创建 ServiceAccount: gcloud iam service-accounts \ create [account] --project [project-id] 为新账号赋权: gcloud serviceAccount:[account]@[project-id].iam.gserviceaccount.com" \ --role "roles/owner" 获取账号文件: gcloud iam service-accounts
gcloud iam service-accounts list 命令gcloud iam service-accounts list可选参数: --filter=EXPRESSION 将布尔过滤器EXPRESSION
要设置身份验证,你将创建一个服务帐户并下载凭据: $ export PROJECT_ID=<GCP Project ID> $ gcloud iam service-accounts create tekton-chains $ gcloud iam service-accounts keys create credentials.json --iam-account=tekton-chains@${PROJECT_ID}
https://hackerone.com/reports/341876 访问http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts
[KUBERNETES_NAMESPACE/KUBERNETES_SERVICE_ACCOUNT] 让我们创建它: $ export GSA_NAME=kyverno-sa $ gcloud iam service-accounts create $GSA_NAME $ gcloud iam service-accounts add-iam-policy-binding \ --role roles/iam.workloadIdentityUser
关于ServiceAccount的更多信息可参考官方文档:service-accounts 关于每个命名空间下默认的服务账号:default 官方文档提到:默认服务账户是Kubernetes在创建集群时自动为每个命名空间创建的一个
kubernetes-key.pem kubernetes.pem Service Account 证书 cat > service-account-csr.json <<EOF { "CN": "service-accounts
flaws/ Google Cloud 同样适用于 google: http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts
cr7258 export SA="${SA_NAME}@${PROJECT_ID}.iam.gserviceaccount.com" export ROLE=roles/admin gcloud iam service-accounts gcloud iam service-accounts keys create gcp-creds.json \ --project $PROJECT_ID --iam-account $SA
Documentation > Concepts > Security > Service Accounts 文档链接:https://kubernetes.io/docs/concepts/security/service-accounts
下面列出首先要关注的几个关键信息: http://metadata.google.internal/computeMetadata/v1beta1/instance/service-accounts/default
registry/flowschemas/kube-system-service-accounts /registry/flowschemas/probes /registry/flowschemas/service-accounts