liveBook · Manning

Kube-api-access volume

As explained in Kubernetes in Action, Second Edition

The kube-api-access volume is a built-in projected volume that provides a pod with credentials and cluster information for accessing the Kubernetes API.

A kube-api-access volume is a projected volume automatically added to almost every pod. It gives containers the files needed to access the Kubernetes API: a service-account token, the cluster CA certificate, and the pod's namespace. section 9.5.6

The volume combines three sources into one mounted directory:

  • serviceAccountToken projects the API token as token. section 9.5.6
  • The kube-root-ca.crt ConfigMap projects ca.crt. section 9.5.6
  • The downward API projects metadata.namespace as namespace. section 9.5.6

Inspecting the generated volume

Run kubectl get pod <pod-name> -o yaml and inspect .spec.volumes. The generated entry has a projected type, a kube-api-access name, and sources for token, ca.crt, and namespace. section 9.5.6

Listing 9.16 The kube-api-access volume built into almost every pod 
volumes:
- name: kube-api-access-gc7lf      #1
  projected:                       #1
    defaultMode: 420
    sources:                    #2
      - serviceAccountToken:           #3
          expirationSeconds: 3607      #3
          path: token                  #3
      - configMap:                   #4
          items:                     #4
            - key: ca.crt            #4
              path: ca.crt           #4
          name: kube-root-ca.crt     #4
      - downwardAPI:                               #5
          items:                                   #5
            - fieldRef:                            #5
                apiVersion: v1                     #5
                fieldPath: metadata.namespace      #5
              path: namespace                      #5

The manifest shows how service-account, ConfigMap, and downward API sources create the built-in volume. section 9.5.6

Most pods do not need API access. Disable automatic mounting with spec.automountServiceAccountToken: false, or configure the same setting on the ServiceAccount, to follow least privilege. section 9.5.6

How Kubernetes in Action, Second Edition covers it

How deep it goes
Explains the projected sources and generated files, then stops short of detailing API client behavior.
Examples
Uses pod YAML inspection and a manifest containing token, ca.crt, and namespace projections.
What it assumes
Assumes basic familiarity with pods, projected volumes, ConfigMaps, ServiceAccounts, and the downward API.
What you can do after
Operate/configure API access by inspecting generated volumes and disabling unnecessary service-account-token mounting.
How it connects
Connects projected volumes with ServiceAccounts, ConfigMaps, the downward API, and least-privilege access.
Cover of Kubernetes in Action, Second Edition
liveBookmanning.com
Read Kubernetes in Action, Second Edition on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Kubernetes in Action, Second Edition. The section links point to the parts of the book it draws on.