turn off automountServiceAccountToken for prometheus service accounts

Author: raptorsun

assets/prometheus-k8s/service-account.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 kind: ServiceAccount
 metadata:
   annotations:

assets/prometheus-user-workload/service-account.yaml

@@ -1,5 +1,5 @@
 apiVersion: v1
-automountServiceAccountToken: true
+automountServiceAccountToken: false
 kind: ServiceAccount
 metadata:
   labels:

jsonnet/components/prometheus-user-workload.libsonnet

@@ -508,4 +508,10 @@ function(params)
     podDisruptionBudget+: {
       apiVersion: 'policy/v1',
     },
+
+    serviceAccount+: {
+      // service account token is managed by the operator.
+      automountServiceAccountToken: false,
+    },
+
   }

jsonnet/components/prometheus.libsonnet

@@ -81,6 +81,8 @@ function(params)
           'serviceaccounts.openshift.io/oauth-redirectreference.prometheus-k8s': '{"kind":"OAuthRedirectReference","apiVersion":"v1","reference":{"kind":"Route","name":"prometheus-k8s"}}',
         },
       },
+      // service account token is managed by the operator.
+      automountServiceAccountToken: false,
     },
 
     // Adding the serving certs annotation causes the serving certs controller