Skip to content

Commit bd6541b

Browse files
committed
Rewrite Security information about LegacyServiceAccountTokenNoAutoGeneration feature gate
1 parent b4f32fa commit bd6541b

File tree

1 file changed

+5
-7
lines changed

1 file changed

+5
-7
lines changed

content/en/docs/concepts/security/service-accounts.md

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -180,13 +180,11 @@ following methods:
180180
rotates the token before it expires.
181181
* [Service Account Token Secrets](/docs/tasks/configure-pod-container/configure-service-account/#manually-create-an-api-token-for-a-serviceaccount)
182182
(not recommended): You can mount service account tokens as Kubernetes
183-
Secrets in Pods. These tokens don't expire and don't rotate.
184-
This method is not recommended, especially at scale, because of the risks associated
185-
with static, long-lived credentials. In Kubernetes v1.24 and later, the
186-
[LegacyServiceAccountTokenNoAutoGeneration feature gate](/docs/reference/command-line-tools-reference/feature-gates/#feature-gates-for-graduated-or-deprecated-features)
187-
prevents Kubernetes from automatically creating these tokens for
188-
ServiceAccounts. `LegacyServiceAccountTokenNoAutoGeneration` is enabled
189-
by default; in other words, Kubernetes does not create these tokens.
183+
Secrets in Pods. These tokens don't expire and don't rotate. In versions prior to v1.24, a permanent token was automatically created for each service account.
184+
This method is not recommended anymore, especially at scale, because of the risks associated
185+
with static, long-lived credentials. The [LegacyServiceAccountTokenNoAutoGeneration feature gate](/docs/reference/command-line-tools-reference/feature-gates-removed)
186+
(which was enabled by default from Kubernetes v1.24 to v1.26), prevented Kubernetes from automatically creating these tokens for
187+
ServiceAccounts. The feature gate is removed in v1.27, because it was elevated to GA status; you can still create indefinite service account tokens manually, but should take into account the security implications.
190188

191189
{{< note >}}
192190
For applications running outside your Kubernetes cluster, you might be considering

0 commit comments

Comments
 (0)