对于 ServiceAccounts 及其 Secrets 的重大变动

kubernetes v1.24.0 更新之后进行创立 ServiceAccount 不会主动生成 Secret 须要对其手动创立

创立 ServiceAccount

cat<<EOF | kubectl apply -f -apiVersion: v1kind: ServiceAccountmetadata:  name: cby  namespace: defaultEOF

查看 ServiceAccount

root@cby:~# kubectl get serviceaccounts cbyNAME                     SECRETS   AGEcby                      0         9s

查看 ServiceAccount 具体具体，没有对 Token 进行创立

root@cby:~# kubectl describe serviceaccounts cbyName:                cbyNamespace:           defaultLabels:              <none>Annotations:         <none>Image pull secrets:  <none>Mountable secrets:   <none>Tokens:              <none>Events:              <none>root@cby:~# root@cby:~# kubectl get secretsNo resources found in default namespace.root@cby:~#

创立 Secret 资源并与 ServiceAccount 关联

cat<<EOF | kubectl apply -f -apiVersion: v1kind: Secrettype: kubernetes.io/service-account-tokenmetadata:  name: cby  annotations:    kubernetes.io/service-account.name: "cby"EOF

再次查看 ServiceAccount 已对 Secret 关联

root@cby:~# kubectl describe serviceaccounts cbyName:                cbyNamespace:           defaultLabels:              <none>Annotations:         <none>Image pull secrets:  <none>Mountable secrets:   <none>Tokens:              cbyEvents:              <none>root@cby:~#

查看 Secret 具体具体

root@cby:~# kubectl get secrets cby NAME   TYPE                                  DATA   AGEcby    kubernetes.io/service-account-token   3      35sroot@cby:~# root@cby:~# kubectl describe secrets cby Name:         cbyNamespace:    defaultLabels:       <none>Annotations:  kubernetes.io/service-account.name: cby              kubernetes.io/service-account.uid: c6629b84-1c08-483d-9a12-c2930ac0a2feType:  kubernetes.io/service-account-tokenData====ca.crt:     1363 bytesnamespace:  7 bytestoken:      eyJhbGciOiJSUzI1NiIsImtpZCI6IjRwMk02VU9leXU3N3lraUN6UVQ4R3I3Smw3eFhYdEVMX1Z2aTFjU2luSVEifQ.eyJpc3MiOiJrdWJlcm5ldGVzL3NlcnZpY2VhY2NvdW50Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9uYW1lc3BhY2UiOiJkZWZhdWx0Iiwia3ViZXJuZXRlcy5pby9zZXJ2aWNlYWNjb3VudC9zZWNyZXQubmFtZSI6ImNieSIsImt1YmVybmV0ZXMuaW8vc2VydmljZWFjY291bnQvc2VydmljZS1hY2NvdW50Lm5hbWUiOiJjYnkiLCJrdWJlcm5ldGVzLmlvL3NlcnZpY2VhY2NvdW50L3NlcnZpY2UtYWNjb3VudC51aWQiOiJjNjYyOWI4NC0xYzA4LTQ4M2QtOWExMi1jMjkzMGFjMGEyZmUiLCJzdWIiOiJzeXN0ZW06c2VydmljZWFjY291bnQ6ZGVmYXVsdDpjYnkifQ.r0nHVPO-QY-1p0fwKx0p0AfkiCGpTZ8vGzE8ioDtih5cAP1ew3ABnrj01EqeIEn8vhz29i0NHtZfh5XtYttqjU6o_b1IGFtkW5uIwlxYX2gtmm9njsL2NM7YM6lM0BDfQXvYrpKUuWLQUR-8i79h-GH9WFydmEwnthdxit7uSMJIZuyZP0X0ebxWUg1GGHsqNPy514zXEyvTZh8vs4fVl5ROJbKzFuSuQ1TntXMDncHSf8DSJ7iHUZ0pD757ysHvFKH9l6IbGrt8GUvxWxjMvnNjclLozKgfLXQEOVei39VrPU5DtsPp9DU8C04Gn4TWFW_WsyEWM14lGsQEGD-2QAroot@cby:~#

删除 ServiceAccount 随之 Secret 一并主动删除

root@cby:~# kubectl delete serviceaccounts cby serviceaccount "cby" deletedroot@cby:~#root@cby:~# kubectl get serviceaccountsroot@cby:~# kubectl get secret
https://www.oiox.cn/
https://www.chenby.cn/
https://cby-chen.github.io/
https://blog.csdn.net/qq\_33921750
https://my.oschina.net/u/3981543
https://www.zhihu.com/people/...
https://segmentfault.com/u/hp...
https://juejin.cn/user/331578...
https://cloud.tencent.com/dev...
https://www.jianshu.com/u/0f8...
https://www.toutiao.com/c/use...
CSDN、GitHub、知乎、开源中国、思否、掘金、简书、腾讯云、今日头条、集体博客、全网可搜《小陈运维》
文章次要公布于微信公众号：《Linux运维交换社区》