Mount ServiceAccount token when dcgm-exporter env needs API access

[rajathagasthya]

Description

The dcgm-exporter DaemonSet sets automountServiceAccountToken=false and re-enables it only when pod metadata enrichment is turned on through enablePodLabels/enablePodUID fields. Users who configure the same features through dcgmExporter.env are missed by that condition, and setting DCGM_EXPORTER_CONFIGMAP_DATA crashes the exporter on startup since it cannot read the ServiceAccount token. This worked before the token was made opt-in.

Mount the token when the user-provided env reads a ConfigMap or enables pod labels/pod UID. A DCGM_EXPORTER_CONFIGMAP_DATA value of none` is the exporter default meaning no ConfigMap is read, so it does not count. Configurations that make no API calls keep the default.

Apply the same env check to the cluster-scoped RBAC gate. Enrichment through raw env otherwise got a token but no matching permissions, leaving the pod informer with only the namespaced Role, which grants pod reads in the operator namespace without watch. The ConfigMap case keeps a separate condition since it needs no cluster-scoped RBAC: the namespaced Role already grants configmaps get/list and its RoleBinding is ungated.

Testing

Metrics are available when DCGM_EXPORTER_CONFIGMAP_DATA is set:

kubectl create configmap -n gpu-operator custom-metrics --from-literal=metrics=\
'DCGM_FI_DEV_GPU_TEMP, gauge, GPU temperature (in C).
DCGM_FI_DEV_POWER_USAGE, gauge, Power draw (in W).'

kubectl patch clusterpolicy cluster-policy --type merge -p \
'{"spec":{"dcgmExporter":{"enablePodLabels":false,"enablePodUID":false,"env":[{"name":"DCGM_EXPORTER_CONFIGMAP_DATA","value":"gpu-operator:custom-metrics"}]}}}'

Metrics are available when pod enrichment is set via env:

kubectl patch clusterpolicy cluster-policy --type merge -p \
'{"spec":{"dcgmExporter":{"env":[{"name":"DCGM_EXPORTER_KUBERNETES_ENABLE_POD_LABELS","value":"true"}]}}}'

Checklist

• No secrets, sensitive information, or unrelated changes
• Lint checks passing (make lint)
• Generated assets in-sync (make validate-generated-assets)
• Go mod artifacts in-sync (make validate-modules)
• Test cases are added for new code paths