Description of problem: oc --context build02 sa create-kubeconfig --namespace ci config-updater Command "create-kubeconfig" is deprecated, and will be removed in the future version. Use oc create token instead. error: could not find a service account token for service account "config-updater" Version-Release number of selected component (if applicable): oc version --context build02 Client Version: 4.11.0-rc.3 Kustomize Version: v4.5.4 Server Version: 4.11.0-fc.3 Kubernetes Version: v1.24.0+284d62a oc get clusterversion version --context build02 NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.11.0-fc.3 True False 19d Cluster version is 4.11.0-fc.3 1. Why does it error out if it is ONLY deprecated? 2. What is the replacement with "oc create token" to generate a SA's kubeconfig? I also tested against build01: It works. So I am not sure if it is a cli's bug. oc --context build01 get clusterversion version NAME VERSION AVAILABLE PROGRESSING SINCE STATUS version 4.10.23 True False 2d8h Cluster version is 4.10.23 oc --context build01 sa create-kubeconfig --namespace ci config-updater Command "create-kubeconfig" is deprecated, and will be removed in the future version. Use oc create token instead. apiVersion: v1 clusters: ...
Hi Hongkai Liu; After upstream decided to switch short-lived tokens, we had to deprecate all `oc serviceaccounts` commands. According to the Slack discussion, there was a solution proposed which will work; $ KUBECONFIG=yournewkubeconfig oc login URL --token $(oc create token ...) But in automated cases, as you said getting the URL might be difficult. Instead I'd suggest directly using "set-credentials" command like this; $ oc config set-credentials --kubeconfig=yourkubeconfig --token=$(oc create token $(service_account) --kubeconfig=yourkubeconfig) That will set the new token into your kubeconfig(/tmp/build-farm-credentials/...). Apart from that, this deprecation is deliberate and I'd not consider this as a bug. But if the suggested command does not work for you, let me know and find a better solution. Thanks.
Thanks Arda for the reply. > 1. Why does it error out if it is ONLY deprecated? > 2. What is the replacement with "oc create token" to generate a SA's kubeconfig? I would like to know answers of the above questions, or confirm my understanding below. 1. It is not only deprecated, it has been removed when working again 4.12 cluster. So the deprecating message is not accurate. To me, deprecation means it is still working now but might not work in the future. 2. There won't be any replacement of "oc sa create-kubeconfig", or at least nothing planed in the near future. I know the workaround of compositing a couple of oc-cmds, but the workaround is not a direct command to print the kubeconfig in the standard outout. The command is heavily used in CI automation. It would be very helpful to recover it. I understand that it is upstream's decision to switch to short-lived token but oc can still do "oc sa create-kubeconfig" to print the short-lived kubeconfig.
> 1. It is not only deprecated, it has been removed when working again 4.12 cluster. So the deprecating message is not accurate. To me, deprecation means it is still working now but might not work in the future. Unfortunately, the functionality was suddenly removed by upstream. The standard procedure is to first deprecate a functionality and then remove it in the next release. However, given the functionality is already gone, we can only report its deprecation.
> 2. There won't be any replacement of "oc sa create-kubeconfig", or at least nothing planed in the near future. I know the workaround of compositing a couple of oc-cmds, but the workaround is not a direct command to print the kubeconfig in the standard outout. The command is heavily used in CI automation. It would be very helpful to recover it. I understand that it is upstream's decision to switch to short-lived token but oc can still do "oc sa create-kubeconfig" to print the short-lived kubeconfig. The original "oc sa create-kubeconfig" functionality was mainly located in the kube-apiserver. Given the code was already removed, backporting the original code into oc will not make any difference.
Thanks for the clarification.
*** Bug 2109799 has been marked as a duplicate of this bug. ***