Fresh Omni instance bootstrap for CI: how do we create/register the first Service Account (no UI) so omnictl can run?

[MoAbdelwahabDrager]

We have an automated test environment (CI) where we bring up a new Omni instance from scratch and then run non-interactive tests using omnictl (inside a Kubernetes pod).

Most of the commands we need (apply templates / list clusters / etc.) appear to require auth via OMNI_SERVICE_ACCOUNT_KEY, but on a fresh instance we have no service account key yet.

What is the supported “bootstrap” path to create/register the first Service Account + key without using the UI?
Concretely:

Is there a CLI flow in omnictl to create the first SA/key?
Or does the initial install generate a bootstrap/admin credential somewhere (K8s Secret / config)?
If SA creation requires pre-existing auth, what is the recommended CI-friendly way to obtain that initial credential?
We’re mainly looking for the official guidance / best practice for Day-0 automation.

[utkuozdemir]

Hi,

We have a functionality to create a service account token at omni startup via these flags:

      --create-initial-service-account                          create and dump a service account credentials on the first start of Omni
      --initial-service-account-key-path string                 dump the initial service account key into the path (default "_out/initial-service-account-key")
      --initial-service-account-lifetime duration               the lifetime duration of the initial service account key (default 1h0m0s)
      --initial-service-account-role string                     the initial service account access role (default "Admin")

You can see all the flags by running:

docker run --rm ghcr.io/siderolabs/omni:v1.4.8 --help