fix: use service accounts, not kubeconfig

charts/mint/templates/ensemble-manager.yaml

@@ -26,17 +26,6 @@ spec:
   selector:
     app: {{ include "mint.prefix" . }}-ensemble-manager
 ---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ include "mint.prefix" . }}-kubeconfig
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    "helm.sh/resource-policy": keep
-type: Opaque
-data:
-  config: {{ .Files.Get "kubeconfig" | b64enc | quote }}
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -52,6 +41,7 @@ spec:
       labels:
         app: {{ include "mint.prefix" . }}-ensemble-manager
     spec:
+      serviceAccountName: {{ .Values.components.ensemble_manager.serviceAccountName }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -65,9 +55,6 @@ spec:
         - name: storage
           persistentVolumeClaim:
             claimName: {{ include "mint.prefix" . }}-ensemble-manager
-        - name: kubeconfig
-          secret:
-            secretName: {{ include "mint.prefix" . }}-kubeconfig
       initContainers:
         - name: volume-mount-hack
           image: busybox
@@ -101,9 +88,6 @@ spec:
             - name: config
               mountPath: /home/node/app/config.json
               subPath: config.json
-            - name: kubeconfig
-              mountPath: /home/node/.kube
-              readOnly: true
         - name: files
           {{- with .Values.components.ensemble_manager }}
           image: "nginx"

charts/mint/values.yaml

@@ -260,6 +260,7 @@ components:
       tag: 17dcd41412f97525425e4377b8c0dbd6e2088458
       pullPolicy: IfNotPresent
     resources: {}
+    serviceAccountName: default
     environment:
       data_dir: /var/mint
       data_url: http://localhost:30010/data