From 6aed52c08879de0fa9bf2139568632fd6237f990 Mon Sep 17 00:00:00 2001 From: Cao Shufeng Date: Fri, 31 Mar 2017 00:59:06 -0400 Subject: [PATCH] Update description about serviceaccount token controller This change specifies how to enable token controller in controller-manager. --- docs/admin/service-accounts-admin.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/admin/service-accounts-admin.md b/docs/admin/service-accounts-admin.md index 0c7b495a10..3fa6ef492f 100644 --- a/docs/admin/service-accounts-admin.md +++ b/docs/admin/service-accounts-admin.md @@ -64,6 +64,11 @@ TokenController runs as part of controller-manager. It acts asynchronously. It: - observes secret addition, and ensures the referenced ServiceAccount exists, and adds a token to the secret if needed - observes secret deletion and removes a reference from the corresponding ServiceAccount if needed +You must pass a service account private key file to the token controller in the controller-manager by using +the `--service-account-private-key-file` option. The private key will be used to sign generated service account tokens. +Similarly, you must pass the corresponding public key to the kube-apiserver using the `--service-account-key-file` +option. The public key will be used to verify the tokens during authentication. + #### To create additional API tokens A controller loop ensures a secret with an API token exists for each service