| Field | Type | Description | Value(s) |
|---|---|---|---|
issuer | IssuerServiceAccountConfig | The service account issuer configuration. This configures how the service accounts are issued in Kubernetes. | |
accepted | AcceptedServiceAccountConfig | The additional service accounts which are accepted by the Kubernetes API server. This might be used for service account rotation, or for accepting service accounts from other clusters, or for accepting service accounts from other issuers. |
issuer
IssuerServiceAccountConfig configures the service account issuer.| Field | Type | Description | Value(s) |
|---|---|---|---|
privateKey | string | The key which is used to sign the service account tokens. This key is used to sign the service account tokens, and it is used by the Kubernetes API server to verify the service account tokens. The key must be a valid PEM encoded RSA or ECDSA private key. | |
issuerURL | URL | The issuer URL which is used to sign the service account tokens. This URL is used to sign the service account tokens, and it is used by the Kubernetes API server to verify the service account tokens. |
accepted
AcceptedServiceAccountConfig configures the accepted service accounts.| Field | Type | Description | Value(s) |
|---|---|---|---|
publicKeys | []string | The list of public keys which are used to verify the service account tokens. These keys are used by the Kubernetes API server to verify the service account tokens. The keys must be valid PEM encoded RSA or ECDSA public keys. | |
issuers | []URL | The additional service account issuers which are accepted by the Kubernetes API server. This might be used for service account rotation, or for accepting service accounts from other clusters, or for accepting service accounts from other issuers. | |
audiences | []string | The list of API audiences for which the service account tokens are accepted by the Kubernetes API server. If this field is not set, the default is to set to the issuer URL of the service account issuer. |