Kubernetes service account - token signature validation

0
votes

In any given POD, service account token is is mounted at location.

/var/run/secrets/kubernetes.io/serviceaccount/token

I want to understand how this token is signed. What keys are used while signing this token by Kubernetes? How to get access to public key that can help in offline signature validation

/var/run/secrets/kubernetes.io/serviceaccount/ca.crt - I tried signature validation with the public key associated with this certificate. This does not seem to work.

Appreciate any help on this.

1
kubernetes

1 Answers

1
votes

You can check the service account file from kube-apiserver pod yaml file. There is a flag which is:

 --service-account-key-file=/etc/kubernetes/pki/sa.pub

From master node check /etc/kubernetes/pki directory.