cub serviceaccount token

cub serviceaccount token

Manage the long-lived tokens a service account authenticates with

Synopsis

Manage the long-lived tokens issued to a service account.

A long-lived token is a ConfigHub token with no expiry, for a consumer that can hold only a static credential: a username/password field in a third-party system, such as an Argo CD repository Secret. Anything that can sign an assertion ("cub auth login --private-key") should use a key instead.

The token is shown once, when it is issued, and ConfigHub does not keep it. What it keeps is a record per token, so a token can be revoked on its own, and so an operator can see which tokens exist, who issued them, and when each was last used.

Issuing or revoking a token is acting as the service account: whoever holds the token authenticates as it until the token is revoked. It requires Impersonate permission on the service account, which Manage does not include. A service account cannot issue a token for itself. Listing tokens requires View.

Options

  -h, --help   help for token

Options inherited from parent commands

      --context string   The context to use for this command
      --debug            Debug output

SEE ALSO

• cub serviceaccount - Service account commands
• cub serviceaccount token create - Issue a long-lived token for a service account
• cub serviceaccount token list - List the long-lived tokens issued to a service account
• cub serviceaccount token revoke - Revoke a service account's long-lived token