Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCPBUGS#43809: Clarifying what's created for each service account #87965

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+13 −19
Open

OCPBUGS#43809: Clarifying what's created for each service account #87965

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions authentication/understanding-and-creating-service-accounts.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,8 @@ toc::[]

include::modules/service-accounts-overview.adoc[leveloffset=+1]

include::modules/service-account-auto-secret-removed.adoc[leveloffset=+2]

// include::modules/service-accounts-enabling-authentication.adoc[leveloffset=+1]

include::modules/service-accounts-creating.adoc[leveloffset=+1]
Expand Down
12 changes: 6 additions & 6 deletions modules/service-accounts-creating.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ $ oc get sa
[source,terminal]
----
NAME SECRETS AGE
builder 2 2d
default 2 2d
deployer 2 2d
builder 1 2d
default 1 2d
deployer 1 2d
----

. To create a new service account in the current project:
bergerhoffer marked this conversation as resolved.
Show resolved Hide resolved
Expand Down Expand Up @@ -67,10 +67,10 @@ $ oc describe sa robot
----
Name: robot
Namespace: project1
Labels: <none>
Annotations: <none>
Labels: <none>
Annotations: openshift.io/internal-registry-pull-secret-ref: robot-dockercfg-qzbhb
Image pull secrets: robot-dockercfg-qzbhb
Mountable secrets: robot-dockercfg-qzbhb
Tokens: robot-token-f4khf
Tokens: <none>
Events: <none>
----
2 changes: 1 addition & 1 deletion modules/service-accounts-granting-roles.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
// * authentication/using-service-accounts.adoc

[id="service-accounts-granting-roles_{context}"]
= Examples of granting roles to service accounts
= Granting roles to service accounts

You can grant roles to service accounts in the same way that you grant roles
to a regular user account.
Expand Down
16 changes: 4 additions & 12 deletions modules/service-accounts-overview.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,11 +15,12 @@ When you use the {product-title} CLI or web console, your API token
authenticates you to the API. You can associate a component with a service account
so that they can access the API without using a regular user's credentials.
ifdef::openshift-online,openshift-origin,openshift-enterprise,openshift-webscale[]

For example, service accounts can allow:
bergerhoffer marked this conversation as resolved.
Show resolved Hide resolved

* Replication controllers to make API calls to create or delete pods.
* Applications inside containers to make API calls for discovery purposes.
* External applications to make API calls for monitoring or integration purposes.
* Replication controllers to make API calls to create or delete pods
* Applications inside containers to make API calls for discovery purposes
* External applications to make API calls for monitoring or integration purposes
endif::[]

Each service account's user name is derived from its project and name:
Expand All @@ -45,12 +46,3 @@ Every service account is also a member of two groups:
specified project.

|===

Each service account automatically contains two secrets:

* An API token
* Credentials for the OpenShift Container Registry

The generated API token and registry credentials do not expire, but you can
revoke them by deleting the secret. When you delete the secret, a new one is
automatically generated to take its place.