30-secret-tokenrequestor.yaml

---
apiVersion: v1
kind: Secret
metadata:
  name: <some name>
  namespace: <some-ns>
  annotations:
    # name and namespace of the Service Account used for requesting the token
    # used for authorization by the token
    serviceaccount.resources.gardener.cloud/name: kube-scheduler
    serviceaccount.resources.gardener.cloud/namespace: kube-system

    # configure the expiration duration of the token. Defaults to 12h
    # serviceaccount.resources.gardener.cloud/token-expiration-duration: 12h

    # name and namespace of a Secret in the target cluster to which the token
    # should be synced (instead of this one)
    # token-requestor.resources.gardener.cloud/target-secret-name: kube-scheduler
    # token-requestor.resources.gardener.cloud/target-secret-namespace: kube-system
  labels:
    # the token-requestor will only act upon secrets with this label
    resources.gardener.cloud/purpose: token-requestor

    # the token-requestor can run with multiple instances in different components, hence it is possible to differentiate
    # which instance is responsible for this secret by defining the class label
    # resources.gardener.cloud/class: foo
type: Opaque