security(umami): disposition CKV_K8S_38 — the provisioning Lease client needs its SA token #3198

🤖 Generated by the Agentic Engineer

Evidence

CKV_K8S_38 ("Ensure that Service Account Tokens are only mounted where necessary") fails on
CronJob.umami.umami-provision-tenants. Reproduced with the repository's own
scripts/megalinter-scan-counts.sh at main (9a84e92b): 3 failing checkov checks, of which
this is one — the other two are the CKV_K8S_40 pair tracked by #2904.

It appeared after #3116 and #3122 reworked this CronJob's credential handling; it is the last
finding on this workload.

Why the token is necessary

The check is a false positive here, and the reason is verifiable in the manifests rather than
asserted:

• The provisioning script reads /var/run/secrets/kubernetes.io/serviceaccount/{token,namespace,ca.crt}
  and calls coordination.k8s.io/v1 directly (KUBERNETES_SERVICE_HOST) to hold a Lease, which
  serialises the scheduled and bootstrap provisioners against each other.
• role-provision-tenants.yaml grants exactly get + update on leases, narrowed by
  resourceNames to the single umami-provision-tenants Lease. No Secrets, no workloads, no other
  coordination object.
• service-account-provision-tenants.yaml keeps the account-level default
  automountServiceAccountToken: false, so the token is opted into per pod, not granted broadly.

That is already the least-privilege shape the check exists to encourage: the token is both required
and minimally scoped. Removing the mount would break run serialisation; there is nothing left to
tighten.

Expected behaviour

The finding is dispositioned with a scoped, stated reason, matching the existing
checkov.io/skip1 on this same CronJob and the pattern used in vault-backup/job.yaml — never a
blanket disable.

Acceptance criteria

• CKV_K8S_38 no longer counts toward the checkov total on main.
• The suppression is scoped to this one check on this one resource and states the real reason.
• The stated reason is checked against the manifests it describes (security(k8s): CKV_K8S_40 needs one risk acceptance, not 11 per-site constraints #2904's rule), not asserted.

Rough size: small — one annotation plus its rationale comment.

Part of #2787.