whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update description about serviceaccount token controller

Browse Source 
This change specifies how to enable token controller in
controller-manager.
This commit is contained in:
Cao Shufeng
2017-03-31 00:59:06 -04:00
committed by Andrew Chen
parent 4391c903ce
commit 6aed52c088
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/admin/service-accounts-admin.md
+5
View File
@@ -64,6 +64,11 @@ TokenController runs as part of controller-manager. It acts asynchronously. It:
- observes secret addition, and ensures the referenced ServiceAccount exists, and adds a token to the secret if needed
- observes secret deletion and removes a reference from the corresponding ServiceAccount if needed
You must pass a service account private key file to the token controller in the controller-manager by using
the `--service-account-private-key-file` option. The private key will be used to sign generated service account tokens.
Similarly, you must pass the corresponding public key to the kube-apiserver using the `--service-account-key-file`
option. The public key will be used to verify the tokens during authentication.
#### To create additional API tokens
A controller loop ensures a secret with an API token exists for each service