You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* For information about requesting bound service account tokens, see xref:../authentication/bound-service-account-tokens.adoc#bound-sa-tokens-configuring_bound-service-account-tokens[Configuring bound service account tokens using volume projection].
18
-
19
-
* For information about creating a service account token secret, see xref:../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating-sa_nodes-pods-secrets[Creating a service account token secret].
Copy file name to clipboardExpand all lines: modules/cluster-image-registry-operator.adoc
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,11 +34,11 @@ If insufficient information is available to define a complete `image-registry` r
34
34
The Cluster Image Registry Operator runs in the `openshift-image-registry` namespace and it also manages the registry instance in that location. All configuration and workload resources for the registry reside in that namespace.
35
35
36
36
ifdef::cluster-caps[]
37
-
In order to integrate the image registry into the cluster's user authentication and authorization system, a service account token secret and an image pull secret are generated for each service account in the cluster.
37
+
In order to integrate the image registry into the cluster's user authentication and authorization system, an image pull secret is generated for each service account in the cluster.
38
38
39
39
[IMPORTANT]
40
40
====
41
-
If you disable the `ImageRegistry` capability or if you disable the integrated {product-registry} in the Cluster Image Registry Operator's configuration, the service account token secret and image pull secret are not generated for each service account.
41
+
If you disable the `ImageRegistry` capability or if you disable the integrated {product-registry} in the Cluster Image Registry Operator's configuration, the image pull secret is not generated for each service account.
42
42
====
43
43
44
44
If you disable the `ImageRegistry` capability, you can reduce the overall resource footprint of {product-title} in resource-constrained environments. Depending on your deployment, you can disable this component if you do not need it.
Copy file name to clipboardExpand all lines: modules/nodes-pods-secrets-creating-sa.adoc
+13-7Lines changed: 13 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,24 +4,30 @@
4
4
5
5
:_mod-docs-content-type: PROCEDURE
6
6
[id="nodes-pods-secrets-creating-sa_{context}"]
7
-
= Creating a service account token secret
7
+
= Creating a legacy service account token secret
8
8
9
-
As an administrator, you can create a service account token secret, which allows you to distribute a service account token to applications that must authenticate to the API.
9
+
As an administrator, you can create a legacy service account token secret, which allows you to distribute a service account token to applications that must authenticate to the API.
10
10
11
-
[NOTE]
11
+
[WARNING]
12
12
====
13
-
It is recommended to obtain bound service account tokens using the TokenRequest API instead of using service account token secrets. The tokens obtained from the TokenRequest API are more secure than the tokens stored in secrets, because they have a bounded lifetime and are not readable by other API clients.
13
+
It is recommended to obtain bound service account tokens using the TokenRequest API instead of using legacy service account token secrets. You should create a service account token secret only if you cannot use the TokenRequest API and if the security exposure of a nonexpiring token in a readable API object is acceptable to you.
14
14
15
-
You should create a service account token secret only if you cannot use the TokenRequest API and if the security exposure of a non-expiring token in a readable API object is acceptable to you.
15
+
Bound service account tokens are more secure than service account token secrets for the following reasons:
16
16
17
-
See the Additional resources section that follows for information on creating bound service account tokens.
17
+
* Bound service account tokens have a bounded lifetime.
18
+
* Bound service account tokens contain audiences.
19
+
* Bound service account tokens can be bound to pods or secrets and the bound tokens are invalidated when the bound object is removed.
20
+
21
+
Workloads are automatically injected with a projected volume to obtain a bound service account token. If your workload needs an additional service account token, add an additional projected volume in your workload manifest.
22
+
23
+
For more information, see "Configuring bound service account tokens using volume projection".
18
24
====
19
25
20
26
.Procedure
21
27
22
28
. Create a `Secret` object in a YAML file on a control plane node:
Copy file name to clipboardExpand all lines: modules/service-account-auto-secret-removed.adoc
+7-25Lines changed: 7 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,37 +5,19 @@
5
5
6
6
:_mod-docs-content-type: CONCEPT
7
7
[id="auto-generated-sa-token-secrets_{context}"]
8
-
= Automatically generated secrets
8
+
= Automatically generated image pull secrets
9
9
10
-
By default, {product-title} creates the following secrets for each service account:
10
+
By default, {product-title} creates an image pull secret for each service account.
11
11
12
-
* A dockercfg image pull secret
13
-
* A service account token secret
14
-
+
15
12
[NOTE]
16
13
====
17
-
Prior to {product-title} 4.11, a second service account token secret was generated when a service account was created. This service account token secret was used to access the Kubernetes API.
14
+
Prior to {product-title} 4.16, a long-lived service account API token secret was also generated for each service account that was created. Starting with {product-title} 4.16, this service account API token secret is no longer created.
18
15
19
-
Starting with {product-title} 4.11, this second service account token secret is no longer created. This is because the `LegacyServiceAccountTokenNoAutoGeneration` upstream Kubernetes feature gate was enabled, which stops the automatic generation of secret-based service account tokens to access the Kubernetes API.
20
-
21
-
After upgrading to {product-version}, any existing service account token secrets are not deleted and continue to function.
16
+
After upgrading to {product-version}, any existing long-lived service account API token secrets are not deleted and will continue to function. For information about detecting long-lived API tokens that are in use in your cluster or deleting them if they are not needed, see the Red Hat Knowledgebase article link:https://access.redhat.com/articles/7058801[Long-lived service account API tokens in OpenShift Container Platform].
22
17
====
23
18
24
-
This service account token secret and docker configuration image pull secret are necessary to integrate the {product-registry} into the cluster's user authentication and authorization system.
25
-
26
-
However, if you do not enable the `ImageRegistry` capability or if you disable the integrated {product-registry} in the Cluster Image Registry Operator's configuration, these secrets are not generated for each service account.
27
-
28
-
[WARNING]
29
-
====
30
-
Do not rely on these automatically generated secrets for your own use; they might be removed in a future {product-title} release.
31
-
====
32
-
33
-
Workloads are automatically injected with a projected volume to obtain a bound service account token. If your workload needs an additional service account token, add an additional projected volume in your workload manifest. Bound service account tokens are more secure than service account token secrets for the following reasons:
34
-
35
-
* Bound service account tokens have a bounded lifetime.
36
-
* Bound service account tokens contain audiences.
37
-
* Bound service account tokens can be bound to pods or secrets and the bound tokens are invalidated when the bound object is removed.
19
+
This image pull secret is necessary to integrate the {product-registry} into the cluster's user authentication and authorization system.
38
20
39
-
For more information, see _Configuring bound service account tokens using volume projection_.
21
+
However, if you do not enable the `ImageRegistry` capability or if you disable the integrated {product-registry} in the Cluster Image Registry Operator's configuration, an image pull secret is not generated for each service account.
40
22
41
-
You can also manually create a service account token secret to obtain a token, if the security exposure of a non-expiring token in a readable API object is acceptable to you. For more information, see _Creating a service account token secret_.
23
+
When the integrated {product-registry} is disabled on a cluster that previously had it enabled, the previously generated image pull secrets are deleted automatically.
* For information about requesting bound service account tokens, see xref:../../authentication/bound-service-account-tokens.adoc#bound-sa-tokens-configuring_bound-service-account-tokens[Using bound service account tokens]
21
-
endif::openshift-rosa,openshift-dedicated[]
22
-
* For information about creating a service account token secret, see xref:../../nodes/pods/nodes-pods-secrets.doc#nodes-pods-secrets-creating-sa_nodes-pods-secrets[Creating a service account token secret].
* For more information on using secrets in pods, see xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets].
24
+
* xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets]
* For more information on using secrets in pods, see xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets].
31
+
* xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets]
39
32
40
33
ifndef::openshift-rosa,openshift-dedicated[]
41
34
42
-
* For information on requesting bound service account tokens, see xref:../../authentication/bound-service-account-tokens.adoc#bound-sa-tokens-configuring_bound-service-account-tokens[Using bound service account tokens]
35
+
* xref:../../authentication/bound-service-account-tokens.adoc#bound-sa-tokens-configuring_bound-service-account-tokens[Configuring bound service account tokens using volume projection]
43
36
44
-
* For information on creating service accounts, see xref:../../authentication/understanding-and-creating-service-accounts.adoc#understanding-and-creating-service-accounts[Understanding and creating service accounts].
37
+
* xref:../../authentication/understanding-and-creating-service-accounts.adoc#understanding-and-creating-service-accounts[Understanding and creating service accounts]
* For more information on using secrets in pods, see xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets].
45
+
* xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets]
* For more information on using secrets in pods, see xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets].
59
+
* xref:../../nodes/pods/nodes-pods-secrets.adoc#nodes-pods-secrets-creating_nodes-pods-secrets[Understanding how to create secrets]
0 commit comments