Kubernetes Identity Settings

This page documents settings for authenticating Kubernetes workloads with their own service account tokens. See Kubernetes Service Account Identity for how the provider works and how to grant policies with the PolicyBinding resource.

You can establish or modify settings by defining:

an environment variable on the host system prior to starting or restarting the AIStor Server.
a configuration setting using mc admin config set.

If you define both an environment variable and the similar configuration setting, MinIO AIStor uses the environment variable value.

Enable

The identity_kubernetes subsystem has no enable setting.

MinIO AIStor turns the provider on by itself when it detects that it runs inside a Kubernetes cluster and can reach both a token validator and the PolicyBinding API. To stop AIStor from accepting service account tokens, set token_validation to disabled.

Settings

Token validation

Optional

Environment Variable Configuration Setting

How MinIO AIStor validates a service account token. One of the following values:

Value	Behavior
`oidc`	Verify the token signature against the cluster’s OIDC discovery endpoint, caching signing keys. This is the default.
`token_review`	Call the Kubernetes `TokenReview` API for every request.
`disabled`	Do not accept service account tokens.

Default value: oidc

token_review places the Kubernetes API server in the path of every authentication, where oidc calls out only when it meets a signing key it has not cached.

Token audience

Optional

Environment Variable Configuration Setting

The audience MinIO AIStor requires in a service account token. Project the token with a matching audience so the check succeeds.

Default value: sts.min.io

Keep the configured audience. An empty string turns the audience check off, which accepts any correctly signed service account token in the cluster, including tokens minted for other services.