External-Mirrors/kubespray
2
0
Fork 0
mirror of https://github.com/kubernetes-sigs/kubespray.git synced 2026-10-31 14:36:20 -02:30
Code Issues Packages Projects Releases Wiki Activity

Allow setting --service-account-extend-token-expiration for kube-apiserver in hardening.yaml (#13616)

Browse Source 
* kube-apiserver: add --service-account-extend-token-expiration

* Update docs/ansible/vars.md

Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

* Update docs/operations/hardening.md

* Update docs/operations/hardening.md

Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>

---------

Co-authored-by: Ali Afsharzadeh <afsharzadeh8@gmail.com>
This commit is contained in:
Jay.H
2026-10-12 03:57:19 +00:00
committed by GitHub
co-authored by Ali Afsharzadeh
parent 131fd144cc
commit 457217aaa0
4 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ansible/vars.md
+1
View File
@@ -171,6 +171,7 @@ kube_apiserver_admission_event_rate_limits:
```
* *kube_apiserver_service_account_lookup* - Enable validation service account before validating token. Default `true`.
* *kube_apiserver_service_account_extend_token_expiration* - Extend admission-injected service account tokens to 1 year (kube-apiserver `--service-account-extend-token-expiration`). Not set by default (kube-apiserver default `true`). Set to `false` to disable.
Note, if cloud providers have any use of the ``10.233.0.0/16``, like instances'
private addresses, make sure to pick another values for ``kube_service_addresses``