Stable release of Bound Service Account Tokens?

[joebowbeer]

I read in the blog and in the release notes that edge-21.11.1 uses Service Account Token Volume Projection and does not require automountServiceAccountToken to be enabled (avoiding yellow card from CIS Benchmark).

When is this feature expected to be in a stable linkerd2 release?

[mateiidavid]

@joebowbeer it will likely be present in the next stable release, stable-2.12.

[KIVagant]

@mateiidavid , is anything special must be enabled to start using the feature, or is it enough to disable automountServiceAccountToken to activate the "Bound Service Account Tokens" feature? I could not find the answer in the article. Also, do you know if it will work in AWS EKS 1.22?

[mateiidavid]

@KIVagant you shouldn't have to configure anything special for this to be enabled. Edge releases support the feature and it will be on by default. You can confirm by looking at the linkerd-config ConfigMap:

:; k get cm -n linkerd linkerd-config -o yaml | rg 'serviceAccountTokenProjection'
      serviceAccountTokenProjection: true

Token projection is in Kubernetes stable 1.20. While I'm not sure if EKS would do anything "special" here, my assumption is the feature would be on by default for 1.22.

[KIVagant]

What if there is no such config line in the ConfigMap (and also I could not find it in the official Helm chart)? Should I manually add it?

[KIVagant]

My bad, it is actually there. I will update my Helm chart.

Up2: it seems like the feature is not in the stable version of the chart yet. I will wait for it to be released.