As per the k8s official docs link-
The kubelet requires the following configuration to bootstrap:
A path to store the key and certificate it generates (optional, can use default)
What's the default path and where and how can I change the path where keys and certs generated for the kubelet are stored?
It is in /var/run/secrets/kubernetes.io/serviceaccount by default.
You can run
kubectl exec POD_NAME -it -- ls /var/run/secrets/kubernetes.io/serviceaccountAnd you will get :
ca.crt namespace tokenIt is defined in spec.volumeMounts.mountPath
Example :
apiVersion: v1
kind: Pod
...
spec:
containers:
...
volumeMounts:
- mountPath: /var/run/secrets/kubernetes.io/serviceaccount
name: my-pod-token-ctmvg
readOnly: true
...
volumes:
- name: my-pod-token-ctmvg
secret:
defaultMode: 420
secretName: my-pod-token-ctmvgIn other words it's mounted to Pod's volume.