### **Cluster Lifecycle**

*   You must either specify the `--discovery-token-ca-cert-hash` flag to `kubeadm join`, or opt out of the CA pinning feature using `--discovery-token-unsafe-skip-ca-verification`.
*   The default `auto-detect` behavior of the kubelet's `--cloud-provider` flag is removed.

* `--service-account-lookup` now defaults to true, requiring the Secret API object containing the token to exist in order for a service account token to be valid. This enables service account tokens to be revoked by deleting the Secret object containing the token. ([#44071](https://github.com/kubernetes/kubernetes/pull/44071), [@liggitt](https://github.com/liggitt))

.Values.metrics.serviceMonitor.relabelConfigs }} {{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

.Values.metrics.serviceMonitor.relabelConfigs }} {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

.Values.metrics.serviceMonitor.relabelConfigs }} {{- toYaml .Values.metrics.serviceMonitor.relabelConfigs | nindent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

.Values.metrics.serviceMonitor.relabelConfigs }} {{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

    assertThat(response.cacheResponse!!.request.url).isEqualTo(request.url)
  }

  @Test
  fun postWithOverrideResponse() {
    val url = server.url("/abc?token=123")
    val cacheUrlOverride = url.newBuilder().removeAllQueryParameters("token").build()

    val request =
      Request.Builder()
        .url(url)
        .method("POST", "XYZ".toRequestBody())
        .cacheUrlOverride(cacheUrlOverride)

- Upon receiving a LIST request with an expired continue token, the apiserver now returns a continue token together with the 410 "the from parameter is too old" error. If the client does not care about getting a list from a consistent snapshot, the client can use this token to continue listing from the next key, but the returned chunk will be from the latest snapshot. ([#67284](https://github.com/kubernetes/kubernetes/pull/67284),...

.Values.metrics.serviceMonitor.relabelConfigs }} {{ toYaml .Values.metrics.serviceMonitor.relabelConfigs | indent 6 }} {{- end }} {{- if not .Values.metrics.serviceMonitor.public }} bearerTokenSecret: name: {{ template "minio.fullname" . }}-prometheus key: token {{- end }} namespaceSelector: matchNames: - {{ .Release.Namespace | quote }} selector: matchLabels: app: {{ include "minio.name" . }} release: {{ .Release.Name }} monitoring: "true" {{- end }} {{- if .Values.metrics.serviceMonitor.enabled }} --- apiVersion:...

# パスワード（およびハッシュ化）によるOAuth2、JWTトークンによるBearer

これでセキュリティの流れが全てわかったので、<abbr title="JSON Web Tokens">JWT</abbr>トークンと安全なパスワードのハッシュ化を使用して、実際にアプリケーションを安全にしてみましょう。

このコードは、アプリケーションで実際に使用したり、パスワードハッシュをデータベースに保存するといった用途に利用できます。

本章では、前章の続きから始めて、コードをアップデートしていきます。

## JWT について

JWTとは「JSON Web Tokens」の略称です。

JSONオブジェクトをスペースのない長く密集した文字列で表現したトークンの仕様です。例えば次のようになります：

```