Reword tasks relating to ServiceAccounts #33654

sftim · 2022-05-13T18:27:49Z

Account for TokenRequest API now being the default
- example
- example
- example
General rewording

This adapts and supersedes PR #14681.

/sig auth

netlify · 2022-05-13T18:42:16Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`a4629cd`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/63534de308064d000871dc0f
😎 Deploy Preview	https://deploy-preview-33654--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

sftim · 2022-07-14T07:39:45Z

I recommend getting a technical review from SIG Auth for this one.

raesene · 2022-07-14T07:45:47Z

content/en/docs/reference/access-authn-authz/service-accounts-admin.md

+   - If the spec of the incoming Pod does already contain any `imagePullSecrets`, then the
+     admission controller adds `imagePullSecrets`, copying them from the `ServiceAccount`.
+
+### TokenRequest API


Would it be worth mentioning the new kubectl create token feature here as that uses the TokenRequest API and could be used by end-users to generate new tokens?

Maybe. Is that a “makes the page better” change, or a “page doesn't make sense without it”. If it's the former, I'd prefer to move this one forward towards merge, and also track an issue about also documenting kubectl create token - maybe with a new task page.

How's this new wording?

liggitt · 2022-08-23T16:16:07Z

looks like this might overlap with other already merged changes or in-flight PRs... I can take a look once it's deconflicted with current content

sftim · 2022-08-23T16:36:39Z

If anyone wants to borrow text from this PR, go ahead - it's got a CLA signoff. A Co-Authored-By: credit would be nice.

I also hope to revisit this after the 1.25 release.

sftim · 2022-10-06T15:19:50Z

May help with #32655

sftim · 2022-10-13T11:09:40Z

looks like this might overlap with other already merged changes or in-flight PRs... I can take a look once it's deconflicted with current content

@liggitt this should be current enough to review

content/en/docs/reference/access-authn-authz/service-accounts-admin.md

liggitt · 2022-10-18T14:00:50Z

content/en/docs/reference/access-authn-authz/service-accounts-admin.md

+   This mechanism superseded an earlier mechanism that added a volume based on a Secret,
+   where the Secret represented the ServiceAccount for the Pod, but did not expire.
+1. A `configMap` source. The ConfigMap contains a bundle of certificate authority data. Pods can use these
+   certificates to make sure that they are connecting to your cluster's kube-apiserver (and not to middlebox


https://en.wikipedia.org/wiki/Middlebox - that's the term I'd use

content/en/docs/reference/access-authn-authz/service-accounts-admin.md

content/en/docs/tasks/configure-pod-container/configure-service-account.md

Now that TokenRequest is the default way to get a service account token for a Pod, update the task pages that relate to this.

sftim · 2022-10-22T01:57:30Z

Updated with fixes

liggitt · 2022-10-24T12:27:59Z

updates lgtm

liggitt · 2022-10-24T12:28:12Z

/lgtm

k8s-ci-robot · 2022-10-24T12:28:18Z

LGTM label has been added.

Git tree hash: fcc32ea69be6d3a0b213bc23c1686567cd6add0c

reylejano · 2022-11-09T21:47:15Z

This PR has an lgtm from a SIG Auth TL
The changes look good and good to see more of kubectl create token in the docs
/label refactor
/approve

k8s-ci-robot · 2022-11-09T21:47:31Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: reylejano

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/OWNERS~~ [reylejano]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-ci-robot added sig/auth Categorizes an issue or PR as relevant to SIG Auth. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels May 13, 2022

sftim marked this pull request as draft May 13, 2022 18:28

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. language/en Issues or PRs related to English language labels May 13, 2022

k8s-ci-robot requested review from divya-mohan0209 and liggitt May 13, 2022 18:28

k8s-ci-robot added the sig/docs Categorizes an issue or PR as relevant to SIG Docs. label May 13, 2022

sftim force-pushed the 20190601_task_configure_service_account_reword branch from d351bc7 to 4c5a40b Compare May 14, 2022 08:16

sftim marked this pull request as ready for review May 14, 2022 08:19

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label May 14, 2022

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 15, 2022

sftim force-pushed the 20190601_task_configure_service_account_reword branch from 4c5a40b to bd13ef7 Compare June 26, 2022 20:47

