From 2ca239ddfcabe8584f2aa1998946a842bbfb4433 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=B4me=20Petazzoni?= Date: Wed, 17 Aug 2022 14:18:15 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=94=92=EF=B8=8F=20Mention=20bound=20servi?= =?UTF-8?q?ce=20account=20tokens?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- slides/k8s/authn-authz.md | 28 +++++++++++++++++++++++++++- 1 file changed, 27 insertions(+), 1 deletion(-) diff --git a/slides/k8s/authn-authz.md b/slides/k8s/authn-authz.md index d2e3b339..75ef0b2e 100644 --- a/slides/k8s/authn-authz.md +++ b/slides/k8s/authn-authz.md @@ -246,7 +246,7 @@ class: extra-details (they don't require hand-editing a file and restarting the API server) -- A service account is associated with a set of secrets +- A service account can be associated with a set of secrets (the kind that you can view with `kubectl get secrets`) @@ -256,6 +256,28 @@ class: extra-details --- +## Service account tokens evolution + +- In Kubernetes 1.21 and above, pods use *bound service account tokens*: + + - these tokens are *bound* to a specific object (e.g. a Pod) + + - they are automatically invalidated when the object is deleted + + - these tokens also expire quickly (e.g. 1 hour) and gets rotated automatically + +- In Kubernetes 1.24 and above, unbound tokens aren't created automatically + + - before 1.24, we would see unbound tokens with `kubectl get secrets` + + - with 1.24 and above, these tokens can be created with `kubectl create token` + + - ...or with a Secret with the right [type and annotation][create-token] + +[create-token]: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#to-create-additional-api-tokens + +--- + class: extra-details ## Checking our authentication method @@ -390,6 +412,10 @@ class: extra-details It should be named `default-token-XXXXX`. +When running Kubernetes 1.24 and above, this Secret won't exist. +
+Instead, create a token with `kubectl create token default`. + --- class: extra-details