A web Pod runs in citadel-zvjo3i. Read its identity and its credential:
sh
kubectl get pods -n citadel-zvjo3i
kubectl get pod -l app=market-web -n citadel-zvjo3i -o jsonpath='{.items[0].spec.serviceAccountName}'
kubectl exec deploy/market-web -n citadel-zvjo3i -- ls /var/run/secrets/kubernetes.io/serviceaccountCreate an account for the API and run a Pod as it:
sh
kubectl create serviceaccount market-api -n citadel-zvjo3i
kubectl apply -n citadel-zvjo3i -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
name: api
spec:
serviceAccountName: market-api
containers:
- name: api
image: stackmonsters/monster-market-api
EOFThen a Pod that gets no token at all:
sh
kubectl apply -n citadel-zvjo3i -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
name: quiet
spec:
automountServiceAccountToken: false
containers:
- name: box
image: busybox
command: ["sleep", "3600"]
EOF
kubectl exec quiet -n citadel-zvjo3i -- ls /var/run/secrets/kubernetes.io/serviceaccount