You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
prevents Kubernetes from automatically creating these tokens for
188
-
ServiceAccounts. `LegacyServiceAccountTokenNoAutoGeneration` is enabled
189
-
by default; in other words, Kubernetes does not create these tokens.
183
+
Secrets in Pods. These tokens don't expire and don't rotate. In versions prior to v1.24, a permanent token was automatically created for each service account.
184
+
This method is not recommended anymore, especially at scale, because of the risks associated
185
+
with static, long-lived credentials. The [LegacyServiceAccountTokenNoAutoGeneration feature gate](/docs/reference/command-line-tools-reference/feature-gates-removed)
186
+
(which was enabled by default from Kubernetes v1.24 to v1.26), prevented Kubernetes from automatically creating these tokens for
187
+
ServiceAccounts. The feature gate is removed in v1.27, because it was elevated to GA status; you can still create indefinite service account tokens manually, but should take into account the security implications.
190
188
191
189
{{< note >}}
192
190
For applications running outside your Kubernetes cluster, you might be considering
0 commit comments