Use service account token volume projection

When you create a Kubernetes cluster, you can enable service account token volume projection to enhance security when you use service accounts. This feature enables the kubelet to request and store the token on behalf of the pod, and allows you to configure token properties such as the audience and validity duration. As the token approaches expiration, the kubelet proactively rotates the token if it is older than 80 percent of its time to live (TTL) or if it is older than 24 hours. This topic describes how to configure and use service account token volume projection in Container Service.

Step 1: Enable service account token volume projection

When you create a cluster, select the Enable check box to enable service account token volume projection. For more information about creating a cluster, see Create an ACK cluster.

When service account token volume projection is enabled, system components apiserver and controller-manager will automatically enable BoundServiceAccountTokenVolume feature gate and the following parameters will be added to apiserver startup parameters.

Parameter	Description	Default	Configure through console
service-account-issuer	The issuer of the service account token, which corresponds to the iss field in the token payload.	kubernetes.default.svc	Supported
api-audiences	The identifiers of the API, which are used to validate the tokens at the API server side.	kubernetes.default.svc	Supported. You can set one or more audiences. Separate multiple audiences with commas (,).
service-account-signing-key-file	The file path of the private key that signs the token.	/etc/kubernetes/pki/sa.key	Not supported. Default is /etc/kubernetes/pki/sa.key.

kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: build-robot
EOF

apiVersion: v1
kind: Pod
metadata:
  name: nginx
spec:
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /var/run/secrets/tokens
      name: vault-token
  serviceAccountName: build-robot
  volumes:
  - name: vault-token
    projected:
      sources:
      - serviceAccountToken:
          path: vault-token
          expirationSeconds: 7200
          audience: vault