Configuring Third Party Token Projection#

You can follow these steps to determine if you have third party token projection enabled in your cluster. If it is not enabled, follow the steps below to configure third party token projection in your cluster.

Determining whether third party token projection is enabled#

In order to see if third party JWTs are being issued by your cluster, run the following command:

  kubectl get --raw /api/v1 | jq '.resources[] | select(.name | index("serviceaccounts/token"))'

If your cluster already issues third party JWTs, you will get output resembling:

{
  "name": "serviceaccounts/token",
  "singularName": "",
  "namespaced": true,
  "group": "authentication.k8s.io",
  "version": "v1",
  "kind": "TokenRequest",
  "verbs": [
    "create"
  ]
}

Enabling third party token projection#

Depending on how you deploy Kubernetes, follow one of the following sections.

Note

Aspen Mesh provides instructions below for several platforms as a convenience. Please work with your Kubernetes platform or cloud provider for details or support on third-party token projection.

Kops cluster#

If you’re creating your Kubernetes cluster via kops :

  1. Run kops edit cluster $YOUR_CLUSTER_NAME

  2. Add the following Kubernetes apiserver options under your cluster’s spec key:

    kubeAPIServer:
  apiAudiences:
  - api
  - istio-ca
  serviceAccountIssuer: kubernetes.default.svc
  serviceAccountKeyFile:
  - /srv/kubernetes/server.key
  serviceAccountSigningKeyFile: /srv/kubernetes/server.key

  3. Perform the cluster update, followed by a rolling update:

    • kops update cluster --yes

    • kops rolling-update cluster --yes

Kubespray cluster#

If you’re creating your Kubernetes cluster via kubespray :

  1. Add the following configuration to your group_vars at inventory/mycluster/group_vars/k8s-cluster/k8s-cluster.yml :

    kube_kubeadm_apiserver_extra_args:
  service-account-issuer: kubernetes.default.svc
  api-audiences: api,istio-ca
  service-account-key-file: /etc/kubernetes/ssl/sa.key
  service-account-signing-key-file: /etc/kubernetes/ssl/sa.key

  2. Perform the cluster update using ansible:

    • ansible-playbook -i inventory/mycluster/hosts.yaml  --become --become-user=root cluster.yml

Configuring Kubernetes apiserver directly#

For any other Kubernetes provider, you’ll need to configure the Kubernetes apiserver with the following command line arguments.

Note

The location of the service account key files might differ depending on your Kubernetes provider.

--service-account-issuer=kubernetes.default.svc \
--api-audiences=api,istio-ca \
--service-account-key-file=/srv/kubernetes/server.key \
--service-account-signing-key-file=/srv/kubernetes/server.key

Kubeadm#

If you’re creating your Kubernetes cluster via kubeadm, the API server configuration is available on your master node at /etc/kubernetes/manifests/kube-apiserver.yaml

You will need root permissions to edit the file and add/edit the 4 extra lines mentioned above. The API Server runs as a pod and should automatically restart when changes are made to its manifest. Otherwise, forcefully restart the pod by killing it manually:

  • kubectl -n kube-system delete pod kube-apiserver-k8s-master