Updating to 3.6.0 from 3.5.2 requires the Kiali Service account to be patched in

[p1-bot-repo-sync]

Bug

Upon migrating to 3.6.0 the Kiali pod will enter a crash loop

Description

Upgrading to 3.6.0 from 3.5.2 Kiali gets stuck in a crash loop with various errors in the kiali pod logs.

Describe the problem, what were you doing when you noticed the bug?
with the following errors:

kubectl logs kiali-776f4bf95b-vdg74 -n kiali

2025/09/05 15:54:03 maxprocs: Leaving GOMAXPROCS=8: CPU quota undefined 2025-09-05T15:54:03Z INF Kiali: Version: v2.14.0, Commit: ab7b9b634840b5d6f72d883e594f6449933214d2, Go: 1.24.2 2025-09-05T15:54:03Z INF DEPRECATION NOTICE: 'external_services.grafana.url' has been deprecated - switch to 'external_services.grafana.external_url' 2025-09-05T15:54:03Z INF DEPRECATION NOTICE: 'external_services.tracing.url' has been deprecated - switch to 'external_services.tracing.external_url' 2025-09-05T15:54:03Z INF Using authentication strategy [openid] 2025-09-05T15:54:03Z INF Some validation errors will be ignored [KIA1301]. If these errors do occur, they will still be logged. If you think the validation errors you see are incorrect, please report them to the Kiali team if you have not done so already and provide the details of your scenario. This will keep Kiali validations strong for the whole community. 2025-09-05T15:54:03Z ERR Error 'open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory' getting config for local cluster 2025-09-05T15:54:03Z WRN Cannot resolve local cluster name. Err: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory. Falling back to [Kubernetes] 2025-09-05T15:54:03Z ERR Error 'open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory' getting config for local cluster 2025-09-05T15:54:03Z FTL Failed to create client factory. Err: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
Provide any steps possible used to reproduce the error (ideally in an isolated fashion).
Just upgrading to the latest 3.6.0 version is what causes the error. The error can be fixed by -

kubectl -n kiali patch deploy kiali
--type='json'
-p='[{"op":"add","path":"/spec/template/spec/automountServiceAccountToken","value":true}]'

kubectl -n kiali rollout restart deploy kiali
kubectl -n kiali rollout status deploy kiali

The pod will restart and helm reconciles successfully

BigBang Version

3.6.0
What version of BigBang were you running?
3.5.2

[p1-bot-repo-sync]

rob.ferguson commented:

---

@pberrigan Are you using Kyverno?

[p1-bot-repo-sync]

pberrigan commented:

---

We've decided to hold off migrating to Kyverno at this time because of the LOE it would take to get it in our environment. Just ran into a lot of issues with the mutations that were blocking deployments of various applications.