token auto-mounting in Kubernetes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix_sa_automounttoken_secstatic_jun2

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@kubernetes/helm/openrag/templates/serviceaccount.yaml`:
- Line 13: The automountServiceAccountToken field is incorrectly indented under
metadata; move the line defining automountServiceAccountToken so it is a
top-level key (aligned with apiVersion, kind, and metadata) in the
serviceaccount.yaml template; locate the template's automountServiceAccountToken
entry and adjust its indentation/column to column 0 (same placement pattern as
kubernetes/helm/operator/templates/serviceaccount.yaml) so it sits as a sibling
of metadata rather than nested under it.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 30918bd2-2749-4270-98fd-bbfda7b661b6

📥 Commits

Reviewing files that changed from the base of the PR and between 17e8a19 and 8d03389.

📒 Files selected for processing (1)

• kubernetes/helm/openrag/templates/serviceaccount.yaml