Senior LevelDocker & Deployment
How does Bound Service Account Token Volume Projection enhance token security in K8s 1.21+?
❓ Interview Prompt: Explain Bound Service Account Tokens — time-bound, audience-scoped JWTs, automatic rotation, and comparison with legacy long-lived tokens.
Legacy Service Account Tokens (Pre-K8s 1.21):
Old-style tokens were:
•
Stored in Secrets — auto-created when ServiceAccount was created.
•
Never expire — valid until manually deleted.
•
Not audience-scoped — valid for any Kubernetes API call.
•
Any pod with the right RBAC could impersonate the SA indefinitely.
Projected Service Account Tokens (K8s 1.21+ Default):
Kubernetes now uses Projected Volumes to mount short-lived, audience-scoped tokens:
•
Time-bound: Default expiry is 1 hour (configurable via
expirationSeconds). Kubelet automatically rotates them before expiry.•
Audience-scoped: Token is only valid for the specified audience (e.g.,
api for Kubernetes API, or custom audiences for Vault/AWS OIDC).•
Not stored in etcd: Generated on-demand by the API server — no Secret object to steal.
•
Pod-bound: Token is invalidated when the pod is deleted.
IRSA (IAM Roles for Service Accounts — AWS):
AWS uses projected tokens with the sts.amazonaws.com audience to implement IRSA — pods assume AWS IAM roles without long-lived AWS credentials. The projected token is exchanged for temporary AWS credentials via OIDC federation.
Code Implementation Example
yaml
# Pod with projected service account token (explicit configuration)
apiVersion: v1
kind: Pod
spec:
serviceAccountName: api-sa
containers:
- name: api
image: myapp:v1.2.3
volumeMounts:
- mountPath: /var/run/secrets/tokens
name: projected-token
volumes:
- name: projected-token
projected:
sources:
# Short-lived Kubernetes API token (1 hour, auto-rotated)
- serviceAccountToken:
audience: api # valid only for K8s API
expirationSeconds: 3600 # 1 hour (kubelet rotates at 80%)
path: kube-token
# AWS IRSA token (for assuming IAM role via OIDC)
- serviceAccountToken:
audience: sts.amazonaws.com # AWS STS audience
expirationSeconds: 86400 # 24 hours
path: aws-token
# IRSA IAM Role annotation
# annotations:
# eks.amazonaws.com/role-arn: arn:aws:iam::123456:role/my-role💡Projected volume tokens: 1-hour K8s API token (auto-rotated) + 24-hour AWS STS token for IRSA — both pod-bound and audience-scoped.
🎯 Interview Key Takeaway
Projected tokens are time-bound (1hr), audience-scoped, and pod-bound — cannot be used after pod deletion. Replace legacy Secret-mounted tokens to prevent long-lived credential theft.
#Kubernetes#Service Account Tokens#IRSA#OIDC#Security#Senior
Back to all Docker & Deployment Questions→