Skip to content

cub serviceaccount token create

cub serviceaccount token create

Issue a long-lived token for a service account

Synopsis

Issue a long-lived token that authenticates as a service account.

The token is printed once and cannot be shown again; store it where the consumer will read it. By default it never expires. --expires-in sets an expiry, which a server may require by policy.

The token is a bearer token for the API, and a registry client uses it as a password with the username "token":

docker login <oci host> --username token --password-stdin

Examples: 

  # Issue a token for the service account Argo CD pulls as
  cub serviceaccount token create argo-prod --description "Argo CD, prod cluster"

  # A token that expires in a year
  cub serviceaccount token create argo-prod --expires-in 8760h

  # Just the token, for a script
  cub serviceaccount token create argo-prod -o jq=.Token

cub serviceaccount token create <service account> [flags]

Options

      --description string    note recording which system holds the token
      --dry-run               report what the command would write, and write nothing
      --expires-in duration   how long the token stays valid, such as 720h; unset means it does not expire
  -h, --help                  help for create
  -o, --output string         Output format. One of: json, yaml, name, wide, mutations, jq=<expr>, yq=<expr>, custom-columns=<spec>
      --quiet                 No default output.
      --verbose               Detailed output, additive with default output

Options inherited from parent commands

      --context string   The context to use for this command
      --debug            Debug output

SEE ALSO