k8s长期token的使用方式

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-an-api-token-for-a-serviceaccount

如官方所说，创建一个ServiceAccount，将它与Secret关联，如下代码：

apiVersion: v1
kind: Secret
metadata:
  name: {{ include "sa.serviceAccountName" . }}-secret
  annotations:
    kubernetes.io/service-account.name: {{ include "sa.serviceAccountName" . }}
type: kubernetes.io/service-account-token

使用helm的方式就是这样：（可以使用helm create命令，然后将其它的文件都删除了，只留下serviceaccount.yaml就行，然后再helm install） serviceaccount.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: {{ .Release.Name }}
---

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: {{ .Release.Name }}
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
  - kind: ServiceAccount
    name: {{ .Release.Name }}
    namespace: {{ .Release.Namespace }}

---
apiVersion: v1
kind: Secret
metadata:
  name: {{ .Release.Name }}-secret
  annotations:
    kubernetes.io/service-account.name: {{ .Release.Name }}
type: kubernetes.io/service-account-token

查看token

kubectl config view |grep server|cut -f 2- -d ":" | tr -d " "
kubectl get secret build-robot-sa-secret -o jsonpath={.data.token} | base64 -d
kubectl get secret build-robot-sa-secret -o jsonpath={.data.ca\\.crt}