Skip to content

cub serviceaccount key

cub serviceaccount key

Manage the public keys a service account authenticates with

Synopsis

Manage the public keys a service account authenticates with.

The holder of the matching private key authenticates as the service account by signing a short-lived assertion, so ConfigHub never receives or stores a secret.

Registering or deleting a key is acting as the service account: whoever holds the private key authenticates as it from then on. It requires Impersonate permission on the service account, which Manage does not include. Whoever creates a service account is given Impersonate on it, and only someone who has Impersonate can grant it to another user. A service account cannot register a key for itself. Listing keys requires View.

Options

  -h, --help   help for key

Options inherited from parent commands

      --context string   The context to use for this command
      --debug            Debug output

SEE ALSO