Skip to main content
FieldTypeDescriptionValue(s)
issuerIssuerServiceAccountConfigThe service account issuer configuration.

This configures how the service accounts are issued in Kubernetes.
acceptedAcceptedServiceAccountConfigThe additional service accounts which are accepted by the Kubernetes API server.

This might be used for service account rotation, or for accepting service accounts from other clusters,
or for accepting service accounts from other issuers.

issuer

IssuerServiceAccountConfig configures the service account issuer.
FieldTypeDescriptionValue(s)
privateKeystringThe key which is used to sign the service account tokens.

This key is used to sign the service account tokens, and it is used by the Kubernetes API server to verify the service account tokens.
The key must be a valid PEM encoded RSA or ECDSA private key.
issuerURLURLThe issuer URL which is used to sign the service account tokens.

This URL is used to sign the service account tokens, and it is used by the Kubernetes API server to verify the service account tokens.

accepted

AcceptedServiceAccountConfig configures the accepted service accounts.
FieldTypeDescriptionValue(s)
publicKeys[]stringThe list of public keys which are used to verify the service account tokens.

These keys are used by the Kubernetes API server to verify the service account tokens.
The keys must be valid PEM encoded RSA or ECDSA public keys.
issuers[]URLThe additional service account issuers which are accepted by the Kubernetes API server.

This might be used for service account rotation, or for accepting service accounts from other clusters,
or for accepting service accounts from other issuers.
audiences[]stringThe list of API audiences for which the service account tokens are accepted by the Kubernetes API server.

If this field is not set, the default is to set to the issuer URL of the service account issuer.