whentimeslows/website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update doc for BoundServiceAccountTokenVolume and RootCAConfigMap

Browse Source
This commit is contained in:
Shihang Zhang
2021-03-25 17:33:48 -07:00
parent 9ae3e5c8c9
commit 7a461e5f13
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/en/docs/reference/access-authn-authz/service-accounts-admin.md
+2 -3
View File
@@ -60,9 +60,9 @@ It acts synchronously to modify pods as they are created or updated. When this p
1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`.
#### Bound Service Account Token Volume
{{< feature-state for_k8s_version="v1.13" state="alpha" >}}
{{< feature-state for_k8s_version="v1.21" state="beta" >}}
When the `BoundServiceAccountTokenVolume` feature gate is enabled, the service account admission controller will
When the `BoundServiceAccountTokenVolume` [feature gate](/docs/reference/command-line-tools-reference/feature-gates/) is enabled, the service account admission controller will
add a projected service account token volume instead of a secret volume. The service account token will expire after 1 hour by default or the pod is deleted. See more details about [projected volume](/docs/tasks/configure-pod-container/configure-projected-volume-storage/).
This feature depends on the `RootCAConfigMap` feature gate enabled which publish a "kube-root-ca.crt" ConfigMap to every namespace. This ConfigMap contains a CA bundle used for verifying connections to the kube-apiserver.
@@ -140,4 +140,3 @@ kubectl delete secret mysecretname
A ServiceAccount controller manages the ServiceAccounts inside namespaces, and
ensures a ServiceAccount named "default" exists in every active namespace.