public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 12:38:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

deploy: c256118aa9

Browse Source
This commit is contained in:
github-actions[bot]
2024-03-25 22:28:53 +00:00
parent 1a3b6f0ef3
commit bac6fc0ce4
2577 changed files with 10484 additions and 10551 deletions
Download Patch File Download Diff File Expand all files Collapse all files
404.html
+4 -4
View File
File diff suppressed because one or more lines are too long
api/api-reference.html
+4 -4
View File
File diff suppressed because one or more lines are too long
api/quickstart.html
+4 -4
View File
File diff suppressed because one or more lines are too long
api/workflows/projects.html
+4 -4
View File
File diff suppressed because one or more lines are too long
assets/js/31dc42bc.5298aea3.js → assets/js/31dc42bc.8bdc09aa.js
+44 -110
View File
@@ -324,8 +324,8 @@ const metadata = {
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/docs/reference-guides/about-the-api/api-tokens.md",
"tags": [],
"version": "current",
"lastUpdatedAt": 1703280782,
"formattedLastUpdatedAt": "Dec 22, 2023",
"lastUpdatedAt": 1711404317,
"formattedLastUpdatedAt": "Mar 25, 2024",
"frontMatter": {
"title": "API Tokens"
},
@@ -342,54 +342,49 @@ const metadata = {
const assets = {};
const toc = [
{
value: 'Deleting tokens',
value: 'Deleting Tokens',
id: 'deleting-tokens',
level: 3
level: 2
},
{
value: 'Setting TTL on Kubeconfig Tokens',
id: 'setting-ttl-on-kubeconfig-tokens',
level: 3
level: 2
},
{
value: 'Disable Tokens in Generated Kubeconfigs',
id: 'disable-tokens-in-generated-kubeconfigs',
level: 3
level: 2
},
{
value: 'Token Hashing',
id: 'token-hashing',
level: 3
level: 2
},
{
value: 'Token Settings',
id: 'token-settings',
level: 3
level: 2
},
{
value: 'auth-user-session-ttl-minutes',
id: 'auth-user-session-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-default-token-TTL-minutes',
value: 'kubeconfig-default-token-ttl-minutes',
id: 'kubeconfig-default-token-ttl-minutes',
level: 4
},
{
value: 'kubeconfig-token-ttl-minutes',
id: 'kubeconfig-token-ttl-minutes',
level: 4
level: 3
},
{
value: 'auth-token-max-ttl-minutes',
id: 'auth-token-max-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-generate-token',
id: 'kubeconfig-generate-token',
level: 4
level: 3
}
];
const layoutProps = {
@@ -410,9 +405,9 @@ function MDXContent(_param) {
parentName: "p"
}, `ttl=0`), `). In other words, API tokens with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "deleting-tokens"
}, `Deleting tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token,`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `Deleting Tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
@@ -430,7 +425,7 @@ function MDXContent(_param) {
parentName: "li"
}, `Click `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Here is the complete list of tokens that are generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The following is a complete list of tokens generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), `:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -451,16 +446,6 @@ function MDXContent(_param) {
"align": null
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubeconfig-*`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Kubeconfig token`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
parentName: "tbody"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubectl-shell-*`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
@@ -516,62 +501,52 @@ function MDXContent(_param) {
}, `drain-node-*`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Token for drain (we use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Token for drain (Rancher uses `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubectl`), ` for drain because there is no native Kubernetes API)`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `kubectl`), ` for drain because there is no native Kubernetes API).`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "setting-ttl-on-kubeconfig-tokens"
}, `Setting TTL on Kubeconfig Tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Admins can set a global time-to-live (TTL) on Kubeconfig tokens. Changing the default kubeconfig TTL can be done by navigating to global settings and setting `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-ttl-minutes`)), ` to the desired duration in minutes. The default value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-default-token-ttl-minutes`)), ` to the desired duration in minutes. As of Rancher v2.8, the default value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-ttl-minutes`)), ` is 0, which means tokens never expire.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
}, `kubeconfig-default-token-ttl-minutes`)), ` is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `43200`), `, which means that tokens expire in 30 days.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
"type": "note"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "admonition"
}, `This setting is used by all kubeconfig tokens except those created by the CLI to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "disable-tokens-in-generated-kubeconfigs"
}, `Disable Tokens in Generated Kubeconfigs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
}, `Set the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Disable Tokens in Generated Kubeconfigs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Set the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubeconfig-generate-token`), ` setting to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. Once this setting is deactivated, a generated kubeconfig will reference the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. When this setting is deactivated, a generated kubeconfig references the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `Rancher CLI`), ` to retrieve a short-lived token for the cluster. When this kubeconfig is used in a client, such as `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubectl`), `, the Rancher CLI needs to be installed to complete the log in request.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
}, `Set the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubeconfig-token-ttl-minutes`), ` setting to the desired duration in minutes. By default, `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubeconfig-token-ttl-minutes`), ` is 960 (16 hours).`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `kubectl`), `, the Rancher CLI needs to be installed to complete the log in request.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-hashing"
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens will undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process, once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process: once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/how-to-guides/advanced-user-guides/enable-experimental-features/"
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature will affect all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature affects all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Kubeconfig tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Bearer tokens API keys/calls`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-settings"
}, `Token Settings`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `These global settings affect Rancher token behavior.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -608,32 +583,13 @@ function MDXContent(_param) {
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-TTL-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
}, `kubeconfig-default-token-ttl-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Default TTL applied to all kubeconfig tokens except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `Default TTL applied to all kubeconfig tokens except for tokens `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "td",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generated by Rancher CLI`), `. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "td"
}, `Introduced in version 2.6.6.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
parentName: "tbody"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "td",
"href": "#kubeconfig-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-token-ttl-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `TTL used for tokens generated via the CLI. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "td"
}, `Deprecated since version 2.6.6, and will be removed in 2.8.0.`), ` This setting will be removed, and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubeconfig-default-token-TTL-minutes`), ` will be used for all kubeconfig tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
}, `generated by Rancher CLI`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
parentName: "tbody"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
@@ -664,61 +620,39 @@ function MDXContent(_param) {
}, `kubeconfig-generate-token`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-user-session-ttl-minutes"
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a user auth session token expires. When expired, the user will be required to log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-default-token-ttl-minutes"
}, `kubeconfig-default-token-TTL-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a kubeconfig token expires. When the token is expired, the API will reject the token. This setting can not be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-default-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. This setting applies to a token generated in a requested kubeconfig file. Except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-token-max-ttl-minutes`)), `. This setting applies to tokens generated in a requested kubeconfig file, except for tokens `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generated by Rancher CLI`), `.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
}, `generated by Rancher CLI`), `. As of Rancher v2.8, the default duration is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `Introduced in version 2.6.6`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
"id": "kubeconfig-token-ttl-minutes"
}, `kubeconfig-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a kubeconfig token that was generated by the CLI expires. Tokens are generated by the CLI when `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#kubeconfig-generate-token"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-generate-token`)), ` is false. When the token is expired, the API will reject the token. This setting can not be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Deprecated since version 2.6.6, and will be removed in 2.8.0: This setting will be replaced with the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "strong",
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-TTL-minutes`)), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `43200`), `, which means that tokens expire in 30 days.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-token-max-ttl-minutes"
}, `auth-token-max-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Maximum Time to Live (TTL) in minutes allowed for auth tokens. If a user attempts to create a token with a TTL greater than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `, Rancher will set the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `auth-token-max-ttl-minutes`), `, Rancher sets the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `. Auth tokens are tokens created for authenticating API requests.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
}, `auth-token-max-ttl-minutes`), `. Applies to all kubeconfig tokens and API tokens. As of Rancher v2.8, the default duration is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `Changed in version 2.6.6: Applies to all kubeconfig tokens and api tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `129600`), `, which means that tokens expire in 90 days.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-generate-token"
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI will contain a valid token. When false, the kubeconfig will contain a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI contain a valid token. When false, kubeconfigs contain a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `The CLI then will retrieve and cache a token for the user`), `.`));
}, `The CLI then retrieves and caches a token for the user`), `.`));
}
MDXContent.isMDXComponent = true;
assets/js/5aa42673.c0df06e7.js → assets/js/5aa42673.1c897beb.js
+42 -44
View File
@@ -324,8 +324,8 @@ const metadata = {
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.8/reference-guides/about-the-api/api-tokens.md",
"tags": [],
"version": "2.8",
"lastUpdatedAt": 1703291432,
