feat(k8s): automatic service account token creation for k8s auth

k8-operator/config/crd/bases/secrets.infisical.com_infisicaldynamicsecrets.yaml

@@ -73,6 +73,12 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set
+                          to `true`, the operator will automatically create a service
+                          account token for the configured service account.
+                        type: boolean
                       identityId:
                         type: string
                       serviceAccountRef:
@@ -85,6 +91,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account
+                          token. This is only relevant if `autoCreateServiceAccountToken`
+                          is true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - serviceAccountRef

k8-operator/config/crd/bases/secrets.infisical.com_infisicalpushsecrets.yaml

@@ -73,6 +73,12 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set
+                          to `true`, the operator will automatically create a service
+                          account token for the configured service account.
+                        type: boolean
                       identityId:
                         type: string
                       serviceAccountRef:
@@ -85,6 +91,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account
+                          token. This is only relevant if `autoCreateServiceAccountToken`
+                          is true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - serviceAccountRef

k8-operator/config/crd/bases/secrets.infisical.com_infisicalsecrets.yaml

@@ -136,6 +136,12 @@ spec:
                     type: object
                   kubernetesAuth:
                     properties:
+                      autoCreateServiceAccountToken:
+                        description: Optionally automatically create a service account
+                          token for the configured service account. If this is set
+                          to `true`, the operator will automatically create a service
+                          account token for the configured service account.
+                        type: boolean
                       identityId:
                         type: string
                       secretsScope:
@@ -163,6 +169,13 @@ spec:
                         - name
                         - namespace
                         type: object
+                      serviceAccountTokenAudiences:
+                        description: The audiences to use for the service account
+                          token. This is only relevant if `autoCreateServiceAccountToken`
+                          is true.
+                        items:
+                          type: string
+                        type: array
                     required:
                     - identityId
                     - secretsScope

k8-operator/config/rbac/role.yaml

@@ -16,6 +16,13 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - pods
+  verbs:
+  - get
+  - list
 - apiGroups:
   - ""
   resources:
@@ -35,6 +42,12 @@ rules:
   - get
   - list
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - serviceaccounts/token
+  verbs:
+  - create
 - apiGroups:
   - apps
   resources:
@@ -55,6 +68,12 @@ rules:
   - list
   - update
   - watch
+- apiGroups:
+  - authentication.k8s.io
+  resources:
+  - tokenreviews
+  verbs:
+  - create
 - apiGroups:
   - secrets.infisical.com
   resources: