Add service account to Kubernetes

[Bertrand NOEL]

Some pods deployed in a Kubernetes cluster may need to access its API. For example Kubernetes' new dashboard, or Prometheus. The usual way is to have a service account, and make the client use a token [1]. In Kubernetes it is done by creating a Secret, and exposing it to the pod on this path "/var/run/secrets/kubernetes.io/serviceaccount/token" [1].
To have that, Kubernetes needs to enable the ServiceAccount plug-in in the list of Admission Controller [2][3]. The ServiceAccount is in the recommended set of plug-ins to use [3].

[1] http://kubernetes.io/docs/user-guide/accessing-the-cluster/#accessing-the-api-from-a-pod
[2] http://kubernetes.io/docs/admin/admission-controllers/
[3] http://kubernetes.io/docs/admin/admission-controllers/#is-there-a-recommended-set-of-plug-ins-to-use
[4] https://github.com/prometheus/prometheus/blob/master/documentation/examples/prometheus-kubernetes.yml#L40 Example, Prometheus expecting a token at path /var/run/secrets/kubernetes.io/serviceaccount/token

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/405374

[Spyros Trigazis (strigazi)]

we need the following argument in the controller manager

--service-account-private-key-file=/etc/kubernetes/ssl/kube-serviceaccount.key

Source: https://github.com/kubernetes/kubernetes/issues/29549

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/405374
Committed: https://git.openstack.org/cgit/openstack/magnum/commit/?id=1f3b0500b7de384a6d1cacc39affdf716f0b0679
Submitter: Jenkins
Branch: master

commit 1f3b0500b7de384a6d1cacc39affdf716f0b0679
Author: Bertrand NOEL <email address hidden>
Date: Thu Dec 1 14:23:42 2016 +0100

    K8S: Allows to specify admission control plugins to enable

    If nothing is specified a set of recommended default plugins is used,
    which includes the ServiceAccount one.

    Change-Id: I1383aae09ba68f8e83b07e3eaae40ab071f7be94
    Closes-Bug: #1646489

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/magnum 4.1.0 release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/newton
Review: https://review.openstack.org/483940

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/483940
Committed: https://git.openstack.org/cgit/openstack/magnum/commit/?id=98f4ae9942ee55c1e7454bb257f21d935c403cb2
Submitter: Jenkins
Branch: stable/newton

commit 98f4ae9942ee55c1e7454bb257f21d935c403cb2
Author: Bertrand NOEL <email address hidden>
Date: Thu Dec 1 14:23:42 2016 +0100

    K8S: Allows to specify admission control plugins to enable

    If nothing is specified a set of recommended default plugins is used,
    which includes the ServiceAccount one.

    Change-Id: I1383aae09ba68f8e83b07e3eaae40ab071f7be94
    Closes-Bug: #1646489
    (cherry picked from commit 1f3b0500b7de384a6d1cacc39affdf716f0b0679)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/magnum 3.3.0 release.