Hands-on Lab·Kubernetes and Cloud Native Security Associate
Projected ServiceAccount Tokens
ServiceAccount tokens changed shape in 1.24 and most material has not caught up. This guide requests one, decodes it, and then uses it against the apiserver by hand to see authentication and authorization act separately.
Security Fundamentals Guide 19 of 42 Intermediate
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 16 min
TokenRequest API, stable since 1.22 and the default since 1.24. Legacy non-expiring Secret-based tokens still work if one exists, but nothing creates them automatically.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA5001 | 192.168.0.41 | Ubuntu 26.04 LTS | Control Plane Node (tainted NoSchedule) | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE01 | 192.168.0.42 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE02 | 192.168.0.43 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
| CKA5001-NODE03 | 192.168.0.44 | Ubuntu 26.04 LTS | Worker Node | 2 Core | 4 GB | 50 GB |
This guide includes
Use this when material tells you to go looking in a Secret for a ServiceAccount token. This matters because tokens changed shape in 1.24 - they are projected, time-bound JWTs now, and nothing creates the old non-expiring Secret automatically.
- requesting a token with an explicit duration, and looking inside the JWT it returns
- reading the
audclaim, and why the apiserver refuses a token whose audience does not include it - using it by hand against two endpoints, and comparing the answers you get
- separating the two gates - the token authenticated both requests, and RBAC refused one of them
Before you start
- guide 18 - the identity and Role this token uses.
-
Ask for a token, and look inside it
-
Use it by hand, twice