Chapter 7. Enabling ManagedServiceAccount add-ons (Technology Preview)

Deploy the ManagedServiceAccount add-on and apply it to your target managed cluster. Create the following YAML file and replace target_managed_cluster with the name of the managed cluster where you are applying the Managed-ServiceAccount add-on:

apiVersion: addon.open-cluster-management.io/v1alpha1
kind: ManagedClusterAddOn
metadata:
  name: managed-serviceaccount
  namespace: <target_managed_cluster>
spec:
  installNamespace: open-cluster-management-agent-addon

Run the following command to apply the file:

oc apply -f -

You have now enabled the Managed-ServiceAccount plugin for your managed cluster. See the following steps to configure a ManagedServiceAccount.

Create a ManagedServiceAccount custom resource with the following YAML source:

apiVersion: authentication.open-cluster-management.io/v1alpha1
kind: ManagedServiceAccount
metadata:
  name: <managed_serviceaccount_name>
  namespace: <target_managed_cluster>
spec:
  rotation: {}

To verify, view the tokenSecretRef attribute in the ManagedServiceAccount object status to find the secret name and namespace. Run the following command with your account and cluster name:

oc get managedserviceaccount <managed_serviceaccount_name> -n <target_managed_cluster> -o yaml

View the Secret containing the retrieved token that is connected to the created ServiceAccount on the managed cluster. Run the following command:

oc get secret <managed_serviceaccount_name> -n <target_managed_cluster> -o yaml