The TokenRequest API provides Service Account credentials for pods that need to authenticate to the Kubernetes API. Kubernetes mounts these credentials through a projected volume rather than creating long-lived token Secrets by default. section 3.3 section 3.1
Operational points to remember:
- Works with RBAC: authentication identifies the Service Account, while roles and role bindings determine permitted operations. section 3.1
- Replaces the older pattern of automatically generated long-term credential Secrets in newer Kubernetes versions. section 3.3
Verify a pod's projected Service Account token
After creating an nginx pod, run `kubectl get po nginx -o yaml | grep volumeMounts -A14` to confirm the Service Account mount. Then use `kubectl exec -it nginx -- sh` and read `/var/run/secrets/kubernetes.io/serviceaccount/token` to inspect the mounted credential.
