小编ncs*_*bra的帖子

我正在使用启用了服务账户发现的 AWS EKS 1.21。
创建了 OIDC 提供程序，.well-known/openid-configuration端点返回正确的配置：

{
  "issuer": "https://oidc.eks.eu-west-1.amazonaws.com/id/***",
  "jwks_uri": "https://ip-***.eu-west-1.compute.internal:443/openid/v1/jwks",
  "response_types_supported": [
    "id_token"
  ],
  "subject_types_supported": [
    "public"
  ],
  "id_token_signing_alg_values_supported": [
    "RS256"
  ]
}

为我的一个部署创建了一个 ServiceAccount，pod 将此作为预计卷：

  volumes:
  - name: kube-api-access-b4xt9
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt
            path: ca.crt
          name: kube-root-ca.crt
      - downwardAPI:
          items:
          - fieldRef:
              apiVersion: v1
              fieldPath: metadata.namespace
            path: namespace

为 ServiceAccount 创建的机密包含以下令牌：

{
  "iss": "kubernetes/serviceaccount",
  "kubernetes.io/serviceaccount/namespace": "sbx",
  "kubernetes.io/serviceaccount/secret.name": "dliver-site-config-service-token-kz874",
  "kubernetes.io/serviceaccount/service-account.name": "dliver-site-config-service",
  "kubernetes.io/serviceaccount/service-account.uid": "c26ad760-9067-4d90-a327-b3d6e32bce42",
  "sub": …