implement ServiceAccountTokenProjection

[mikedanese]

design here: kubernetes/community#1973

part of #61858

Add a volume projection that is able to project service account tokens.

part of #48408

@kubernetes/sig-auth-pr-reviews @kubernetes/sig-storage-pr-reviews

[k8s-ci-robot]

@mikedanese: Adding do-not-merge/release-note-label-needed because the release note process has not been followed.

One of the following labels is required "release-note", "release-note-action-required", or "release-note-none".
Please see: https://git.k8s.io/community/contributors/devel/pull-requests.md#write-release-notes-if-needed.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[CaoShuFeng]

/assign @CaoShuFeng

[mikedanese]

Currently working on testing.

example config:

kind: Deployment
apiVersion: apps/v1
metadata:
  labels:
    run: nginx
  name: nginx
spec:
  replicas: 30
  selector:
    matchLabels:
      run: nginx
  template:
    metadata:
      labels:
        run: nginx
    spec:
      containers:
      - image: nginx
        name: nginx
        volumeMounts:
        - mountPath: /var/run/secrets/tokens
          name: token
      volumes:
      - name: token
        projected:
          sources:
          - serviceAccountToken:
              path: token
              expirationSeconds: 60
              audiences:
                - hi

[jbeda]

/hold

I'd like to see an agreed upon and checked in design doc here. As this also impacts our API, I'd also like to see a heads up to the API review folks to make sure they are aware of the context. A checked in design doc will also help with release notes and documentation.

[mikedanese]

@jbeda this will go through the normal API review process. This is self assigned and and already labeled WIP. I'll be presenting the design (here) at the next sig-storage. Only opened for early feedback

[tallclair]

/lgtm

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: awly, mikedanese, saad-ali, tallclair

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/controller/volume/attachdetach/OWNERS [mikedanese,saad-ali]
• pkg/controller/volume/expand/OWNERS [mikedanese,saad-ali]
• pkg/controller/volume/persistentvolume/OWNERS [mikedanese,saad-ali]
• pkg/kubelet/OWNERS [tallclair]
• pkg/volume/OWNERS [saad-ali]
• plugin/pkg/admission/serviceaccount/OWNERS [mikedanese]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[mikedanese]

squashed

[k8s-ci-robot]

New changes are detected. LGTM label has been removed.

[mikedanese]

fixed govet in test.

[mikedanese]

/retest

[dims]

@mikedanese looks like this could use a good release note. that should be the last thing this needs to merge

[k8s-github-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[k8s-github-robot]

Automatic merge from submit-queue. If you want to cherry-pick this change to another branch, please follow the instructions here.

[zparnold]

Hello there! @mikedanese I'm Zach Arnold working on Docs for the 1.11 release. This PR was identified as one needing some documentation in the https://github.com/kubernetes/website repo around your contributions (thanks by the way!) When you have some time, could you please modify/add/remove the relevant content that needs changing in our documentation repo? Thanks! Please let me or my colleague Misty know (@zparnold/@misty on K8s Slack) if you need any assistance with the documentation.