[Verse 1] In Kubernetes one point twenty four and beyond The token game has changed, old ways are gone No more secrets mounted automatically there Projected tokens are the new way we declare Service accounts need tokens to authenticate But the old static method we must eliminate Create token command is what we use today Dynamic tokens that expire and fade away [Chorus] kubectl create token with the service account name Projected tokens playing a security game No more static secrets hanging around Least privilege principle keeping systems sound View the token but don't let it stay Projected security is the Kubernetes way Short-lived access with expiration time Keeping your clusters secure by design [Verse 2] Never use cluster-admin for your workloads Create dedicated accounts as security unfolds One service account per application you deploy Separation of concerns that nothing can destroy automountServiceAccountToken set to false Unless you really need it, give mounting a pause Only mount the tokens when apps really require Keep the attack surface small, that's what we desire [Chorus] kubectl create token with the service account name Projected tokens playing a security game No more static secrets hanging around Least privilege principle keeping systems sound View the token but don't let it stay Projected security is the Kubernetes way Short-lived access with expiration time Keeping your clusters secure by design [Bridge] Pod Security Standards are your friend Restricted, Baseline, Privileged to defend Pod Security Admission controls the gate Define your policies before it's too late The token you create has a time to live More secure than static secrets that we give Project the identity, scope it down tight Security contexts shining bright [Chorus] kubectl create token with the service account name Projected tokens playing a security game No more static secrets hanging around Least privilege principle keeping systems sound View the token but don't let it stay Projected security is the Kubernetes way Short-lived access with expiration time Keeping your clusters secure by design [Outro] From static to projected, evolution's here Service account tokens crystal clear Create, view, and use them with care Kubernetes security beyond compare
← Delete a PVC (check reclaim policy first!) | Example security context (apply in your pod specs) →