From 0d0cc43f71b0fc6f769a53c324d15b64d9ccef53 Mon Sep 17 00:00:00 2001 From: Shihang Zhang Date: Fri, 30 Oct 2020 09:44:51 -0700 Subject: [PATCH] TokenRequest and TokenRequestProjection are GA now --- .../command-line-tools-reference/feature-gates.md | 10 ++++++---- .../configure-service-account.md | 11 +++++------ 2 files changed, 11 insertions(+), 10 deletions(-) diff --git a/content/en/docs/reference/command-line-tools-reference/feature-gates.md b/content/en/docs/reference/command-line-tools-reference/feature-gates.md index 9b13e34d694ac..303c90aae57c9 100644 --- a/content/en/docs/reference/command-line-tools-reference/feature-gates.md +++ b/content/en/docs/reference/command-line-tools-reference/feature-gates.md @@ -153,10 +153,6 @@ different Kubernetes components. | `StorageVersionHash` | `false` | Alpha | 1.14 | 1.14 | | `StorageVersionHash` | `true` | Beta | 1.15 | | | `Sysctls` | `true` | Beta | 1.11 | | -| `TokenRequest` | `false` | Alpha | 1.10 | 1.11 | -| `TokenRequest` | `true` | Beta | 1.12 | | -| `TokenRequestProjection` | `false` | Alpha | 1.11 | 1.11 | -| `TokenRequestProjection` | `true` | Beta | 1.12 | | | `TTLAfterFinished` | `false` | Alpha | 1.12 | | | `TopologyManager` | `false` | Alpha | 1.16 | | | `ValidateProxyRedirects` | `false` | Alpha | 1.12 | 1.13 | @@ -304,6 +300,12 @@ different Kubernetes components. | `TaintNodesByCondition` | `false` | Alpha | 1.8 | 1.11 | | `TaintNodesByCondition` | `true` | Beta | 1.12 | 1.16 | | `TaintNodesByCondition` | `true` | GA | 1.17 | - | +| `TokenRequest` | `false` | Alpha | 1.10 | 1.11 | +| `TokenRequest` | `true` | Beta | 1.12 | 1.19 | +| `TokenRequest` | `true` | GA | 1.20 | - | +| `TokenRequestProjection` | `false` | Alpha | 1.11 | 1.11 | +| `TokenRequestProjection` | `true` | Beta | 1.12 | 1.19 | +| `TokenRequestProjection` | `true` | GA | 1.20 | - | | `VolumePVCDataSource` | `false` | Alpha | 1.15 | 1.15 | | `VolumePVCDataSource` | `true` | Beta | 1.16 | 1.17 | | `VolumePVCDataSource` | `true` | GA | 1.18 | - | diff --git a/content/en/docs/tasks/configure-pod-container/configure-service-account.md b/content/en/docs/tasks/configure-pod-container/configure-service-account.md index c1a3a8f1c2cfa..4cd5eaa905dc3 100644 --- a/content/en/docs/tasks/configure-pod-container/configure-service-account.md +++ b/content/en/docs/tasks/configure-pod-container/configure-service-account.md @@ -286,15 +286,16 @@ TODO: Test and explain how to use additional non-K8s secrets with an existing se ## Service Account Token Volume Projection -{{< feature-state for_k8s_version="v1.12" state="beta" >}} +{{< feature-state for_k8s_version="v1.20" state="stable" >}} {{< note >}} -This ServiceAccountTokenVolumeProjection is __beta__ in 1.12 and -enabled by passing all of the following flags to the API server: +To enable and use token request projection, you must specify each of the following +command line arguments to `kube-apiserver`: * `--service-account-issuer` +* `--service-account-key-file` * `--service-account-signing-key-file` -* `--service-account-api-audiences` +* `--api-audiences` {{< /note >}} @@ -385,5 +386,3 @@ See also: - [Cluster Admin Guide to Service Accounts](/docs/reference/access-authn-authz/service-accounts-admin/) - [Service Account Signing Key Retrieval KEP](https://github.com/kubernetes/enhancements/blob/master/keps/sig-auth/20190730-oidc-discovery.md) - [OIDC Discovery Spec](https://openid.net/specs/openid-connect-discovery-1_0.html) - -