-
|
What serviceAccount certificate is being used by default? https://www.talos.dev/v1.0/reference/configuration/#clusterconfig - serviceAccount block |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 7 replies
-
|
It's a key, and a random one is generated whenever Talos machine configuration is generated for each cluster. |
Beta Was this translation helpful? Give feedback.
-
|
What algorithm is used to generate the certificate? The final case is for me to know the data of the standard admin SA (by generating from my side and passing to Talos, or by receiving from Talos or retrying) for further authentication in the Kubernetes cluster |
Beta Was this translation helpful? Give feedback.
-
|
https://www.siderolabs.com/blog/workload-identity-for-kubernetes-on-gcp/ the blog has an example on manually passing a SA key, by default talos uses ecdsa keys |
Beta Was this translation helpful? Give feedback.
-
|
kube-apiserver supports both RSA and ECDSA keys |
Beta Was this translation helpful? Give feedback.
-
|
Well thank you. And the last question - is the serviceAccount key used to create the "default-admin" SA or something else? |
Beta Was this translation helpful? Give feedback.
-
|
it's the signing key, the private key is used to sign SA token when using projected volume mounts |
Beta Was this translation helpful? Give feedback.
It's a key, and a random one is generated whenever Talos machine configuration is generated for each cluster.