Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-48650

Service Account Tokens should not automatically created as per the OpenShift documentation.

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • 2
    • Important
    • None
    • None
    • None
    • None
    • OSDOCS Sprint 267
    • 1
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      According to the official OpenShift documentation https://docs.openshift.com/container-platform/4.17/authentication/understanding-and-creating-service-accounts.html, when a Service Account is created using the `oc create sa` command, an API token is automatically generated and associated with the Service Account.
      
      $ oc describe sa robot
      
      Name:                robot
      Namespace:           project1
      Labels:                 <none>
      Annotations:         <none>
      Image pull secrets:  robot-dockercfg-qzbhb
      Mountable secrets:   robot-dockercfg-qzbhb
      Tokens:              robot-token-f4khf <------------------------
      Events:              <none>
      
      However, in practice, no token is created by default. This discrepancy can lead to confusion for users relying on the documentation.When the Service Account is described using the `oc describe sa <service_account_name>` command, the "Tokens" field is absent, whereas the documentation implies that the token should be created automatically and listed under this field.      

      Version-Release number of selected component (if applicable):

          

      How reproducible:

          

      Steps to Reproduce:

          1. oc create sa <sa_name>
          2. oc describe sa <sa_name>
      
          Name:                <sa_name>
      Namespace:           testkhushi
      Labels:              <none>
      Annotations:         <none>
      Image pull secrets:  <sa_name>-dockercfg-hfbbk
      Mountable secrets:   <sa_nane>-dockercfg-hfbbk
      Tokens:              <none>     <----------------------
      Events:              <none>
      
          3.
          

      Actual results:

      The `oc describe sa <service_account_name>` command does not show a token under the "Tokens" field by default, requiring users to manually create a token.
      

      Expected results:

      The documentation should be updated to reflect the current behavior, where a Service Account does not automatically generate a token upon creation. It would be helpful if the example output for `oc describe sa <service_account_name>` could show "None" or similar for the "Tokens" field. Additionally, the documentation should include guidance on how to manually create long-lived API tokens for Service Accounts.    

      Additional info:

          

              rhn-support-ahoffer Andrea Hoffer
              rhn-support-kchawlan Khushi Chawlani
              None
              None
              None
              None
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated:
                Resolved: