What is Kubernetes Service Account Token Volume Projection?

Question

Accepted Answer

**Token Projection** — mount short-lived service account tokens.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: my-pod
spec:
  serviceAccountName: myapp-sa
  containers:
  - name: app
    image: myapp:latest
    volumeMounts:
    - name: token
      mountPath: /var/run/secrets/tokens
      readOnly: true
  volumes:
  - name: token
    projected:
      sources:
      - serviceAccountToken:
          path: vault-token
          expirationSeconds: 3600
          audience: https://vault.example.com
      - serviceAccountToken:
          path: k8s-api-token
          expirationSeconds: 86400
          audience: https://kubernetes.default.svc
      - configMap:
          name: ca-cert
          items:
          - key: ca.crt
            path: ca.crt
      - secret:
          name: my-secret
          items:
          - key: db-password
            path: db-password
```

```bash
# Commands
kubectl get pod my-pod -o jsonpath='{.spec.volumes}' | jq

# Check projected token
kubectl exec my-pod -- cat /var/run/secrets/tokens/vault-token
kubectl exec my-pod -- cat /var/run/secrets/tokens/k8s-api-token

# Decode token
kubectl exec my-pod -- cat /var/run/secrets/tokens/vault-token | cut -d. -f2 | base64 -d

# Check token expiration
kubectl exec my-pod -- cat /var/run/secrets/tokens/vault-token | cut -d. -f2 | base64 -d | jq .exp

# Verify token audience
kubectl exec my-pod -- cat /var/run/secrets/tokens/vault-token | cut -d. -f2 | base64 -d | jq .aud
```

**Benefits:**
- Short-lived tokens (automatic rotation).
- Scoped audiences.
- Bind to external services (Vault, OIDC).
- No need for long-lived secrets.

DevOps: What is Kubernetes Service Account Token Volume Projection?