Skip to content

Latest commit

 

History

History
48 lines (34 loc) · 2.3 KB

kubernetes-aks-engine-service-account.md

File metadata and controls

48 lines (34 loc) · 2.3 KB
Raw
title description author ms.topic ms.date ms.author ms.reviewer ms.lastreviewed
Enabling service account token volume projection for AKS engine on Azure Stack Hub
Learn how to enable service account token volume projection for AKS engine on Azure Stack Hub.
sethmanheim
article
12/21/2022
sethm
waltero
10/23/2020

Enabling service account token volume projection for AKS engine on Azure Stack Hub

Istio is a configurable, open source service-mesh layer that connects, monitors, and secures the containers in a Kubernetes cluster. Istio 1.3 and higher uses a feature in Kubernetes called service account token volume projection. This feature is not enabled by default in Kubernetes clusters deployed by AKS engine. In this article, you can find the API model json properties in the apiServerConfig element that shows the Kubernetes API server flags required to enable service account token volume projection for your cluster.

For more information about service account token volume projection, see Service Account Token Volume Projection.

Enable service account token volume projection

To enable service account token volume projection, add the following settings into your API model json file.

{
    "kubernetesConfig": {
        "apiServerConfig": {
            "--service-account-api-audiences": "api,istio-ca",
            "--service-account-issuer": "kubernetes.default.svc",
            "--service-account-signing-key-file": "/etc/kubernetes/certs/apiserver.key"
        }
    }
}

Note

You may have to adjust --service-account-api-audiences and --service-account-issuer to your specific use case.

For a full example API model, refer to istio.json.

Next steps