1.24后serviceaccount token如何生成

背景

1.24前sa会自动创建secret,且配置token
1.24后不会,需要手动创建secret,然后token会自动配置

secret要求

data中token不存在或者为空
annotations中kubernetes.io/service-account.name对应的value为serviceaccount的名字,非空且实际存在

相关代码

pkg/controller/serviceaccount/tokens_controller.go中

func (e *TokensController) syncSecret(ctx context.Context) {
    ...
    if retriable, err := e.generateTokenIfNeeded(logger, sa, secret); err != nil {
                logger.Error(err, "Populating serviceaccount token", "secret", klog.KRef(secretInfo.namespace, secretInfo.name), "serviceAccount", klog.KRef(secretInfo.namespace, secretInfo.saName))
                retry = retriable
            }
    ...
}

func (e *TokensController) generateTokenIfNeeded(logger klog.Logger, serviceAccount *v1.ServiceAccount, cachedSecret *v1.Secret) ( /* retry */ bool, error) {
    ...
    needsCA, needsNamespace, needsToken := e.secretUpdateNeeded(liveSecret)
    if !needsCA && !needsToken && !needsNamespace {
        return false, nil
    }
    ...
    if needsToken {
        token, err := e.token.GenerateToken(serviceaccount.LegacyClaims(*serviceAccount, *liveSecret))
        if err != nil {
            return false, err
        }
        liveSecret.Data[v1.ServiceAccountTokenKey] = []byte(token)
    }
    ...
    liveSecret.Annotations[v1.ServiceAccountNameKey] = serviceAccount.Name
    liveSecret.Annotations[v1.ServiceAccountUIDKey] = string(serviceAccount.UID)
    ...
}


func (e *TokensController) secretUpdateNeeded(secret *v1.Secret) (bool, bool, bool) {
    caData := secret.Data[v1.ServiceAccountRootCAKey]
    needsCA := len(e.rootCA) > 0 && !bytes.Equal(caData, e.rootCA)

    needsNamespace := len(secret.Data[v1.ServiceAccountNamespaceKey]) == 0

    tokenData := secret.Data[v1.ServiceAccountTokenKey]
    needsToken := len(tokenData) == 0

    return needsCA, needsNamespace, needsToken
}


func (e *TokensController) queueSecretSync(obj interface{}) {
    if secret, ok := obj.(*v1.Secret); ok {
        e.syncSecretQueue.Add(makeSecretQueueKey(secret))
    }
}

func (e *TokensController) queueSecretUpdateSync(oldObj interface{}, newObj interface{}) {
    if secret, ok := newObj.(*v1.Secret); ok {
        e.syncSecretQueue.Add(makeSecretQueueKey(secret))
    }
}
func makeSecretQueueKey(secret *v1.Secret) interface{} {
    return secretQueueKey{
        namespace: secret.Namespace,
        name:      secret.Name,
        uid:       secret.UID,
        saName:    secret.Annotations[v1.ServiceAccountNameKey],
        saUID:     types.UID(secret.Annotations[v1.ServiceAccountUIDKey]),
    }
}