fix: separate ServiceAccount for router workloads

controller/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/additional-router-deployment.yaml

@@ -106,6 +106,7 @@ spec:
           requests:
             cpu: 1000m
             memory: 256Mi
-      serviceAccountName: controller-manager
+      serviceAccountName: router-sa
+      automountServiceAccountToken: false
       terminationGracePeriodSeconds: 10
 {{ end }}

controller/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role.yaml

@@ -3,7 +3,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
 metadata:
   labels:
-    app.kubernetes.io/name: jumpstarter-router
+    app.kubernetes.io/name: jumpstarter-controller
   name: leader-election-role
   namespace: {{ default .Release.Namespace .Values.namespace }}
 rules:

controller/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/leader_election_role_binding.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: RoleBinding
 metadata:
   labels:
-    app.kubernetes.io/name: jumpstarter-router
+    app.kubernetes.io/name: jumpstarter-controller
   namespace: {{ default .Release.Namespace .Values.namespace }}
   name: leader-election-rolebinding
 roleRef:

controller/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/role_binding.yaml

@@ -2,7 +2,7 @@ apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
 metadata:
   labels:
-    app.kubernetes.io/name: jumpstarter-router
+    app.kubernetes.io/name: jumpstarter-controller
   annotations:
     argocd.argoproj.io/sync-wave: "-1"
   name: jumpstarter-manager-rolebinding

controller/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/rbac/service_account.yaml

@@ -2,8 +2,19 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   labels:
-    app.kubernetes.io/name: jumpstarter-router
+    app.kubernetes.io/name: jumpstarter-controller
   annotations:
     argocd.argoproj.io/sync-wave: "-1"
   name: controller-manager
   namespace: {{ default .Release.Namespace .Values.namespace }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/name: jumpstarter-router
+  annotations:
+    argocd.argoproj.io/sync-wave: "-1"
+  name: router-sa
+  namespace: {{ default .Release.Namespace .Values.namespace }}
+automountServiceAccountToken: false

controller/deploy/helm/jumpstarter/charts/jumpstarter-controller/templates/router-deployment.yaml

@@ -105,5 +105,6 @@ spec:
         secret:
           secretName: {{ .Values.grpc.tls.routerCertSecret }}
       {{- end }}
-      serviceAccountName: controller-manager
+      serviceAccountName: router-sa
+      automountServiceAccountToken: false
       terminationGracePeriodSeconds: 10

controller/deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go

@@ -1017,8 +1017,9 @@ func (r *JumpstarterReconciler) createRouterDeployment(jumpstarter *operatorv1al
 							Type: corev1.SeccompProfileTypeRuntimeDefault,
 						},
 					},
-					ServiceAccountName:        fmt.Sprintf("%s-controller-manager", jumpstarter.Name),
-					TopologySpreadConstraints: jumpstarter.Spec.Routers.TopologySpreadConstraints,
+					ServiceAccountName:            fmt.Sprintf("%s-router-sa", jumpstarter.Name),
+					AutomountServiceAccountToken:  boolPtr(false),
+					TopologySpreadConstraints:     jumpstarter.Spec.Routers.TopologySpreadConstraints,
 				},
 			},
 		},

controller/deploy/operator/internal/controller/jumpstarter/rbac.go

@@ -61,6 +61,46 @@ func (r *JumpstarterReconciler) reconcileRBAC(ctx context.Context, jumpstarter *
 		"namespace", existingSA.Namespace,
 		"operation", op)
 
+	// Router ServiceAccount (zero RBAC, no token automount)
+	desiredRouterSA := r.createRouterServiceAccount(jumpstarter)
+
+	existingRouterSA := &corev1.ServiceAccount{}
+	existingRouterSA.Name = desiredRouterSA.Name
+	existingRouterSA.Namespace = desiredRouterSA.Namespace
+
+	op, err = controllerutil.CreateOrUpdate(ctx, r.Client, existingRouterSA, func() error {
+		if existingRouterSA.CreationTimestamp.IsZero() {
+			existingRouterSA.Labels = desiredRouterSA.Labels
+			existingRouterSA.Annotations = desiredRouterSA.Annotations
+			existingRouterSA.AutomountServiceAccountToken = desiredRouterSA.AutomountServiceAccountToken
+			return nil
+		}
+
+		if !serviceAccountNeedsUpdate(existingRouterSA, desiredRouterSA) {
+			log.V(1).Info("Router ServiceAccount is up to date, skipping update",
+				"name", existingRouterSA.Name,
+				"namespace", existingRouterSA.Namespace)
+			return nil
+		}
+
+		existingRouterSA.Labels = desiredRouterSA.Labels
+		existingRouterSA.Annotations = desiredRouterSA.Annotations
+		existingRouterSA.AutomountServiceAccountToken = desiredRouterSA.AutomountServiceAccountToken
+		return nil
+	})
+
+	if err != nil {
+		log.Error(err, "Failed to reconcile Router ServiceAccount",
+			"name", desiredRouterSA.Name,
+			"namespace", desiredRouterSA.Namespace)
+		return err
+	}
+
+	log.Info("Router ServiceAccount reconciled",
+		"name", existingRouterSA.Name,
+		"namespace", existingRouterSA.Namespace,
+		"operation", op)
+
 	// Role
 	desiredRole := r.createRole(jumpstarter)
 
@@ -169,6 +209,23 @@ func (r *JumpstarterReconciler) createServiceAccount(jumpstarter *operatorv1alph
 	}
 }
 
+// createRouterServiceAccount creates a service account for the router with no RBAC permissions
+func (r *JumpstarterReconciler) createRouterServiceAccount(jumpstarter *operatorv1alpha1.Jumpstarter) *corev1.ServiceAccount {
+	automount := false
+	return &corev1.ServiceAccount{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:      fmt.Sprintf("%s-router-sa", jumpstarter.Name),
+			Namespace: jumpstarter.Namespace,
+			Labels: map[string]string{
+				"app":                          "jumpstarter-router",
+				"app.kubernetes.io/name":       "jumpstarter-router",
+				"app.kubernetes.io/managed-by": "jumpstarter-operator",
+			},
+		},
+		AutomountServiceAccountToken: &automount,
+	}
+}
+
 // createRole creates a role with necessary permissions for the controller
 func (r *JumpstarterReconciler) createRole(jumpstarter *operatorv1alpha1.Jumpstarter) *rbacv1.Role {
 	return &rbacv1.Role{