Do we need to create service account token after every hour?

Kubernetes
#1

@Tej-Singh-Rana : As per the tutorial video: Certified Kubernetes Application Developer (CKAD) | KodeKloud

Post version 1.24, I am creating a Service Account and then its token but it will get expire after one hour? It means I have to again manually create new token and bind it with the deployment?

Can you please suggest some better way so that I can make sure while working on prod env one should be careful that which command we you should use so that token won’t get expired after every hour.

#2

No you don’t :grinning:

This all happens behind the scenes. The token is automatically rotated for you by the API server’s token service. Anything using the kubernetes client API (like kubectl, or any applications written in-house using official client APIs) will handle this seamlessly.

The details of the change to service account tokens were for security enhancement

  1. The token is no longer stored in a (not so secret) kubernetes secret
  2. Each pod using the service account gets its own unique token
  3. Regular rotation
1 Like
#3

However, you would not be upgrading your prod env to a new kube version without thoroughly testing the upgrade on a lower environment first, now would you?

1 Like
#4

hahaha certainly I won’t test directly on Prod env. :slight_smile: