From a213182b10a3d02d8dc8d0db7b617a2b408dc53f Mon Sep 17 00:00:00 2001 From: WanLinghao Date: Mon, 17 Dec 2018 12:42:45 +0800 Subject: [PATCH] Add description about BoundServiceAccountTokenVolume feature in serviceaccount admission controller (#11643) * Add description about BoundServiceAccountTokenVolume feature in serviceaccount admission controller * Update service-accounts-admin.md * Update service-accounts-admin.md --- .../reference/access-authn-authz/service-accounts-admin.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/content/en/docs/reference/access-authn-authz/service-accounts-admin.md b/content/en/docs/reference/access-authn-authz/service-accounts-admin.md index 7e030903bc..c8f41806c9 100644 --- a/content/en/docs/reference/access-authn-authz/service-accounts-admin.md +++ b/content/en/docs/reference/access-authn-authz/service-accounts-admin.md @@ -59,6 +59,10 @@ It acts synchronously to modify pods as they are created or updated. When this p 1. It adds a `volume` to the pod which contains a token for API access. 1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`. +Starting from v1.13, you can migrate a service account volume to a projected volume when +the `BoundServiceAccountTokenVolume` feature gate is enabled. +The service account token will expire after 1 hour or the pod is deleted. See more details about [projected volume](docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection). + ### Token Controller TokenController runs as part of controller-manager. It acts asynchronously. It: