Add custom claims into bound service account JWT token?

General Discussions
,
1

I have a k8s cluster in EKS where pods are assigned bound service account tokens like so:

    volumeMounts:
    - mountPath: /test
      name: test
      readOnly: true
...
  volumes:
  - name: test
    projected:
      sources:
      - serviceAccountToken:
          path: test
          expirationSeconds: 7200
          audience: test

The resulting token includes some metadata like the namespace and pod name. Is it possible to add additional custom metadata into the JWT?

1 Like