# serviceaccount

Published articles for serviceaccount.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## 【kube-apiserver】Authentication：SA、Bearer、OIDC 边界

DevFeed: [【kube-apiserver】Authentication：SA、Bearer、OIDC 边界](<https://devfeed.tech/articles/kube-apiserver-authentication-sa-bearer-oidc-33966.md>)

Original publisher: [Read original article](<https://quant67.com/post/apiserver/10-authentication/10-authentication.html>)

Author: Liao Tonglang

Published: 2026-08-28T00:00:00Z

Content type: tutorial

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [JSON Web Tokens](<https://devfeed.tech/topics/jwt.md>), [authz](<https://devfeed.tech/topics/authz.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [apiserver](<https://devfeed.tech/tags/apiserver.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [bearer-token](<https://devfeed.tech/tags/bearer-token.md>), [distributed](<https://devfeed.tech/tags/distributed.md>), [jwt](<https://devfeed.tech/tags/jwt.md>), [k8s](<https://devfeed.tech/tags/k8s.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [serviceaccount](<https://devfeed.tech/tags/serviceaccount.md>), [v1-30-3](<https://devfeed.tech/tags/v1-30-3.md>)

### AI overview

This Chinese-language tutorial explains the kube-apiserver authentication chain in Kubernetes v1.30.3. It distinguishes X.509 certificates, ServiceAccount tokens, static and bootstrap tokens, OIDC JWTs, webhook authentication, and anonymous requests, and separates authentication failures such as 401 from storage-layer failures such as 503 or 504.

### Source excerpt

钉 K8s v1.30.3 的认证链：X509、SA token（bound token）、Bearer、OIDC、Webhook token、匿名用户；ServiceAccount bound token 与 TokenRequest 语义；apiserver 认证 flags 边界；401 与存储层故障的分列；AuthZ 路径见第 11 篇。

## 【Istio 控制面】Linkerd 对照：非 xDS 的控制面机制

DevFeed: [【Istio 控制面】Linkerd 对照：非 xDS 的控制面机制](<https://devfeed.tech/articles/istio-linkerd-xds-34002.md>)

Original publisher: [Read original article](<https://quant67.com/post/istio-xds/14-linkerd-contrast/14-linkerd-contrast.html>)

Author: Liao Tonglang

Published: 2026-08-11T00:00:00Z

Content type: article

Language: zh

Sources: [土法炼钢 - 系统与基础设施](<https://devfeed.tech/sources/source-4.md>)

Topics: [istio](<https://devfeed.tech/topics/istio.md>), [linkerd](<https://devfeed.tech/topics/linkerd.md>), [API](<https://devfeed.tech/topics/api.md>), [proxy](<https://devfeed.tech/topics/proxy.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [control-plane](<https://devfeed.tech/tags/control-plane.md>), [destination-controller](<https://devfeed.tech/tags/destination-controller.md>), [envoy](<https://devfeed.tech/tags/envoy.md>), [go](<https://devfeed.tech/tags/go.md>), [identity](<https://devfeed.tech/tags/identity.md>), [istio](<https://devfeed.tech/tags/istio.md>), [istiod](<https://devfeed.tech/tags/istiod.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linkerd](<https://devfeed.tech/tags/linkerd.md>), [mechanism-comparison](<https://devfeed.tech/tags/mechanism-comparison.md>), [network](<https://devfeed.tech/tags/network.md>), [policy](<https://devfeed.tech/tags/policy.md>), [proxy](<https://devfeed.tech/tags/proxy.md>), [route](<https://devfeed.tech/tags/route.md>), [rust](<https://devfeed.tech/tags/rust.md>), [service](<https://devfeed.tech/tags/service.md>), [serviceaccount](<https://devfeed.tech/tags/serviceaccount.md>), [sidecar](<https://devfeed.tech/tags/sidecar.md>), [xds](<https://devfeed.tech/tags/xds.md>)

### AI overview

This article compares Linkerd's control-plane architecture with Istio's istiod and xDS model. It describes Linkerd's separately deployed destination, identity, and proxy-injector components; its proxy-specific gRPC APIs; and its CSR-based identity issuance, contrasting these with Istio's consolidated control plane and xDS/SDS resource model. It explicitly avoids declaring either system superior without workload-specific evidence.

### Source excerpt

以官方文档为准，对照 Linkerd destination/identity 控制面与 Istio istiod/xDS 的机制差异：资源模型、订阅形状、身份签发路径；只讲机制边界，不判定优劣。