"formattedLastUpdatedAt": "Dec 23, 2023",
"lastUpdatedAt": 1711404317,
"formattedLastUpdatedAt": "Mar 25, 2024",
"frontMatter": {
"title": "API Tokens"
},
@@ -342,49 +342,49 @@ const metadata = {
const assets = {};
const toc = [
{
value: 'Deleting tokens',
value: 'Deleting Tokens',
id: 'deleting-tokens',
level: 3
level: 2
},
{
value: 'Setting TTL on Kubeconfig Tokens',
id: 'setting-ttl-on-kubeconfig-tokens',
level: 3
level: 2
},
{
value: 'Disable Tokens in Generated Kubeconfigs',
id: 'disable-tokens-in-generated-kubeconfigs',
level: 3
level: 2
},
{
value: 'Token Hashing',
id: 'token-hashing',
level: 3
level: 2
},
{
value: 'Token Settings',
id: 'token-settings',
level: 3
level: 2
},
{
value: 'auth-user-session-ttl-minutes',
id: 'auth-user-session-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-default-token-TTL-minutes',
value: 'kubeconfig-default-token-ttl-minutes',
id: 'kubeconfig-default-token-ttl-minutes',
level: 4
level: 3
},
{
value: 'auth-token-max-ttl-minutes',
id: 'auth-token-max-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-generate-token',
id: 'kubeconfig-generate-token',
level: 4
level: 3
}
];
const layoutProps = {
@@ -405,9 +405,9 @@ function MDXContent(_param) {
parentName: "p"
}, `ttl=0`), `). In other words, API tokens with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "deleting-tokens"
}, `Deleting tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token,`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `Deleting Tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
@@ -425,7 +425,7 @@ function MDXContent(_param) {
parentName: "li"
}, `Click `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Here is the complete list of tokens that are generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The following is a complete list of tokens generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), `:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -501,50 +501,52 @@ function MDXContent(_param) {
}, `drain-node-*`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Token for drain (we use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Token for drain (Rancher uses `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubectl`), ` for drain because there is no native Kubernetes API)`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `kubectl`), ` for drain because there is no native Kubernetes API).`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "setting-ttl-on-kubeconfig-tokens"
}, `Setting TTL on Kubeconfig Tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Admins can set a global time-to-live (TTL) on Kubeconfig tokens. Changing the default kubeconfig TTL can be done by navigating to global settings and setting `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-ttl-minutes`)), ` to the desired duration in minutes. The default value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-default-token-ttl-minutes`)), ` to the desired duration in minutes. As of Rancher v2.8, the default value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-ttl-minutes`)), ` is 43200, which is 30 days.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
}, `kubeconfig-default-token-ttl-minutes`)), ` is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `43200`), `, which means that tokens expire in 30 days.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
"type": "note"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "admonition"
}, `This setting is used by all kubeconfig tokens except those created by the CLI to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "disable-tokens-in-generated-kubeconfigs"
}, `Disable Tokens in Generated Kubeconfigs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Set the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubeconfig-generate-token`), ` setting to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. Once this setting is deactivated, a generated kubeconfig will reference the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. When this setting is deactivated, a generated kubeconfig references the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.8/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `Rancher CLI`), ` to retrieve a short-lived token for the cluster. When this kubeconfig is used in a client, such as `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubectl`), `, the Rancher CLI needs to be installed to complete the log in request.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `kubectl`), `, the Rancher CLI needs to be installed to complete the log in request.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-hashing"
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens will undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process, once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process: once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.8/how-to-guides/advanced-user-guides/enable-experimental-features/"
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature will affect all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature affects all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Kubeconfig tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Bearer tokens API keys/calls`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-settings"
}, `Token Settings`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `These global settings affect Rancher token behavior.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -581,15 +583,13 @@ function MDXContent(_param) {
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-TTL-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
}, `kubeconfig-default-token-ttl-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Default TTL applied to all kubeconfig tokens except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "td",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generated by Rancher CLI`), `. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "td"
}, `Introduced in version 2.6.6.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
}, `generated by Rancher CLI`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
parentName: "tbody"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
@@ -620,41 +620,39 @@ function MDXContent(_param) {
}, `kubeconfig-generate-token`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-user-session-ttl-minutes"
