+++ This bug was initially created as a clone of Bug #1785194 +++ Currently oc adm inspect will send bearer tokens when scraping data from endpoints. This might expose the tokens to potentially untrustworthy parties.
Confirmed with latest oc client , can't reproduce the issue now: [root@dhcp-140-138 ~]# oc version -o yaml clientVersion: buildDate: "2020-02-14T06:13:35Z" compiler: gc gitCommit: 1d7211968ceb449852d10d12eae92ed5c33d8b48 gitTreeState: clean gitVersion: v4.3.3 goVersion: go1.12.12 major: "" minor: "" platform: linux/amd64 I0217 10:43:21.587619 5537 pod.go:71] Skipping container endpoint collection for pod "kube-apiserver-ip-10-0-130-134.us-east-2.compute.internal" container "kube-apiserver": Using token authentication I0217 10:43:21.587714 5537 pod.go:71] Skipping container endpoint collection for pod "kube-apiserver-ip-10-0-130-134.us-east-2.compute.internal" container "kube-apiserver-cert-syncer": Using token authentication
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:0528