# ServiceAccount for the node-local-dns DaemonSet.
# No RBAC: the binary does not talk to the API server. The upstream
# Service IP is resolved by env var (KUBE_DNS_UPSTREAM_SERVICE_HOST)
# injected by kubelet from the kube-dns-upstream Service.
# automountServiceAccountToken: false — the binary makes no API calls,
# so the auto-mounted SA token is unused dead weight. Disabling it
# removes a credential-leak vector if the privileged container is
# compromised.
apiVersion: v1
kind: ServiceAccount
metadata:
  name: node-local-dns
  namespace: kube-system
  labels:
    k8s-app: node-local-dns
    app.kubernetes.io/managed-by: osdc-base
automountServiceAccountToken: false
