whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #28570 from zshihang/main

Browse Source 
update doc for BoundServiceAccountTokenVolume ga
This commit is contained in:
Kubernetes Prow Robot
2021-06-24 01:17:41 -07:00
committed by GitHub
parent e53208d4f3 3a9b198beb
commit 369169dbb3
2 changed files with 5 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
+2 -7
View File
@@ -62,10 +62,9 @@ It acts synchronously to modify pods as they are created or updated. When this p
#### Bound Service Account Token Volume
{{< feature-state for_k8s_version="v1.21" state="beta" >}}
{{< feature-state for_k8s_version="v1.22" state="stable" >}}
When the `BoundServiceAccountTokenVolume` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) is enabled, the service account admission controller will
add the following projected volume instead of a Secret-based volume for the non-expiring service account token created by Token Controller.
The ServiceAccount admission controller will add the following projected volume instead of a Secret-based volume for the non-expiring service account token created by Token Controller.
```yaml
- name: kube-api-access-<random-suffix>
@@ -96,10 +95,6 @@ This projected volume consists of three sources:
See more details about [projected volumes](/docs/tasks/configure-pod-container/configure-projected-volume-storage/).
You can manually migrate a Secret-based service account volume to a projected volume when
the `BoundServiceAccountTokenVolume` feature gate is not enabled by adding the above
projected volume to the pod spec.
### Token Controller
TokenController runs as part of `kube-controller-manager`. It acts asynchronously. It: