15장. Configuring API tokens
Red Hat Advanced Cluster Security for Kubernetes (RHACS) requires API tokens for some system integrations, authentication processes, and system functions. You can configure tokens using the RHACS web interface.
참고
-
To prevent privilege escalation, when you create a new token, your role’s permissions limit the permission you can assign to that token. For example, if you only have
readpermission for the Integration resource, you cannot create a token withwritepermission. - If you want a custom role to create tokens for other users to use, you must assign the required permissions to that custom role.
-
Use short-lived tokens for machine-to-machine communication, such as CI/CD pipelines, scripts, and other automation. Also, use the
roxctl central logincommand for human-to-machine communication, such asroxctlCLI or API access. - The majority of cloud service providers support OIDC identity tokens, for example, Microsoft Entra ID, Google Cloud Identity Platform, and AWS Cognito. OIDC identity tokens issued by these services can be used for RHACS short-lived access.
- Third-party OIDC identity tokens can also be used directly to access the API endpoint, without an exchange, if a machine-to-machine configuration exists for the token issuer.
15.1. Creating an API token 링크 복사링크가 클립보드에 복사되었습니다!
링크 복사링크가 클립보드에 복사되었습니다!
Procedure
-
In the RHACS portal, go to Platform Configuration
Integrations. - Scroll to the Authentication Tokens category, and then click API Token.
- Click Generate Token.
- Enter a name for the token and select a role that provides the required level of access (for example, Continuous Integration or Sensor Creator).
Click Generate.
중요Copy the generated token and securely store it. You will not be able to view it again.