{"action":"opened","issue":{"url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7647","labels_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7647/labels{/name}","comments_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7647/comments","events_url":"https://api.github.com/repos/GoogleCloudPlatform/kubernetes/issues/7647/events","html_url":"https://github.com/GoogleCloudPlatform/kubernetes/issues/7647","id":72514815,"number":7647,"title":"Generate kubeconfig as well as tokens for service accounts","user":{"login":"erictune","id":8105590,"avatar_url":"https://avatars.githubusercontent.com/u/8105590?v=3","gravatar_id":"","url":"https://api.github.com/users/erictune","html_url":"https://github.com/erictune","followers_url":"https://api.github.com/users/erictune/followers","following_url":"https://api.github.com/users/erictune/following{/other_user}","gists_url":"https://api.github.com/users/erictune/gists{/gist_id}","starred_url":"https://api.github.com/users/erictune/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erictune/subscriptions","organizations_url":"https://api.github.com/users/erictune/orgs","repos_url":"https://api.github.com/users/erictune/repos","events_url":"https://api.github.com/users/erictune/events{/privacy}","received_events_url":"https://api.github.com/users/erictune/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-05-01T20:25:22Z","updated_at":"2015-05-01T20:25:22Z","closed_at":null,"body":"Mentioned in todays community meeting by @smarterclayton during @liggitt ServiceAccount demo.\r\n\r\nShould something generate a kubeconfig file with the token in it, for each service account?\r\nThis would allow me to simplify the code in cluster/saltbase/salt/kube-addons/kube-addons.sh which creates secrets to just create service accounts.\r\n\r\nWould this be the TokenController, or some new controller?\r\n\r\nWould the kubeconfig go into a separate secret, or the same secret as the bare token?\r\n  - if same, then is ServiceAccountSecret still the right secret type?\r\n  - if different, is it annoying to have so many volumes?\r\n  - if same, limited control over location of each?\r\n\r\nGiven that there is now a \"file format\" for tokens, should we just extend the kubeconfig format to support a `tokenFilename` field?  If we did that, is there any need to put the kubeconfig in a secret, since it just references secrets?\r\n\r\nWhat should be the canonical location where the automounter puts a kubeconfig file, so that clients don't have to specify a flag?\r\n"}}