KUBERNETES(1)(kubernetes)                            KUBERNETES(1)(kubernetes)

Eric Paris Jan 2015


NAME
       kubectl create token - Request a service account token



SYNOPSIS
       kubectl create token [OPTIONS]



DESCRIPTION
       Request a service account token.



OPTIONS
       --allow-missing-template-keys=true      If true, ignore any errors in
       templates when a field or map key is missing in the template. Only
       applies to golang and jsonpath output formats.


       --audience=[]  Audience of the requested token. If unset, defaults to
       requesting a token for use with the Kubernetes API server. May be
       repeated to request a token valid for multiple audiences.


       --bound-object-kind=""   Kind of an object to bind the token to.
       Supported kinds are Pod, Secret. If set, --bound-object-name must be
       provided.


       --bound-object-name=""   Name of an object to bind the token to. The
       token will expire when the object is deleted. Requires --bound-object-
       kind.


       --bound-object-uid=""    UID of an object to bind the token to.
       Requires --bound-object-kind and --bound-object-name. If unset, the UID
       of the existing object is used.


       --duration=0s  Requested lifetime of the issued token. If not set, the
       lifetime will be determined by the server automatically. The server may
       return a token with a longer or shorter lifetime.


       -o, --output=""     Output format. One of: (json, yaml, name, go-
       template, go-template-file, template, templatefile, jsonpath, jsonpath-
       as-json, jsonpath-file).


       --show-managed-fields=false   If true, keep the managedFields when
       printing objects in JSON or YAML format.


       --template=""  Template string or path to template file to use when
       -o=go-template, -o=go-template-file. The template format is golang
       templates [http://golang.org/pkg/text/template/#pkg-overview].



OPTIONS INHERITED FROM PARENT COMMANDS
       --as=""   Username to impersonate for the operation. User could be a
       regular user or a service account in a namespace.


       --as-group=[]  Group to impersonate for the operation, this flag can be
       repeated to specify multiple groups.


       --as-uid=""    UID to impersonate for the operation.


       --azure-container-registry-config=""    Path to the file containing
       Azure container registry configuration information.


       --cache-dir="/home/username/.kube/cache"     Default cache directory


       --certificate-authority=""    Path to a cert file for the certificate
       authority


       --client-certificate=""  Path to a client certificate file for TLS


       --client-key=""     Path to a client key file for TLS


       --cluster=""   The name of the kubeconfig cluster to use


       --context=""   The name of the kubeconfig context to use


       --disable-compression=false   If true, opt-out of response compression
       for all requests to the server


       --insecure-skip-tls-verify=false   If true, the server's certificate
       will not be checked for validity. This will make your HTTPS connections
       insecure


       --kubeconfig=""     Path to the kubeconfig file to use for CLI
       requests.


       --match-server-version=false  Require server version to match client
       version


       -n, --namespace=""  If present, the namespace scope for this CLI
       request


       --password=""  Password for basic authentication to the API server


       --profile="none"    Name of profile to capture. One of
       (none|cpu|heap|goroutine|threadcreate|block|mutex)


       --profile-output="profile.pprof"   Name of the file to write the
       profile to


       --request-timeout="0"    The length of time to wait before giving up on
       a single server request. Non-zero values should contain a corresponding
       time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout
       requests.


       -s, --server=""     The address and port of the Kubernetes API server


       --tls-server-name=""     Server name to use for server certificate
       validation. If it is not provided, the hostname used to contact the
       server is used


       --token=""     Bearer token for authentication to the API server


       --user=""      The name of the kubeconfig user to use


       --username=""  Username for basic authentication to the API server


       --version=false     --version, --version=raw prints version information
       and quits; --version=vX.Y.Z... sets the reported version


       --warnings-as-errors=false    Treat warnings received from the server
       as errors and exit with a non-zero exit code



EXAMPLE

                # Request a token to authenticate to the kube-apiserver as the service account "myapp" in the current namespace
                kubectl create token myapp

                # Request a token for a service account in a custom namespace
                kubectl create token myapp --namespace myns

                # Request a token with a custom expiration
                kubectl create token myapp --duration 10m

                # Request a token with a custom audience
                kubectl create token myapp --audience https://example.com

                # Request a token bound to an instance of a Secret object
                kubectl create token myapp --bound-object-kind Secret --bound-object-name mysecret

                # Request a token bound to an instance of a Secret object with a specific UID
                kubectl create token myapp --bound-object-kind Secret --bound-object-name mysecret --bound-object-uid 0d4691ed-659b-4935-a832-355f77ee47cc




SEE ALSO
       kubectl-create(1),



HISTORY
       January 2015, Originally compiled by Eric Paris (eparis at redhat dot
       com) based on the kubernetes source material, but hopefully they have
       been automatically generated since!

Manuals                              User            KUBERNETES(1)(kubernetes)