internal/jobs/jobs.go

@@ -145,6 +145,9 @@ func base(cfg *config.Config, r store.Request, t Type, args []string, deadline i
 				Spec: corev1.PodSpec{
 					RestartPolicy:      corev1.RestartPolicyNever,
 					ServiceAccountName: cfg.JobServiceAccount,
+					// Jobs never touch the k8s API; only the vault-audience
+					// projected token below is needed.
+					AutomountServiceAccountToken: ptr(false),
 					Containers: []corev1.Container{{
 						Name:                     string(t),
 						Image:                    cfg.Image,

internal/jobs/jobs_test.go

@@ -59,6 +59,10 @@ func TestPRJobSpec(t *testing.T) {
 	if pod.ServiceAccountName != "repospawner" {
 		t.Errorf("serviceAccountName = %q", pod.ServiceAccountName)
 	}
+	// The job only needs the vault-audience token, not a k8s API token.
+	if pod.AutomountServiceAccountToken == nil || *pod.AutomountServiceAccountToken {
+		t.Errorf("automountServiceAccountToken = %v, want false", pod.AutomountServiceAccountToken)
+	}
 	if len(pod.Containers) != 1 || pod.Containers[0].Image != cfg.Image {
 		t.Fatalf("containers = %+v", pod.Containers)
 	}