table of contents
OC CREATE(1) | June 2016 | OC CREATE(1) |
NAME¶
oc create token - Request a service account token
SYNOPSIS¶
oc create token [OPTIONS]
DESCRIPTION¶
Request a service account token.
OPTIONS¶
--allow-missing-template-keys=true
If true, ignore any errors in templates when a field or map key is missing in
the template. Only applies to golang and jsonpath output formats.
--audience=[]
Audience of the requested token. If unset, defaults to requesting a token for
use with the Kubernetes API server. May be repeated to request a token valid
for multiple audiences.
--bound-object-kind=""
Kind of an object to bind the token to. Supported kinds are Pod, Secret. If
set, --bound-object-name must be provided.
--bound-object-name=""
Name of an object to bind the token to. The token will expire when the object
is deleted. Requires --bound-object-kind.
--bound-object-uid=""
UID of an object to bind the token to. Requires --bound-object-kind and
--bound-object-name. If unset, the UID of the existing object is used.
--duration=0
Requested lifetime of the issued token. If not set or if set to 0, the
lifetime will be determined by the server automatically. The server may
return a token with a longer or shorter lifetime.
-o, --output=""
Output format. One of: (json, yaml, name, go-template, go-template-file,
template, templatefile, jsonpath, jsonpath-as-json, jsonpath-file).
--show-managed-fields=false
If true, keep the managedFields when printing objects in JSON or YAML
format.
--template=""
Template string or path to template file to use when -o=go-template,
-o=go-template-file. The template format is golang templates [
⟨http://golang.org/pkg/text/template/#pkg-overview⟩].
OPTIONS INHERITED FROM PARENT COMMANDS¶
--as=""
Username to impersonate for the operation. User could be a regular user or a
service account in a namespace.
--as-group=[]
Group to impersonate for the operation, this flag can be repeated to specify
multiple groups.
--as-uid=""
UID to impersonate for the operation.
--cache-dir="/home/abuild/.kube/cache"
Default cache directory
--certificate-authority=""
Path to a cert file for the certificate authority
--client-certificate=""
Path to a client certificate file for TLS
--client-key=""
Path to a client key file for TLS
--cluster=""
The name of the kubeconfig cluster to use
--context=""
The name of the kubeconfig context to use
--disable-compression=false
If true, opt-out of response compression for all requests to the server
--insecure-skip-tls-verify=false
If true, the server's certificate will not be checked for validity. This will
make your HTTPS connections insecure
--kubeconfig=""
Path to the kubeconfig file to use for CLI requests.
--match-server-version=false
Require server version to match client version
-n, --namespace=""
If present, the namespace scope for this CLI request
--profile="none"
Name of profile to capture. One of
(none|cpu|heap|goroutine|threadcreate|block|mutex)
--profile-output="profile.pprof"
Name of the file to write the profile to
--request-timeout="0"
The length of time to wait before giving up on a single server request.
Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h).
A value of zero means don't timeout requests.
-s, --server=""
The address and port of the Kubernetes API server
--tls-server-name=""
Server name to use for server certificate validation. If it is not provided,
the hostname used to contact the server is used
--token=""
Bearer token for authentication to the API server
--user=""
The name of the kubeconfig user to use
--warnings-as-errors=false
Treat warnings received from the server as errors and exit with a non-zero
exit code
EXAMPLE¶
# Request a token to authenticate to the kube-apiserver as the service account "myapp" in the current namespace
oc create token myapp
# Request a token for a service account in a custom namespace
oc create token myapp --namespace myns
# Request a token with a custom expiration
oc create token myapp --duration 10m
# Request a token with a custom audience
oc create token myapp --audience https://example.com
# Request a token bound to an instance of a Secret object
oc create token myapp --bound-object-kind Secret --bound-object-name mysecret
# Request a token bound to an instance of a Secret object with a specific UID
oc create token myapp --bound-object-kind Secret --bound-object-name mysecret --bound-object-uid 0d4691ed-659b-4935-a832-355f77ee47cc
SEE ALSO¶
HISTORY¶
June 2016, Ported from the Kubernetes man-doc generator
Openshift CLI User Manuals | Openshift |