Skip to content

cub serviceaccount token revoke

cub serviceaccount token revoke

Revoke a service account's long-lived token

Synopsis

Revoke one long-lived token, by its id.

The token stops working within a minute on every server. Its record stays, marked revoked, so the list still shows it was issued. The service account's other credentials keep working.

To rotate without an outage, issue the new token first, move the consumer over, confirm the new token's Last-Used is moving, and only then revoke the old one.

Examples: 

  cub serviceaccount token revoke argo-prod 6f1c2a9e-3b7d-4e0a-9c11-2d5f8b7a4c3e

cub serviceaccount token revoke <service account> <jti> [flags]

Options

  -h, --help            help for revoke
  -o, --output string   Output format. One of: json, yaml, name, wide, mutations, jq=<expr>, yq=<expr>, custom-columns=<spec>
      --quiet           No default output.
      --verbose         Detailed output, additive with default output

Options inherited from parent commands

      --context string   The context to use for this command
      --debug            Debug output

SEE ALSO