keps/sig-auth/1205-bound-service-account-tokens/kep.yaml

title: Bound Service Account Tokens
kep-number: 1205
authors:
  - "@mikedanese"
  - "@zshihang"
owning-sig: sig-auth
participating-sigs:
  - sig-auth
  - sig-storage
reviewers:
  - "@liggitt"
approvers:
  - "@liggitt"
creation-date: 2019-08-06
last-updated: 2021-04-29
status: implemented
replaces:
  - "/keps/sig-storage/2451-service-account-token-volumes"
stage: stable
latest-milestone: "v1.22"
milestone:
  alpha: "v1.13"
  beta: "v1.21"
  stable: "v1.22"
feature-gates:
  - name: TokenRequest
    components:
    - kube-apiserver
    - kube-controller-manager
  - name: TokenRequestProjection
    components:
    - kube-apiserver
    - kubelet
  - name: RootCAConfigMap
    components:
      - kube-controller-manager
  - name: BoundServiceAccountTokenVolume
    components:
      - kube-apiserver
metrics:
  - serviceaccount_stale_tokens_total
  - serviceaccount_valid_tokens_total