Issue Summary

Microsoft Defender for Cloud flags the Jira DC deployment on Azure Kubernetes Service (AKS) as Unhealthy. This occurs because the application pods automatically mount the default Service Account API token, creating a container security risk.

Enterprise compliance frameworks dictate that the automountServiceAccountToken: false flag must be explicitly set at the pod level within the workload manifest.
Because the deployment utilizes the official atlassian/data-center-helm-charts framework, this parameter cannot be passed into the runtime manifests. The underlying templates inside the Helm chart completely lack the logical anchor blocks required to evaluate or render this flag into the final Kubernetes StatefulSet specification.

Steps to Reproduce

Configure your deployment values.yaml file to enforce rigorous container security constraints, including the dropping of all standard Linux capabilities

jira:
  containerSecurityContext:
    capabilities:
      drop:
        - ALL 

Attempt to append the pod-level configuration flag automountServiceAccountToken: false under the jira: block or the serviceAccount: block in an attempt to restrict token exposure. Execute a deployment using standard automation tooling

Expected Results

The Helm engine compiles the templates successfully, and the resulting StatefulSet manifest injects the security parameter onto the target specification

spec:
  template:
    spec:
      serviceAccountName: jira
      automountServiceAccountToken: false 

Actual Results

The parameter is entirely ignored during template evaluation because src/main/charts/jira/templates/statefulset.yaml has no conditional tracking logic for this variable. The compiled StatefulSet object defaults back to standard Kubernetes behavior, mounting the token securely into the secret volume path of every application container. Microsoft Defender for Cloud immediately marks the cluster deployment as Unhealthy under the "Least privileged Linux capabilities/Service Account enforcement" audit vectors.

Workaround

Currently there is no known workaround for this behavior. A workaround will be added here when available