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a user auth session token expires. When expired, the user will be required to log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-default-token-ttl-minutes"
}, `kubeconfig-default-token-TTL-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a kubeconfig token expires. When the token is expired, the API will reject the token. This setting can not be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-default-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. This setting applies to a token generated in a requested kubeconfig file. Except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-token-max-ttl-minutes`)), `. This setting applies to tokens generated in a requested kubeconfig file, except for tokens `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generated by Rancher CLI`), `.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
}, `generated by Rancher CLI`), `. As of Rancher v2.8, the default duration is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `Introduced in version 2.6.6`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `43200`), `, which means that tokens expire in 30 days.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-token-max-ttl-minutes"
}, `auth-token-max-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Maximum Time to Live (TTL) in minutes allowed for auth tokens. If a user attempts to create a token with a TTL greater than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `, Rancher will set the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `auth-token-max-ttl-minutes`), `, Rancher sets the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `. Auth tokens are tokens created for authenticating API requests.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
}, `auth-token-max-ttl-minutes`), `. Applies to all kubeconfig tokens and API tokens. As of Rancher v2.8, the default duration is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `Changed in version 2.6.6: Applies to all kubeconfig tokens and api tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `129600`), `, which means that tokens expire in 90 days.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-generate-token"
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI will contain a valid token. When false, the kubeconfig will contain a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI contain a valid token. When false, kubeconfigs contain a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.8/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `The CLI then will retrieve and cache a token for the user`), `.`));
}, `The CLI then retrieves and caches a token for the user`), `.`));
}
MDXContent.isMDXComponent = true;
assets/js/d36d398e.7ef7e8c9.js → assets/js/d36d398e.5e4981a4.js
+52 -47
View File
@@ -324,8 +324,8 @@ const metadata = {
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.7/reference-guides/about-the-api/api-tokens.md",
"tags": [],
"version": "2.7",
"lastUpdatedAt": 1705011762,
"formattedLastUpdatedAt": "Jan 11, 2024",
"lastUpdatedAt": 1711404317,
"formattedLastUpdatedAt": "Mar 25, 2024",
"frontMatter": {
"title": "API Tokens"
},
@@ -342,9 +342,9 @@ const metadata = {
const assets = {};
const toc = [
{
value: 'Deleting tokens',
value: 'Deleting Tokens',
id: 'deleting-tokens',
level: 3
level: 2
},
{
value: 'Setting TTL on Kubeconfig Tokens',
@@ -354,42 +354,42 @@ const toc = [
{
value: 'Disable Tokens in Generated Kubeconfigs',
id: 'disable-tokens-in-generated-kubeconfigs',
level: 3
level: 2
},
{
value: 'Token Hashing',
id: 'token-hashing',
level: 3
level: 2
},
{
value: 'Token Settings',
id: 'token-settings',
level: 3
level: 2
},
{
value: 'auth-user-session-ttl-minutes',
id: 'auth-user-session-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-default-token-TTL-minutes',
value: 'kubeconfig-default-token-ttl-minutes',
id: 'kubeconfig-default-token-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-token-ttl-minutes',
id: 'kubeconfig-token-ttl-minutes',
level: 4
level: 3
},
{
value: 'auth-token-max-ttl-minutes',
id: 'auth-token-max-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-generate-token',
id: 'kubeconfig-generate-token',
level: 4
level: 3
}
];
const layoutProps = {
@@ -410,9 +410,9 @@ function MDXContent(_param) {
parentName: "p"
}, `ttl=0`), `). In other words, API tokens with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "deleting-tokens"
}, `Deleting tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token,`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `Deleting Tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
@@ -430,7 +430,7 @@ function MDXContent(_param) {
parentName: "li"
}, `Click `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Here is the complete list of tokens that are generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The following is a complete list of tokens generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), `:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -516,7 +516,7 @@ function MDXContent(_param) {
}, `drain-node-*`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Token for drain (we use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Token for drain (Rancher uses `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubectl`), ` for drain because there is no native Kubernetes API)`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "setting-ttl-on-kubeconfig-tokens"
@@ -530,14 +530,16 @@ function MDXContent(_param) {
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-ttl-minutes`)), ` is 0, which means tokens never expire.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
}, `kubeconfig-default-token-ttl-minutes`)), ` is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `0`), `, which means that tokens never expire.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
"type": "note"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "admonition"
}, `This setting is used by all kubeconfig tokens except those created by the CLI to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "disable-tokens-in-generated-kubeconfigs"
}, `Disable Tokens in Generated Kubeconfigs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
@@ -547,7 +549,7 @@ function MDXContent(_param) {
parentName: "p"
}, `kubeconfig-generate-token`), ` setting to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. Once this setting is deactivated, a generated kubeconfig will reference the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. When this setting is deactivated, a generated kubeconfig references the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.7/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `Rancher CLI`), ` to retrieve a short-lived token for the cluster. When this kubeconfig is used in a client, such as `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
@@ -560,18 +562,20 @@ function MDXContent(_param) {
parentName: "p"
}, `kubeconfig-token-ttl-minutes`), ` setting to the desired duration in minutes. By default, `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubeconfig-token-ttl-minutes`), ` is 960 (16 hours).`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `kubeconfig-token-ttl-minutes`), ` is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `960`), ` (16 hours).`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-hashing"
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens will undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process, once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process: once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.7/how-to-guides/advanced-user-guides/enable-experimental-features/"
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature will affect all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature affects all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Kubeconfig tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Bearer tokens API keys/calls`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-settings"
}, `Token Settings`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `These global settings affect Rancher token behavior.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -608,7 +612,7 @@ function MDXContent(_param) {
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-TTL-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
}, `kubeconfig-default-token-ttl-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Default TTL applied to all kubeconfig tokens except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
@@ -631,9 +635,9 @@ function MDXContent(_param) {
"align": null
}, `TTL used for tokens generated via the CLI. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "td"
}, `Deprecated since version 2.6.6, and will be removed in 2.8.0.`), ` This setting will be removed, and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Deprecated since version 2.6.6, and removed in 2.8.0.`), ` Rancher v2.8 and later instead use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubeconfig-default-token-TTL-minutes`), ` will be used for all kubeconfig tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
}, `kubeconfig-default-token-ttl-minutes`), ` for all kubeconfig tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
parentName: "tbody"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
@@ -651,7 +655,9 @@ function MDXContent(_param) {
"href": "#auth-user-session-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-user-session-ttl-minutes`)), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
}, `auth-user-session-ttl-minutes`)), `. May override `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubeconfig-default-token-ttl-minutes`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
parentName: "tbody"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
@@ -664,34 +670,36 @@ function MDXContent(_param) {
}, `kubeconfig-generate-token`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-user-session-ttl-minutes"
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a user auth session token expires. When expired, the user will be required to log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-default-token-ttl-minutes"
}, `kubeconfig-default-token-TTL-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a kubeconfig token expires. When the token is expired, the API will reject the token. This setting can not be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-default-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. This setting applies to a token generated in a requested kubeconfig file. Except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-token-max-ttl-minutes`)), `. This setting applies to tokens generated in a requested kubeconfig file, except for tokens `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generated by Rancher CLI`), `.
}, `generated by Rancher CLI`), `. The default value is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `0`), `, which means that tokens never expire.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Introduced in version 2.6.6`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `Introduced in version 2.6.6`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-token-ttl-minutes"
}, `kubeconfig-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a kubeconfig token that was generated by the CLI expires. Tokens are generated by the CLI when `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#kubeconfig-generate-token"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-generate-token`)), ` is false. When the token is expired, the API will reject the token. This setting can not be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-generate-token`)), ` is false. When the token is expired, the API rejects the token. This setting can't be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
@@ -699,26 +707,23 @@ function MDXContent(_param) {
}, `auth-token-max-ttl-minutes`)), `.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Deprecated since version 2.6.6, and will be removed in 2.8.0: This setting will be replaced with the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "strong",
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-TTL-minutes`)), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `Deprecated since Rancher v2.6.6.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-token-max-ttl-minutes"
}, `auth-token-max-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Maximum Time to Live (TTL) in minutes allowed for auth tokens. If a user attempts to create a token with a TTL greater than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `, Rancher will set the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `auth-token-max-ttl-minutes`), `, Rancher sets the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `. Auth tokens are tokens created for authenticating API requests.
}, `auth-token-max-ttl-minutes`), `. Applies to all kubeconfig tokens and API tokens. The default value is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `0`), `, which means that tokens never expire.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Changed in version 2.6.6: Applies to all kubeconfig tokens and api tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `Rancher v2.6.5 and earlier: Applies only to tokens created for authenticating API requests.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-generate-token"
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI will contain a valid token. When false, the kubeconfig will contain a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI contain a valid token. When false, kubeconfigs contain a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.7/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `The CLI then will retrieve and cache a token for the user`), `.`));
}, `The CLI then retrieves and caches a token for the user`), `.`));
}
MDXContent.isMDXComponent = true;
assets/js/f9f9702d.a1042d00.js → assets/js/f9f9702d.f5cee47a.js
+50 -49
View File
@@ -324,8 +324,8 @@ const metadata = {
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.6/reference-guides/about-the-api/api-tokens.md",
"tags": [],
"version": "2.6",
"lastUpdatedAt": 1705016351,
"formattedLastUpdatedAt": "Jan 11, 2024",
"lastUpdatedAt": 1711404317,
"formattedLastUpdatedAt": "Mar 25, 2024",
"frontMatter": {
"title": "API Tokens"
},
@@ -342,54 +342,54 @@ const metadata = {
const assets = {};
const toc = [
{
value: 'Deleting tokens',
value: 'Deleting Tokens',
id: 'deleting-tokens',
level: 3
level: 2
},
{
value: 'Setting TTL on Kubeconfig Tokens',
id: 'setting-ttl-on-kubeconfig-tokens',
level: 3
level: 2
},
{
value: 'Disable Tokens in Generated Kubeconfigs',
id: 'disable-tokens-in-generated-kubeconfigs',
level: 3
level: 2
},
{
value: 'Token Hashing',
id: 'token-hashing',
level: 3
level: 2
},
{
value: 'Token Settings',
id: 'token-settings',
level: 3
level: 2
},
{
value: 'auth-user-session-ttl-minutes',
id: 'auth-user-session-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-default-token-TTL-minutes',
value: 'kubeconfig-default-token-ttl-minutes',
id: 'kubeconfig-default-token-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-token-ttl-minutes',
id: 'kubeconfig-token-ttl-minutes',
level: 4
level: 3
},
{
value: 'auth-token-max-ttl-minutes',
id: 'auth-token-max-ttl-minutes',
level: 4
level: 3
},
{
value: 'kubeconfig-generate-token',
id: 'kubeconfig-generate-token',
level: 4
level: 3
}
];
const layoutProps = {
@@ -410,9 +410,9 @@ function MDXContent(_param) {
parentName: "p"
}, `ttl=0`), `). In other words, API tokens with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `ttl=0`), ` never expire unless you invalidate them. Tokens are not invalidated by changing a password.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `You can deactivate API tokens by deleting them or by deactivating the user account.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "deleting-tokens"
}, `Deleting tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token,`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `Deleting Tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To delete a token:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "li"
@@ -430,7 +430,7 @@ function MDXContent(_param) {
parentName: "li"
}, `Click `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Here is the complete list of tokens that are generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Delete`), `.`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The following is a complete list of tokens generated with `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `ttl=0`), `:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -526,9 +526,9 @@ function MDXContent(_param) {
}, `drain-node-*`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Token for drain (we use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Token for drain (Rancher uses `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubectl`), ` for drain because there is no native Kubernetes API)`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `kubectl`), ` for drain because there is no native Kubernetes API)`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "setting-ttl-on-kubeconfig-tokens"
}, `Setting TTL on Kubeconfig Tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Admins can set a global time-to-live (TTL) on Kubeconfig tokens. Changing the default kubeconfig TTL can be done by navigating to global settings and setting `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
@@ -540,14 +540,16 @@ function MDXContent(_param) {
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-ttl-minutes`)), ` is 0, which means tokens never expire.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
}, `kubeconfig-default-token-ttl-minutes`)), ` is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `0`), `, which means that tokens never expire.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("admonition", {
"type": "note"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", {
parentName: "admonition"
}, `This setting is used by all kubeconfig tokens except those created by the CLI to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `generate kubeconfig tokens`), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "disable-tokens-in-generated-kubeconfigs"
}, `Disable Tokens in Generated Kubeconfigs`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ol", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ol"
@@ -557,7 +559,7 @@ function MDXContent(_param) {
parentName: "p"
