k8s 1.24 版本以后获取永不过期token?

问题产生背景:

一个服务操作多个k8s集群, 这个时候就会出现授权问题。k8s 1.24版本之前sa账号产生的token在secret中是永久不过期的。在1.24版本以后secret将不再保留token.而此时容器中的token是只有一个小时就过期的，这对于一个服务来操作多个k8s集群基本就不可能了。

解决方法：

apiVersion: v1
kind: ServiceAccount
metadata:
  name: dashboard-admin
  namespace: kube-system
---
kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: dashboard-admin
subjects:
  - kind: ServiceAccount
    name: dashboard-admin
    namespace: kube-system
roleRef:
  kind: ClusterRole
  name: cluster-admin
  apiGroup: rbac.authorization.k8s.io

---
# 上面均为正常的建立ServiceAccount并与集群默认角色cluster-admin进行绑定
# 下面为手动建立secret文件进行永久token建立
apiVersion: v1
kind: Secret
metadata:
  name: secret-admin
  namespace: kube-system
  annotations:
    kubernetes.io/service-account.name: "dashboard-admin"
type: kubernetes.io/service-account-token

查看生成token

[root@master ~]# kubectl describe -nkube-system secret/secret-admin
Name:         secret-admin
Namespace:    kube-system
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: dashboard-admin
              kubernetes.io/service-account.uid: f59e9238-331a-40d1-9cba-c00f39124104

Type:  kubernetes.io/service-account-token

Data
====
ca.crt:     1099 bytes
namespace:  11 bytes
token:      eyJhbGciOiJ......bmGl8XPA

这篇好文章是转载于：学新通技术网