Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

Chapter 17. Configuring API tokens

Red Hat Advanced Cluster Security for Kubernetes (RHACS) requires API tokens for some system integrations, authentication processes, and system functions. You can configure tokens using the RHACS web interface.

Note
  • To prevent privilege escalation, when you create a new token, your role’s permissions limit the permission you can assign to that token. For example, if you only have read permission for the Integration resource, you cannot create a token with write permission.
  • If you want a custom role to create tokens for other users to use, you must assign the required permissions to that custom role.
  • Use short-lived tokens for machine-to-machine communication, such as CI/CD pipelines, scripts, and other automation. Also, use the roxctl central login command for human-to-machine communication, such as roxctl CLI or API access.
  • The majority of cloud service providers support OIDC identity tokens, for example, Microsoft Entra ID, Google Cloud Identity Platform, and AWS Cognito. OIDC identity tokens issued by these services can be used for RHACS short-lived access.
  • Third-party OIDC identity tokens can also be used directly to access the API endpoint, without an exchange, if a machine-to-machine configuration exists for the token issuer.

17.1. Creating an API token
링크 복사

Procedure

  1. In the RHACS portal, go to Platform Configuration Integrations.
  2. Scroll to the Authentication Tokens category, and then click API Token.
  3. Click Generate Token.
  4. Enter a name for the token and select a role that provides the required level of access (for example, Continuous Integration or Sensor Creator).

  5. Click Generate.

    Important

    Copy the generated token and securely store it. You will not be able to view it again.

17.2. About API token expiration
링크 복사

You use API tokens in Red Hat Advanced Cluster Security for Kubernetes (RHACS) for several authentication and access functions, such as API access, CLI access, and authentication. API tokens expire one year from the creation date, and RHACS alerts you when a token expires soon.

RHACS provides notifications in the web interface and by sending log messages to Central when a token will expire in less than one week. The log message process runs once an hour. Once a day, the process lists the tokens that are expiring and creates a log message for each one. Log messages are issued once a day and appear in Central logs.

Logs have the format as shown in the following example: 

Warn: API Token [token name] (ID [token ID]) will expire in less than X days.
Copy to Clipboard Toggle word wrap

You can change the default settings for the log message process by configuring the environment variables shown in the following table:

Expand

Environment variable

Default value

Description

ROX_TOKEN_EXPIRATION_NOTIFIER_INTERVAL

1h (1 hour)

The frequency at which the log message background loop that lists tokens and creates the logs will run.

ROX_TOKEN_EXPIRATION_NOTIFIER_BACKOFF_INTERVAL

24h (1 day)

The frequency at which the loop lists tokens and issues notifications.

ROX_TOKEN_EXPIRATION_DETECTION_WINDOW

168h (1 week)

The time period before expiration of the token that will cause the notification to be generated.

Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2026 Red Hat맨 위로 이동