[deckhouse] Add hook to disable default service account token automount

[YuryLysov]

Description

Add hook to disable default ServiceAccount token automount

Why do we need it, and what problem does it solve?

According to CIS Benchmark 5.1.5, automountServiceAccountToken for default sa should be disabled

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: deckhouse
type: feature
summary: Add hook to disable default ServiceAccount token automount.
impact_level: default

[deckhouse-BOaTswain]

🟢 e2e: GCP for deckhouse:feature/disable-default-sa-token-automount succeeded in 29m55s.

Workflow details

GCP-WithoutNAT-Containerd-1.29 - Connection string: ssh user@34.159.96.201

🟢 e2e: GCP, Containerd, Kubernetes 1.29 succeeded in 29m14s.

[deckhouse-BOaTswain]

🟢 e2e: Yandex.Cloud for deckhouse:feature/disable-default-sa-token-automount succeeded in 35m26s.

Workflow details

Yandex.Cloud-WithoutNAT-Containerd-1.29 - Connection string: ssh redos@89.169.152.199

🟢 e2e: Yandex.Cloud, Containerd, Kubernetes 1.29 succeeded in 34m43s.

[deckhouse-BOaTswain]

🔴 e2e: AWS for deckhouse:feature/disable-default-sa-token-automount failed in 5m49s.

E2e for aws WithoutNAT;containerd;1.30 was failed. Use:
ssh -i ~/.ssh/e2e-id-rsa ec2-user@3.123.137.65 - connect for debugging;

/e2e/abort aws;WithoutNAT;containerd;1.30 13435897249 13435897249-1-con-1-30 /sys/deckhouse-oss/install:pr11954 ec2-user@3.123.137.65 - for abort failed cluster

Workflow details (1 job failed)

AWS-WithoutNAT-Containerd-1.30 - Connection string: ssh ec2-user@3.123.137.65

🔴 e2e: AWS, Containerd, Kubernetes 1.30 failed in 5m10s.

[yalosev]

/e2e/abort aws;WithoutNAT;containerd;1.30 13435897249 13435897249-1-con-1-30 /sys/deckhouse-oss/install:pr11954 ec2-user@3.123.137.65

[deckhouse-BOaTswain]

🟢 destroy cluster: AWS for refs/heads/main succeeded in 6m9s.

Workflow details

🟢 destroy cluster: AWS, Containerd, Kubernetes 1.30 succeeded in 5m46s.

[deckhouse-BOaTswain]

🔴 e2e: Yandex.Cloud for deckhouse:feature/disable-default-sa-token-automount failed in 5m29s.

E2e for yandex-cloud WithoutNAT;containerd;1.30 was failed. Use:
ssh -i ~/.ssh/e2e-id-rsa redos@84.252.129.162 - connect for debugging;

/e2e/abort yandex-cloud;WithoutNAT;containerd;1.30 13436805652 13436805652-1-con-1-30 /sys/deckhouse-oss/install:pr11954 redos@84.252.129.162 - for abort failed cluster

Workflow details (1 job failed)

Yandex.Cloud-WithoutNAT-Containerd-1.30 - Connection string: ssh redos@84.252.129.162

🔴 e2e: Yandex.Cloud, Containerd, Kubernetes 1.30 failed in 4m44s.

[YuryLysov]

/e2e/abort yandex-cloud;WithoutNAT;containerd;1.30 13436805652 13436805652-1-con-1-30 /sys/deckhouse-oss/install:pr11954 redos@84.252.129.162

[deckhouse-BOaTswain]

🟢 destroy cluster: Yandex.Cloud for refs/heads/main succeeded in 6m16s.

Workflow details

🟢 destroy cluster: Yandex.Cloud, Containerd, Kubernetes 1.30 succeeded in 5m53s.

[deckhouse-BOaTswain]

🟢 e2e: GCP for deckhouse:feature/disable-default-sa-token-automount succeeded in 40m3s.

Workflow details

GCP-WithoutNAT-Containerd-1.30 - Connection string: ssh user@34.159.69.69

🟢 e2e: GCP, Containerd, Kubernetes 1.30 succeeded in 39m27s.

[deckhouse-BOaTswain]

🟢 e2e: AWS for deckhouse:feature/disable-default-sa-token-automount succeeded in 32m9s.

Workflow details

AWS-WithoutNAT-Containerd-1.30 - Connection string: ssh ec2-user@18.195.53.32

🟢 e2e: AWS, Containerd, Kubernetes 1.30 succeeded in 31m28s.