kubernetes 使用服务帐户创建 pod

Question

I am assuming, because pod contains service account ( by default mounting default service account), pod is being created.

If i do autoMountServiceAccountToken as false, then also my pod is creating. In that case how authentication happening?

kubectl command ( client ) + service account token --> requesting to create pod -> server is validating and accepting request to create the pod.

is my understand wrong?

Answer 1

To check which actions can be performed in an cluster, below command can be executed. If it return yes then pods can be created.

kubectl auth can-i create <resource-name>
kubectl auth can-i create pod

To understand more details or restrict to creation of resources in cluster please refer Authentication , Authorisation documentation and also ServiceAccount