Service Account Token Volume Projection
The Service Account Token Volume Projection
feature of Kubernetes allows projection of time and audience-bound service account tokens into Pods. This feature
is used by some applications to enhance security when using service accounts
(e.g. Istio uses it by default as of version v1.3).
As of KKP version v2.16, KKP supports Service Account Token Volume Projection as follows:
- in clusters with Kubernetes version v1.20+, it is enabled by default with the default configuration as described below,
- in clusters with Kubernetes below v1.20, it has to be explicitly enabled.
TokenRequestProjection Kubernetes feature gates have to be enabled (enabled by default since
Kubernetes v1.11 and v1.12 respectively).
In KKP v2.16, the Service Account Token Volume Projection feature can be configured only via KKP API.
Cluster API object provides the
serviceAccount field of the
ServiceAccountSettings type, with the following definition:
"description": "Issuer is the identifier of the service account token issuer. If this is not specified, it will be set to the URL of apiserver by default",
"description": "APIAudiences are the Identifiers of the API. If this is not specified, it will be set to a single element list containing the issuer URL",
The following table summarizes the supported properties of the
|Enables the Service Account Token Volume Projection feature.|
false for clusters with Kubernetes version below v1.20,
true for clusters with Kubernetes v1.20+.
|Identifier of the service account token issuer. The issuer will assert this identifier in |
iss claim of issued tokens.
|The URL of the apiserver, e.g., |
|Identifiers of the API. The service account token authenticator will validate that tokens used against the API are bound to at least one of these audiences. Multiple audiences can be separated by comma (|
|Equal to |
Example: Configuration using a request to KKP API
To configure the feature in an existing cluster, execute a
PATCH request to URL:
with the following content:
You can use the Swagger UI at
https://<your-kubermatic-domain>/rest-api to construct and send the API request.
Example: Configuration using Cluster CR
Alternatively, the feature can be also configured via the
Cluster Custom Resource in the KKP seed cluster.
For example, to enable the feature in an existing cluster via kubectl, edit the
Cluster CR with
kubectl edit cluster <cluster-id> and add the following configuration: