@@ -315,13 +315,10 @@ token might be shorter, or could even be longer).
315
315
{{< feature-state feature_gate_name="ServiceAccountTokenNodeBinding" >}}
316
316
317
317
<!--
318
- When the `ServiceAccountTokenNodeBinding` and `ServiceAccountTokenNodeBindingValidation`
319
- features are enabled, and using `kubectl` v1.31 or later, it is possible to create a service
318
+ Using `kubectl` v1.31 or later, it is possible to create a service
320
319
account token that is directly bound to a Node :
321
320
-->
322
- 当启用了 `ServiceAccountTokenNodeBinding` 和 `ServiceAccountTokenNodeBindingValidation`
323
- 特性,并使用 v1.31 或更高版本的 `kubectl` 时,
324
- 可以创建一个直接绑定到 `Node` 的服务账号令牌:
321
+ 使用 kubectl v1.31 或更高版本,可以创建一个直接绑定到 Node 的服务账号令牌:
325
322
326
323
` ` ` shell
327
324
kubectl create token build-robot --bound-object-kind Node --bound-object-name node-001 --bound-object-uid 123...456
@@ -711,10 +708,10 @@ The JSON payload of this token follows a well defined schema - an example payloa
711
708
"exp": 1731613413,
712
709
"iat": 1700077413,
713
710
"iss": "https://kubernetes.default.svc", # matches the first value passed to the --service-account-issuer flag
714
- "jti": "ea28ed49-2e11-4280-9ec5-bc3d1d84661a", # ServiceAccountTokenJTI feature must be enabled for the claim to be present
711
+ "jti": "ea28ed49-2e11-4280-9ec5-bc3d1d84661a",
715
712
"kubernetes.io": {
716
713
"namespace": "kube-system",
717
- "node": { # ServiceAccountTokenPodNodeInfo feature must be enabled for the API server to add this node reference claim
714
+ "node": {
718
715
"name": "127.0.0.1",
719
716
"uid": "58456cb0-dd00-45ed-b797-5578fdceaced"
720
717
},
@@ -741,10 +738,10 @@ The JSON payload of this token follows a well defined schema - an example payloa
741
738
" exp " : 1731613413,
742
739
" iat " : 1700077413,
743
740
" iss " : " https://kubernetes.default.svc" , # 匹配传递到 --service-account-issuer 标志的第一个值
744
- " jti " : " ea28ed49-2e11-4280-9ec5-bc3d1d84661a" , # ServiceAccountTokenJTI 特性必须被启用才能出现此申领
741
+ " jti " : " ea28ed49-2e11-4280-9ec5-bc3d1d84661a" ,
745
742
" kubernetes.io " : {
746
743
" namespace " : " kube-system" ,
747
- " node " : { # ServiceAccountTokenPodNodeInfo 特性必须被启用,API 服务器才会添加此节点引用申领
744
+ " node " : {
748
745
" name " : " 127.0.0.1" ,
749
746
" uid " : " 58456cb0-dd00-45ed-b797-5578fdceaced"
750
747
},
0 commit comments