From baf379436b8b1598fc3a65b100f75148b88ae4d3 Mon Sep 17 00:00:00 2001 From: Shubham Kuchhal Date: Mon, 7 Jun 2021 17:33:58 +0530 Subject: [PATCH 1/2] Improvement: Managing Service Accounts --- .../access-authn-authz/service-accounts-admin.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/content/en/docs/reference/access-authn-authz/service-accounts-admin.md b/content/en/docs/reference/access-authn-authz/service-accounts-admin.md index ea04f462b1..867c9d0445 100644 --- a/content/en/docs/reference/access-authn-authz/service-accounts-admin.md +++ b/content/en/docs/reference/access-authn-authz/service-accounts-admin.md @@ -58,7 +58,7 @@ It acts synchronously to modify pods as they are created or updated. When this p 1. It ensures that the `ServiceAccount` referenced by the pod exists, and otherwise rejects it. 1. It adds a `volume` to the pod which contains a token for API access if neither the ServiceAccount `automountServiceAccountToken` nor the Pod's `automountServiceAccountToken` is set to `false`. 1. It adds a `volumeSource` to each container of the pod mounted at `/var/run/secrets/kubernetes.io/serviceaccount`, if the previous step has created a volume for ServiceAccount token. -1. If the pod does not contain any `ImagePullSecrets`, then `ImagePullSecrets` of the `ServiceAccount` are added to the pod. +1. If the pod does not contain any `imagePullSecrets`, then `imagePullSecrets` of the `ServiceAccount` are added to the pod. #### Bound Service Account Token Volume @@ -91,14 +91,14 @@ add the following projected volume instead of a Secret-based volume for the non- This projected volume consists of three sources: 1. A ServiceAccountToken acquired from kube-apiserver via TokenRequest API. It will expire after 1 hour by default or when the pod is deleted. It is bound to the pod and has kube-apiserver as the audience. -1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate being enabled, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` is enabled by default in 1.20, and always enabled in 1.21+. +1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` feature gate is graduated to GA in 1.21 and default to true.(This flag will be removed from --feature-gate arg in 1.22) 1. A DownwardAPI that references the namespace of the pod. See more details about [projected volumes](/docs/tasks/configure-pod-container/configure-projected-volume-storage/). -You can manually migrate a secret-based service account volume to a projected volume when +You can manually migrate a Secret-based service account volume to a projected volume when the `BoundServiceAccountTokenVolume` feature gate is not enabled by adding the above -projected volume to the pod spec. However, `RootCAConfigMap` needs to be enabled. +projected volume to the pod spec. ### Token Controller From 5cf02fde985df30e84beae6d580bd3434bd90af6 Mon Sep 17 00:00:00 2001 From: Shubham Kuchhal Date: Tue, 8 Jun 2021 11:08:11 +0530 Subject: [PATCH 2/2] Add Spaces. --- .../docs/reference/access-authn-authz/service-accounts-admin.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content/en/docs/reference/access-authn-authz/service-accounts-admin.md b/content/en/docs/reference/access-authn-authz/service-accounts-admin.md index 867c9d0445..0d4ecff08c 100644 --- a/content/en/docs/reference/access-authn-authz/service-accounts-admin.md +++ b/content/en/docs/reference/access-authn-authz/service-accounts-admin.md @@ -91,7 +91,7 @@ add the following projected volume instead of a Secret-based volume for the non- This projected volume consists of three sources: 1. A ServiceAccountToken acquired from kube-apiserver via TokenRequest API. It will expire after 1 hour by default or when the pod is deleted. It is bound to the pod and has kube-apiserver as the audience. -1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` feature gate is graduated to GA in 1.21 and default to true.(This flag will be removed from --feature-gate arg in 1.22) +1. A ConfigMap containing a CA bundle used for verifying connections to the kube-apiserver. This feature depends on the `RootCAConfigMap` feature gate, which publishes a "kube-root-ca.crt" ConfigMap to every namespace. `RootCAConfigMap` feature gate is graduated to GA in 1.21 and default to true. (This flag will be removed from --feature-gate arg in 1.22) 1. A DownwardAPI that references the namespace of the pod. See more details about [projected volumes](/docs/tasks/configure-pod-container/configure-projected-volume-storage/).