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jun 26, 2022

sftim force-pushed the 20190601_task_configure_service_account_reword branch from bd13ef7 to 87d16b1 Compare June 26, 2022 20:48

raesene reviewed Jul 14, 2022

View reviewed changes

sftim mentioned this pull request Jul 14, 2022

Task page for kubectl create token #35016

Closed

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jul 26, 2022

sftim marked this pull request as draft August 23, 2022 16:35

k8s-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Aug 23, 2022

sftim force-pushed the 20190601_task_configure_service_account_reword branch from 87d16b1 to f87e505 Compare October 4, 2022 10:52

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 4, 2022

k8s-ci-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 6, 2022

sftim force-pushed the 20190601_task_configure_service_account_reword branch from f87e505 to 762f686 Compare October 7, 2022 15:01

k8s-ci-robot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 7, 2022

sftim force-pushed the 20190601_task_configure_service_account_reword branch from 762f686 to 7e00f0d Compare October 7, 2022 15:04

sftim marked this pull request as ready for review October 7, 2022 15:05

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 7, 2022

k8s-ci-robot requested review from lavalamp and natalisucks October 7, 2022 15:05

liggitt reviewed Oct 18, 2022

View reviewed changes

sftim added 3 commits October 22, 2022 02:56

Reword “Configure Service Accounts for Pods”

0fda59f

Reword “Managing Service Accounts” task

f9db6ae

Update ServiceAccount tasks in light of TokenRequest

a4629cd

Now that TokenRequest is the default way to get a service account token for a Pod, update the task pages that relate to this.

sftim force-pushed the 20190601_task_configure_service_account_reword branch from 7e00f0d to a4629cd Compare October 22, 2022 01:56

k8s-ci-robot assigned liggitt Oct 24, 2022

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Oct 24, 2022

k8s-ci-robot added the refactor Indicates a PR with large refactoring changes e.g. removes files or moves content label Nov 9, 2022

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 9, 2022

k8s-ci-robot merged commit f324805 into kubernetes:main Nov 9, 2022

sftim deleted the 20190601_task_configure_service_account_reword branch November 9, 2022 22:20

windsonsea mentioned this pull request Nov 11, 2022

[zh] sync /service-accounts-admin.md #37836

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Reword tasks relating to ServiceAccounts #33654

Reword tasks relating to ServiceAccounts #33654

sftim commented May 13, 2022 •

edited

Loading

netlify bot commented May 13, 2022 •

edited

Loading

sftim commented Jul 14, 2022

raesene Jul 14, 2022

sftim Jul 14, 2022

sftim Oct 7, 2022

liggitt commented Aug 23, 2022

sftim commented Aug 23, 2022

sftim commented Oct 6, 2022

sftim commented Oct 13, 2022

liggitt Oct 18, 2022

sftim Oct 22, 2022

sftim commented Oct 22, 2022

liggitt commented Oct 24, 2022

liggitt commented Oct 24, 2022

k8s-ci-robot commented Oct 24, 2022

reylejano commented Nov 9, 2022

k8s-ci-robot commented Nov 9, 2022

Reword tasks relating to ServiceAccounts #33654

Reword tasks relating to ServiceAccounts #33654

Conversation

sftim commented May 13, 2022 • edited Loading

netlify bot commented May 13, 2022 • edited Loading

✅ Pull request preview available for checking

sftim commented Jul 14, 2022

raesene Jul 14, 2022

Choose a reason for hiding this comment

sftim Jul 14, 2022

Choose a reason for hiding this comment

sftim Oct 7, 2022

Choose a reason for hiding this comment

liggitt commented Aug 23, 2022

sftim commented Aug 23, 2022

sftim commented Oct 6, 2022

sftim commented Oct 13, 2022

liggitt Oct 18, 2022

Choose a reason for hiding this comment

sftim Oct 22, 2022

Choose a reason for hiding this comment

sftim commented Oct 22, 2022

liggitt commented Oct 24, 2022

liggitt commented Oct 24, 2022

k8s-ci-robot commented Oct 24, 2022

reylejano commented Nov 9, 2022

k8s-ci-robot commented Nov 9, 2022

sftim commented May 13, 2022 •

edited

Loading

netlify bot commented May 13, 2022 •

edited

Loading