Skip to content

Admission controller to attach additional secrets to a service account #9902

Closed
Closed
Admission controller to attach additional secrets to a service account#9902
Labels
priority/backlogHigher priority than priority/awaiting-more-evidence.

Description

@erictune
erictune
opened on Jun 16, 2015

The following does not work but I would like it to:

# Make secret
$ kubectl create -f - <<EOF
apiVersion: v1
data:
  thing: dGVzdAo=
kind: Secret 
metadata:
  name: test-secret
type: Opaque
EOF
secrets/test-secret
# Make non-default service account
$ kubectl create -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
EOF
serviceaccounts/test-sa
# Verify creation and get the existing token name
$ kubectl get serviceaccounts/test-sa -oyaml 
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: 2015-06-16T21:52:39Z
  name: test-sa
  namespace: default
  resourceVersion: "313260"
  selfLink: /api/v1/namespaces/default/serviceaccounts/test-sa
  uid: 02348e46-1572-12e5-afc2-41010ae0021f
secrets:
- name: test-sa-token-wr9j3
#  Update service account to have another secret
$ kubectl update -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-sa
secrets:
- name: test-sa-token-wr9j3
- name: test-secret
EOF
serviceaccounts/test-sa
# Create a pod that uses test-sa and both its secrets 
$ kubectl create -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
  name: p1
spec:
  containers:
  - image: progrium/busybox
    name: c
    command: [ "ls", "-lR", "/var/run/secrets/"]
  serviceAccount: test-sa
  restartPolicy: Never
EOF
# Sadly, only one secret got mounted.
$kubectl get pods/p1 -oyaml | grep volumes -A 3
  volumes:
  - name: test-sa-token-wr9j3
    secret:
      secretName: test-sa-token-wr9j3

@liggitt is there a way to talk the service account controller into mounting the second secret?

Activity

  1. liggitt commented on Jun 16, 2015

    @liggitt
    liggitt
    on Jun 16, 2015
    Member

    No… there's no place to indicate default mount points or intent to auto mount. I think @pmorie had one or more issues open about that specifically related to secrets, aside from service accounts, but not much happened with them yet

  2. erictune commented on Jun 16, 2015

    @erictune
    erictune
    on Jun 16, 2015
    ContributorAuthor

    Do you and pmorie agree this is something that we'd want to do in kubernetes, aside from the issue of agreeing on default mount points for ad-hoc secrets?

  3. erictune
    added this to the milestone on Jun 16, 2015
  4. saad-ali
    added
    priority/backlogHigher priority than priority/awaiting-more-evidence.
    team/master
    on Jun 17, 2015
  5. bgrant0607
    removed this from the milestone on Jul 24, 2015
  6. ghost added
    team/control-plane
    on Aug 20, 2015
  7. ghost removed
    team/master
    on Aug 20, 2015

  8. ibotty commented on Jul 30, 2016

    @ibotty
    ibotty
    on Jul 30, 2016

    Regarding the mount point: What about using an annotation in the secret and if none is given, mounting below /run/secrets/kubernetes.io/secrets/<name>?

  9. ibotty commented on Jul 30, 2016

    @ibotty
    ibotty
    on Jul 30, 2016

    Oh, and that should definitely be opt-in per container in the pod: Privilege separation within a pod!

  10. erictune commented on Aug 1, 2016

    @erictune
    erictune
    on Aug 1, 2016
    ContributorAuthor

    If it is opt in per container, then there is nothing left to do here!

  11. liggitt commented on Mar 30, 2017

    @liggitt
    liggitt
    on Mar 30, 2017
    Member

    automountServiceAccountToken option was added to service account and to pod spec

    PodPresets allow automounting additional secrets/configmaps

  12. liggitt
    closed this as completedon Mar 30, 2017

  13. erictune commented on Jun 16, 2017

    @erictune
    erictune
    on Jun 16, 2017
    ContributorAuthor

    @droot

  14. sanyamk23
    added a commit that references this issue on Sep 1, 2026

    fix(glue): tables not including classification (kubernetes#9923)

    61b45f3
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    priority/backlogHigher priority than priority/awaiting-more-evidence.

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions