Api key deprecation #184

rb3ckers · 2026-01-15T15:50:28Z

No description provided.

netlify · 2026-01-15T15:50:34Z

✅ Deploy Preview for suse-obs ready!

Name	Link
🔨 Latest commit	`df200f5`
🔍 Latest deploy log	https://app.netlify.com/projects/suse-obs/deploys/69690cc7cda1810008ba9d5d
😎 Deploy Preview	https://deploy-preview-184--suse-obs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

deontaljaard · 2026-01-16T07:56:45Z

docs/latest/modules/en/pages/use/security/k8s-ingestion-api-keys.adoc

+
+Don't add a `update-scoped-permissions` permission, that will not work for a token that is used from multiple clusters.
+
+Now re-deploy your agents and Open Telemetry collectors by following the instructions available in the UI for the Kubernetes StackPack and the xref:setup/otel/getting-started/getting-started-k8s.adoc[Open Telemetry collector documentation]. Use the generated Service Token as the API key by following.


The last sentence reads like there should be more to it? Use the generated Service Token as the API key by following.

+1 to this.

deontaljaard · 2026-01-16T07:59:45Z

docs/latest/modules/en/pages/setup/security/authentication/service_tokens.adoc

----
-
-➡️ xref:/setup/cli/cli-sts.adoc#_authentication[Learn more about the SUSE Observability APIs]
+Use the xref:use/security/k8s-service-tokens.adoc[Service Tokens] to authenticate authenticate to SUSE Observability without having an associated a user account. Service tokens are the preferred way to authenticate from CI/CD, or when sending telemetry data from agents or Open Telemetry. How to create and use service tokens is described in the xref:use/security/k8s-service-tokens.adoc[Service Tokens documentation].


There's a floating article (a) in the first sentence - having an associated a user account

deontaljaard · 2026-01-16T08:02:04Z

docs/latest/modules/en/pages/use/security/k8s-ingestion-api-keys.adoc


 Ingestion API Keys were used by external tools to ingest data (such as metrics, events and traces) to the SUSE Observability cluster.
-These tools include the STS Agent or/and OTel Collector. The recommended authentication mechanism is through xref:/use/security/k8s-service-tokens.adoc#_authenticate_using_service_tokens_for_data_ingestion[Service Tokens].
+These tools include the STS Agent or/and OTel Collector. Service tokens have the same, and more, capabilities. Follow the same steps as for the API key (in the previous setion) to migrate to <<_migrate_to_a_service_token_per_cluster, a service token per cluster>> or <<_migrate_to_a_single_service_token, a single service token>>.


minor: there's not enough content between the headings and these anchors for them to work as expected.

deontaljaard · 2026-01-16T08:03:50Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

+
+[NOTE]
+====
+*Note:*


minor: the *Note:* is redundant in the rendered output (the note block already has a Note heading) - there's a double note.

deontaljaard · 2026-01-16T08:09:00Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

+
+* The first run of the helm upgrade command will result in pods restarting, which may cause a short interruption of availability.
+* Include `authentication.yaml` on every `helm upgrade` run.
+* The authentication configuration is stored as a Kubernetes secret.


Is there any housekeeping that needs to be done when the TTL on the bootstrap service token expires?

akashraj4261 · 2026-01-19T07:14:11Z

docs/latest/modules/en/pages/use/security/k8s-ingestion-api-keys.adoc

+update-metrics | system
+----
+
+Don't add a `update-scoped-permissions` permission, that will not work for a token that is used from multiple clusters.


Suggested change

Don't add a `update-scoped-permissions` permission, that will not work for a token that is used from multiple clusters.

Do not add a `update-scoped-permissions` permission as it will not work for a token that is used from multiple clusters.

akashraj4261 · 2026-01-19T07:14:42Z

docs/latest/modules/en/pages/use/security/k8s-ingestion-api-keys.adoc

+
+Don't add a `update-scoped-permissions` permission, that will not work for a token that is used from multiple clusters.
+
+Now re-deploy your agents and Open Telemetry collectors by following the instructions available in the UI for the Kubernetes StackPack and the xref:setup/otel/getting-started/getting-started-k8s.adoc[Open Telemetry collector documentation]. Use the generated Service Token as the API key by following.


Suggested change

Now re-deploy your agents and Open Telemetry collectors by following the instructions available in the UI for the Kubernetes StackPack and the xref:setup/otel/getting-started/getting-started-k8s.adoc[Open Telemetry collector documentation]. Use the generated Service Token as the API key by following.

Re-deploy your agents and Open Telemetry collectors by following the instructions available in the UI for the Kubernetes StackPack and the xref:setup/otel/getting-started/getting-started-k8s.adoc[Open Telemetry collector documentation]. Use the generated Service Token as the API key by following.

akashraj4261 · 2026-01-19T07:16:23Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

 Use "sts service-token [command] --help" for more information about a command.
 ----

+It's also possible to <<_set_up_a_bootstrap_service_token,set up a bootstrap service token>> when installing SUSE Observability.


Suggested change

It's also possible to <<_set_up_a_bootstrap_service_token,set up a bootstrap service token>> when installing SUSE Observability.

It's also possible to <<_set_up_a_bootstrap_service_token,set up a bootstrap service token>> when installing {stackstate-product-name}.

akashraj4261 · 2026-01-19T07:16:38Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

 ====

-To create a service token in your instance of SUSE Observability, you can use the `sts` CLI.
+To create a service token for SUSE Observability, you can use the `sts` CLI.


Suggested change

To create a service token for SUSE Observability, you can use the `sts` CLI.

To create a service token for {stackstate-product-name}, you can use the `sts` CLI.

akashraj4261 · 2026-01-19T07:17:15Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc


+=== Set up a bootstrap service token
+
+When installing SUSE Observability, it's possible to bootstrap it with a (temporary) service token. This allows for using the CLI without first interacting with SUSE Observability and obtaining an API token from the UI. In order to set this up, you can add the following snippet to the SUSE Observability configuration file:


Suggested change

When installing SUSE Observability, it's possible to bootstrap it with a (temporary) service token. This allows for using the CLI without first interacting with SUSE Observability and obtaining an API token from the UI. In order to set this up, you can add the following snippet to the SUSE Observability configuration file:

When installing {stackstate-product-name}, it's possible to bootstrap it with a (temporary) service token. This allows using the CLI without first interacting with {stackstate-product-name} and obtaining an API token from the UI. In order to set this up, add the following snippet to the {stackstate-product-name} configuration file:

akashraj4261 · 2026-01-19T07:17:50Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

+
+When installing SUSE Observability, it's possible to bootstrap it with a (temporary) service token. This allows for using the CLI without first interacting with SUSE Observability and obtaining an API token from the UI. In order to set this up, you can add the following snippet to the SUSE Observability configuration file:
+
+To configure SUSE Observability to create a bootstrap service token on Kubernetes, The following values need to be added to the file `authentication.yaml`. For example


Suggested change

To configure SUSE Observability to create a bootstrap service token on Kubernetes, The following values need to be added to the file `authentication.yaml`. For example

To configure {stackstate-product-name} to create a bootstrap service token on Kubernetes, the following values need to be added to the file `authentication.yaml`. For example:

akashraj4261 · 2026-01-19T07:18:13Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

+        ttl: 24h
+----
+
+Follow the steps below to configure SUSE Observability to create a bootstrap service token:


Suggested change

Follow the steps below to configure SUSE Observability to create a bootstrap service token:

Follow the steps below to configure {stackstate-product-name} to create a bootstrap service token:

akashraj4261 · 2026-01-19T07:19:18Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

+ ** *token* - The token that will be created on (initial) start of SUSE Observability.
+ ** *roles* - An array of roles that will be assigned to the bootstrap token.


Suggested change

** *token* - The token that will be created on (initial) start of SUSE Observability.

** *roles* - An array of roles that will be assigned to the bootstrap token.

** *token* - The token that is created at the (initial) start of {stackstate-product-name}.

** *roles* - An array of roles that are assigned to the bootstrap token.

akashraj4261 · 2026-01-19T07:19:29Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

+ ** *token* - The token that will be created on (initial) start of SUSE Observability.
+ ** *roles* - An array of roles that will be assigned to the bootstrap token.
+ ** *ttl* - Optional. The time-to-live for the service token, expressed as a duration string.
+. Store the file `authentication.yaml` together with the `values.yaml` from the SUSE Observability installation instructions.


Suggested change

. Store the file `authentication.yaml` together with the `values.yaml` from the SUSE Observability installation instructions.

. Store the file `authentication.yaml` together with the `values.yaml` from the {stackstate-product-name} installation instructions.

akashraj4261 · 2026-01-19T07:20:41Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

+
+==== Setup the bootstrap service token from an external secret
+
+When the bootstrap token should come from an external secret, follow xref:/setup/security/external-secrets.adoc#_getting_authentication_data_from_an_external_secret[these steps] and add the following data:


When the bootstrap token should come from an external secret- This isn't clear. Is it supposed to be - "When the bootstrap token is retrieved from an external secret"?

akashraj4261 · 2026-01-19T07:21:14Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

----
-> sts context --name <name> --service-token <TOKEN> --url https://<tenant>.app.stackstate.io
----
+A service token can be used for authentication with the `sts` CLI. For details, see xref:/setup/cli/cli-sts.adoc#_authentication[the CLI documentation].


Suggested change

A service token can be used for authentication with the `sts` CLI. For details, see xref:/setup/cli/cli-sts.adoc#_authentication[the CLI documentation].

A service token isd used for authentication with the `sts` CLI. For more information, see xref:/setup/cli/cli-sts.adoc#_authentication[the CLI documentation].

akashraj4261

Minor comments and typos.

viliakov · 2026-01-19T07:38:51Z

docs/latest/modules/en/pages/use/security/k8s-service-tokens.adoc

 === List service tokens

-The ID, name, expiration date and roles of all created service tokens can be seen using the `sts` CLI. For example:
+The ID, name, expiration date and roles of all created service tokens can be seen using the new `sts` CLI. For example:


Suggested change

The ID, name, expiration date and roles of all created service tokens can be seen using the new `sts` CLI. For example:

The ID, name, expiration date and roles of all created service tokens can be seen using the `sts` CLI. For example:

Should we stop use "new" for the cli? It is inconsistent even within this page. And also it might be confusing for those who aren't aware about the "old" cli.

rb3ckers added 2 commits January 15, 2026 16:46

STAC-23542 Migration from api key to service tokens

5335ab2

STAC-23542 Fix preview in makefile

df200f5

rb3ckers requested a review from a team as a code owner January 15, 2026 15:50

deontaljaard reviewed Jan 16, 2026

View reviewed changes

akashraj4261 reviewed Jan 19, 2026

View reviewed changes

viliakov reviewed Jan 19, 2026

View reviewed changes


		Don't add a `update-scoped-permissions` permission, that will not work for a token that is used from multiple clusters.

		Now re-deploy your agents and Open Telemetry collectors by following the instructions available in the UI for the Kubernetes StackPack and the xref:setup/otel/getting-started/getting-started-k8s.adoc[Open Telemetry collector documentation]. Use the generated Service Token as the API key by following.

	Don't add a `update-scoped-permissions` permission, that will not work for a token that is used from multiple clusters.
	Do not add a `update-scoped-permissions` permission as it will not work for a token that is used from multiple clusters.

	Now re-deploy your agents and Open Telemetry collectors by following the instructions available in the UI for the Kubernetes StackPack and the xref:setup/otel/getting-started/getting-started-k8s.adoc[Open Telemetry collector documentation]. Use the generated Service Token as the API key by following.
	Re-deploy your agents and Open Telemetry collectors by following the instructions available in the UI for the Kubernetes StackPack and the xref:setup/otel/getting-started/getting-started-k8s.adoc[Open Telemetry collector documentation]. Use the generated Service Token as the API key by following.

	It's also possible to <<_set_up_a_bootstrap_service_token,set up a bootstrap service token>> when installing SUSE Observability.
	It's also possible to <<_set_up_a_bootstrap_service_token,set up a bootstrap service token>> when installing {stackstate-product-name}.

	To create a service token for SUSE Observability, you can use the `sts` CLI.
	To create a service token for {stackstate-product-name}, you can use the `sts` CLI.


		=== Set up a bootstrap service token

		When installing SUSE Observability, it's possible to bootstrap it with a (temporary) service token. This allows for using the CLI without first interacting with SUSE Observability and obtaining an API token from the UI. In order to set this up, you can add the following snippet to the SUSE Observability configuration file:

	When installing SUSE Observability, it's possible to bootstrap it with a (temporary) service token. This allows for using the CLI without first interacting with SUSE Observability and obtaining an API token from the UI. In order to set this up, you can add the following snippet to the SUSE Observability configuration file:
	When installing {stackstate-product-name}, it's possible to bootstrap it with a (temporary) service token. This allows using the CLI without first interacting with {stackstate-product-name} and obtaining an API token from the UI. In order to set this up, add the following snippet to the {stackstate-product-name} configuration file:


		When installing SUSE Observability, it's possible to bootstrap it with a (temporary) service token. This allows for using the CLI without first interacting with SUSE Observability and obtaining an API token from the UI. In order to set this up, you can add the following snippet to the SUSE Observability configuration file:

		To configure SUSE Observability to create a bootstrap service token on Kubernetes, The following values need to be added to the file `authentication.yaml`. For example

	To configure SUSE Observability to create a bootstrap service token on Kubernetes, The following values need to be added to the file `authentication.yaml`. For example
	To configure {stackstate-product-name} to create a bootstrap service token on Kubernetes, the following values need to be added to the file `authentication.yaml`. For example:

	Follow the steps below to configure SUSE Observability to create a bootstrap service token:
	Follow the steps below to configure {stackstate-product-name} to create a bootstrap service token:

		** token - The token that will be created on (initial) start of SUSE Observability.
		** roles - An array of roles that will be assigned to the bootstrap token.

	. Store the file `authentication.yaml` together with the `values.yaml` from the SUSE Observability installation instructions.
	. Store the file `authentication.yaml` together with the `values.yaml` from the {stackstate-product-name} installation instructions.


		==== Setup the bootstrap service token from an external secret

		When the bootstrap token should come from an external secret, follow xref:/setup/security/external-secrets.adoc#_getting_authentication_data_from_an_external_secret[these steps] and add the following data:

	A service token can be used for authentication with the `sts` CLI. For details, see xref:/setup/cli/cli-sts.adoc#_authentication[the CLI documentation].
	A service token isd used for authentication with the `sts` CLI. For more information, see xref:/setup/cli/cli-sts.adoc#_authentication[the CLI documentation].

	The ID, name, expiration date and roles of all created service tokens can be seen using the new `sts` CLI. For example:
	The ID, name, expiration date and roles of all created service tokens can be seen using the `sts` CLI. For example:

Api key deprecation #184

Are you sure you want to change the base?

Api key deprecation #184

Conversation

rb3ckers commented Jan 15, 2026

Uh oh!

netlify bot commented Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for suse-obs ready!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akashraj4261 Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akashraj4261 Jan 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

akashraj4261 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

netlify bot commented Jan 15, 2026 •

edited

Loading

akashraj4261 Jan 19, 2026 •

edited

Loading

akashraj4261 Jan 19, 2026 •

edited

Loading