kubernetes-bootstrap-token-sa.yaml

apiVersion: v1
kind: ServiceAccount
metadata:
  name: bootstrap-token
  namespace: kube-system
secrets:
- name: bootstrap-token-d07b9d
  #TODO Name MUST be of form "bootstrap-token-<token id>"
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  annotations:
    rbac.authorization.kubernetes.io/autoupdate: "true"
  labels:
    kubernetes.io/bootstrapping: rbac-defaults
  name: bootstrap-token
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cluster-admin
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: system:bootstrap:d07b9d
  #TODO tokens authenticate as the username system:bootstrap:<token id> and are members of the group
  # TODO: modify cluster apitoken in db.tenx_clusters
# doc: https://kubernetes.io/docs/admin/bootstrap-tokens/#enabling-bootstrap-token-authentication