OSDOCS-4272: Updating for service account issuer behavior change

bergerhoffer · bergerhoffer · commit 3f94d9c1b06a · 2022-10-27T09:16:29.000-04:00
diff --git a/modules/bound-sa-tokens-configuring.adoc b/modules/bound-sa-tokens-configuring.adoc
@@ -19,9 +19,9 @@ You can configure pods to request bound service account tokens by using volume p
 +
 This step is typically not required if the bound tokens are used only within the cluster.
 +
-[WARNING]
+[IMPORTANT]
 ====
-If you update the `serviceAccountIssuer` field and there are bound tokens already in use, all bound tokens with the previous issuer value will be invalidated. Unless the holder of a bound token has explicit support for a change in issuer, the holder will not request a new bound token until pods have been restarted.
+If you change the service account issuer to a custom one, the previous service account issuer is still trusted for the next 24 hours.
 
 If necessary, you can manually restart all pods in the cluster so that the holder will request a new bound token. Before doing this, wait for a new revision of the Kubernetes API server pods to roll out with your service account issuer changes.
 ====

Original file line number	Diff line number	Diff line change
`@@ -19,9 +19,9 @@ You can configure pods to request bound service account tokens by using volume p`
`19`	`19`	`+`
`20`	`20`	`This step is typically not required if the bound tokens are used only within the cluster.`
`21`	`21`	`+`
`22`		`-[WARNING]`
	`22`	`+[IMPORTANT]`
`23`	`23`	`====`
`24`		-If you update the `serviceAccountIssuer` field and there are bound tokens already in use, all bound tokens with the previous issuer value will be invalidated. Unless the holder of a bound token has explicit support for a change in issuer, the holder will not request a new bound token until pods have been restarted.
	`24`	`+If you change the service account issuer to a custom one, the previous service account issuer is still trusted for the next 24 hours.`
`25`	`25`
`26`	`26`	`If necessary, you can manually restart all pods in the cluster so that the holder will request a new bound token. Before doing this, wait for a new revision of the Kubernetes API server pods to roll out with your service account issuer changes.`
`27`	`27`	`====`