Merge pull request #25969 from ydFu/add-code-blocks-in-configure-service-account
Add Code blocks in configure-service-account.mdpull/25979/head
commit
8fea26ecba
|
@ -82,6 +82,7 @@ You can list this and any other serviceAccount resources in the namespace with t
|
||||||
```shell
|
```shell
|
||||||
kubectl get serviceaccounts
|
kubectl get serviceaccounts
|
||||||
```
|
```
|
||||||
|
|
||||||
The output is similar to this:
|
The output is similar to this:
|
||||||
|
|
||||||
```
|
```
|
||||||
|
@ -108,9 +109,10 @@ If you get a complete dump of the service account object, like this:
|
||||||
```shell
|
```shell
|
||||||
kubectl get serviceaccounts/build-robot -o yaml
|
kubectl get serviceaccounts/build-robot -o yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
The output is similar to this:
|
The output is similar to this:
|
||||||
|
|
||||||
```
|
```yaml
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: ServiceAccount
|
kind: ServiceAccount
|
||||||
metadata:
|
metadata:
|
||||||
|
@ -164,6 +166,7 @@ Any tokens for non-existent service accounts will be cleaned up by the token con
|
||||||
```shell
|
```shell
|
||||||
kubectl describe secrets/build-robot-secret
|
kubectl describe secrets/build-robot-secret
|
||||||
```
|
```
|
||||||
|
|
||||||
The output is similar to this:
|
The output is similar to this:
|
||||||
|
|
||||||
```
|
```
|
||||||
|
@ -227,7 +230,7 @@ kubectl get serviceaccounts default -o yaml > ./sa.yaml
|
||||||
|
|
||||||
The output of the `sa.yaml` file is similar to this:
|
The output of the `sa.yaml` file is similar to this:
|
||||||
|
|
||||||
```shell
|
```yaml
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: ServiceAccount
|
kind: ServiceAccount
|
||||||
metadata:
|
metadata:
|
||||||
|
@ -244,7 +247,7 @@ Using your editor of choice (for example `vi`), open the `sa.yaml` file, delete
|
||||||
|
|
||||||
The output of the `sa.yaml` file is similar to this:
|
The output of the `sa.yaml` file is similar to this:
|
||||||
|
|
||||||
```shell
|
```yaml
|
||||||
apiVersion: v1
|
apiVersion: v1
|
||||||
kind: ServiceAccount
|
kind: ServiceAccount
|
||||||
metadata:
|
metadata:
|
||||||
|
@ -319,7 +322,8 @@ kubectl create -f https://k8s.io/examples/pods/pod-projected-svc-token.yaml
|
||||||
```
|
```
|
||||||
|
|
||||||
The kubelet will request and store the token on behalf of the pod, make the
|
The kubelet will request and store the token on behalf of the pod, make the
|
||||||
token available to the pod at a configurable file path, and refresh the token as it approaches expiration. Kubelet proactively rotates the token if it is older than 80% of its total TTL, or if the token is older than 24 hours.
|
token available to the pod at a configurable file path, and refresh the token as it approaches expiration.
|
||||||
|
The kubelet proactively rotates the token if it is older than 80% of its total TTL, or if the token is older than 24 hours.
|
||||||
|
|
||||||
The application is responsible for reloading the token when it rotates. Periodic reloading (e.g. once every 5 minutes) is sufficient for most use cases.
|
The application is responsible for reloading the token when it rotates. Periodic reloading (e.g. once every 5 minutes) is sufficient for most use cases.
|
||||||
|
|
||||||
|
@ -380,7 +384,6 @@ JWKS URI is required to use the `https` scheme.
|
||||||
|
|
||||||
## {{% heading "whatsnext" %}}
|
## {{% heading "whatsnext" %}}
|
||||||
|
|
||||||
|
|
||||||
See also:
|
See also:
|
||||||
|
|
||||||
- [Cluster Admin Guide to Service Accounts](/docs/reference/access-authn-authz/service-accounts-admin/)
|
- [Cluster Admin Guide to Service Accounts](/docs/reference/access-authn-authz/service-accounts-admin/)
|
||||||
|
|
Loading…
Reference in New Issue