ServiceAccount token

As explained in Acing the Certified Kubernetes Administrator Exam, Second Edition

A service account token is a credential associated with a Kubernetes ServiceAccount that authenticates workload requests to the Kubernetes API.

A ServiceAccount token authenticates workload requests to the Kubernetes API. Pods commonly use ServiceAccounts for machine-to-machine authentication, while human kubectl requests typically use client certificates or external identity providers. section 3.1

Operational points:

• Kubernetes manages ServiceAccounts as native resources associated with pods. section 3.1
• A token is mounted into the pod through the TokenRequest API and can authenticate API requests. section 3.1
• Applications usually do not need API access, so automatic token mounting can be disabled. section 3.1

Inspect the default ServiceAccount

Run `kubectl get sa` to inspect available ServiceAccounts. A typical result includes the `default` ServiceAccount in the current namespace. section 3.1

Figure 3.2 The TokenRequest API can generate a short-lived token to authenticate to the Kubernetes API. The token expires when the pod is terminated.

The TokenRequest API generates a short-lived token for Kubernetes API authentication; the token expires when its pod is terminated. section 3.1

How Acing the Certified Kubernetes Administrator Exam, Second Edition covers it

How deep it goes

Explains ServiceAccounts, TokenRequest mounting, short-lived tokens, and disabling automatic mounting; it stops short of detailed configuration.

Examples

Uses kubectl get sa output and a TokenRequest-based short-lived token mounted into a pod.

What you can do after

Evaluate/understand how workloads authenticate to the Kubernetes API and when automatic token mounting is unnecessary.

How it connects

Connects ServiceAccount tokens with Kubernetes API authentication, pods, TokenRequest API, bearer tokens, and RBAC.

liveBookmanning.com

Read Acing the Certified Kubernetes Administrator Exam, Second Edition on liveBook Get the book at manning.com

Related concepts

• TokenRequest APIproduced by · The TokenRequest API is a Kubernetes API interface for obtaining tokens associated with Service Accounts.
• service accountproduced by · A service account is a non-human identity or account used by software, services, or automated processes to authenticate and access authorized resources.
• API keyalternative to · An API key is a credential used to identify or authorize a client accessing an application programming interface.
• security tokenkind of · A security token is a credential or assertion presented to a service to convey authenticated identity, authorization, or session information.

This explainer was generated by Manning's knowledge graph from the text of Acing the Certified Kubernetes Administrator Exam, Second Edition. The section links point to the parts of the book it draws on.