In 4.5 we have to remove the oauth-apiserver.openshift.io/secure-token-storage annotation from the config/v1 apiserver object via a controller. +++ This bug was initially created as a clone of Bug #1878648 +++ Audit logs lack the information to trace logins of users because oauth access/authorize tokens are not logged. They cannot be logged by default because pre-4.6 there name was sensitive information. Since 4.6 new tokens are hashed with sha256. We can audit log them without leaking sensitive information. Customers with strong audit requirements need this to adopt the 4.x platform. --- Additional comment from Anand on 2020-09-15 00:00:02 CEST --- BU has agreed to fix this in 4.6, however, it cannot breach the Oct 22 GA date
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (OpenShift Container Platform 4.5.14 bug fix update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:3843