> ## Documentation Index
> Fetch the complete documentation index at: https://docs.siderolabs.com/llms.txt
> Use this file to discover all available pages before exploring further.

> KubeServiceAccountConfig configures Kubernetes service accounts.

# KubeServiceAccountConfig

```yaml theme={null}
apiVersion: v1alpha1
kind: KubeServiceAccountConfig
# The service account issuer configuration.
issuer:
    privateKey: '--- EXAMPLE PRIVATE KEY ---' # The key which is used to sign the service account tokens.
    issuerURL: https://my-control-plane:6443 # The issuer URL which is used to sign the service account tokens.
# The additional service accounts which are accepted by the Kubernetes API server.
accepted:
    # The list of public keys which are used to verify the service account tokens.
    publicKeys:
        - '--- EXAMPLE PUBLIC KEY ---'
    # The additional service account issuers which are accepted by the Kubernetes API server.
    issuers:
        - https://another-control-plane:6443
    # The list of API audiences for which the service account tokens are accepted by the Kubernetes API server.
    audiences:
        - https://another-control-plane:6443
        - https://my-control-plane:6443
```

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`issuer`</td>
      <td><a href="#issuer">IssuerServiceAccountConfig</a></td>
      <td>The service account issuer configuration.<br /><br />This configures how the service accounts are issued in Kubernetes.</td>

      <td />
    </tr>

    <tr>
      <td>`accepted`</td>
      <td><a href="#accepted">AcceptedServiceAccountConfig</a></td>
      <td>The additional service accounts which are accepted by the Kubernetes API server.<br /><br />This might be used for service account rotation, or for accepting service accounts from other clusters,<br />or for accepting service accounts from other issuers.</td>

      <td />
    </tr>
  </tbody>
</table>

## issuer

IssuerServiceAccountConfig configures the service account issuer.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`privateKey`</td>
      <td>string</td>
      <td>The key which is used to sign the service account tokens.<br /><br />This key is used to sign the service account tokens, and it is used by the Kubernetes API server to verify the service account tokens.<br />The key must be a valid PEM encoded RSA or ECDSA private key.</td>

      <td />
    </tr>

    <tr>
      <td>`issuerURL`</td>
      <td>URL</td>
      <td>The issuer URL which is used to sign the service account tokens.<br /><br />This URL is used to sign the service account tokens, and it is used by the Kubernetes API server to verify the service account tokens.</td>

      <td />
    </tr>
  </tbody>
</table>

## accepted

AcceptedServiceAccountConfig configures the accepted service accounts.

<table>
  <thead>
    <tr>
      <th>Field</th>
      <th>Type</th>
      <th>Description</th>
      <th>Value(s)</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>`publicKeys`</td>
      <td>\[]string</td>
      <td>The list of public keys which are used to verify the service account tokens.<br /><br />These keys are used by the Kubernetes API server to verify the service account tokens.<br />The keys must be valid PEM encoded RSA or ECDSA public keys.</td>

      <td />
    </tr>

    <tr>
      <td>`issuers`</td>
      <td>\[]URL</td>
      <td>The additional service account issuers which are accepted by the Kubernetes API server.<br /><br />This might be used for service account rotation, or for accepting service accounts from other clusters,<br />or for accepting service accounts from other issuers.</td>

      <td />
    </tr>

    <tr>
      <td>`audiences`</td>
      <td>\[]string</td>
      <td>The list of API audiences for which the service account tokens are accepted by the Kubernetes API server.<br /><br />If this field is not set, the default is to set to the issuer URL of the service account issuer.</td>

      <td />
    </tr>
  </tbody>
</table>