Epic Goal

Remove long lived tokens and move to single use tokens.

Why is this important?

Security

Scenarios

oc get secrets \
    --all-namespaces \
    --field-selector type=kubernetes.io/service-account-token

Shows three secrets:

hiveadmission-sa-token

open-cluster-management-compliance-history-api-recorder

application-manager

oc get secrets \
    --all-namespaces \
    --show-labels \
    --field-selector type=kubernetes.io/service-account-token \
    --selector kubernetes.io/legacy-token-last-used

The above query shows that the ACM tokens aren't used unless the specific feature gets used.

Acceptance Criteria

Remove any long lived tokens.

Dependencies (internal and external)

1. Hive, Policy, AppSubscription

Previous Work (Optional):

1. Discusses with xiangli@redhat.com 

Open questions:

1. Can a justification be provided as the solution? (I don't think so, but figured I would ask)

Done Checklist

• DEV - No more long lived tokens.