}, `kubeconfig-generate-token`), ` setting to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. Once this setting is deactivated, a generated kubeconfig will reference the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `false`), `. This setting instructs Rancher to no longer automatically generate a token when a user clicks on download a kubeconfig file. When this setting is deactivated, a generated kubeconfig references the `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.6/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `Rancher CLI`), ` to retrieve a short-lived token for the cluster. When this kubeconfig is used in a client, such as `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
@@ -570,18 +572,18 @@ function MDXContent(_param) {
parentName: "p"
}, `kubeconfig-token-ttl-minutes`), ` setting to the desired duration in minutes. By default, `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `kubeconfig-token-ttl-minutes`), ` is 960 (16 hours).`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `kubeconfig-token-ttl-minutes`), ` is 960 (16 hours).`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-hashing"
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens will undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process, once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `Token Hashing`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Users can enable token hashing, where tokens undergo a one-way hash using the SHA256 algorithm. This is a non-reversible process: once enabled, this feature cannot be disabled. It is advisable to take backups prior to enabling and/or evaluating in a test environment first.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `To enable token hashing, refer to `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.6/how-to-guides/advanced-user-guides/enable-experimental-features/"
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature will affect all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
}, `this section`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `This feature affects all tokens which include, but are not limited to, the following:`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Kubeconfig tokens`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Bearer tokens API keys/calls`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
parentName: "ul"
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
}, `Tokens used by internal operations`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
"id": "token-settings"
}, `Token Settings`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `These global settings affect Rancher token behavior.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("table", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("thead", {
parentName: "table"
@@ -618,7 +620,7 @@ function MDXContent(_param) {
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-TTL-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
}, `kubeconfig-default-token-ttl-minutes`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `Default TTL applied to all kubeconfig tokens except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
@@ -641,9 +643,9 @@ function MDXContent(_param) {
"align": null
}, `TTL used for tokens generated via the CLI. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "td"
}, `Deprecated since version 2.6.6, and will be removed in 2.8.0.`), ` This setting will be removed, and `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `Deprecated since version 2.6.6, and removed in 2.8.0.`), ` Rancher v2.8 and later instead use `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "td"
}, `kubeconfig-default-token-TTL-minutes`), ` will be used for all kubeconfig tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
}, `kubeconfig-default-token-ttl-minutes`), ` for all kubeconfig tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("tr", {
parentName: "tbody"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
@@ -674,34 +676,36 @@ function MDXContent(_param) {
}, `kubeconfig-generate-token`))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("td", {
parentName: "tr",
"align": null
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `If true, automatically generate tokens when a user downloads a kubeconfig.`)))), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-user-session-ttl-minutes"
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a user auth session token expires. When expired, the user will be required to log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-user-session-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a user auth session token expires. When expired, the user must log in and obtain a new token. This setting is not affected by `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `auth-token-max-ttl-minutes`)), `. Session tokens are created when a user logs into Rancher.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-default-token-ttl-minutes"
}, `kubeconfig-default-token-TTL-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a kubeconfig token expires. When the token is expired, the API will reject the token. This setting can not be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-default-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a kubeconfig token expires. When the token is expired, the API rejects the token. This setting can't be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `auth-token-max-ttl-minutes`)), `. This setting applies to a token generated in a requested kubeconfig file. Except those `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `auth-token-max-ttl-minutes`)), `. This setting applies to tokens generated in a requested kubeconfig file, except for tokens `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#disable-tokens-in-generated-kubeconfigs"
}, `generated by Rancher CLI`), `.
}, `generated by Rancher CLI`), `. The default value is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `0`), `, which means that tokens never expire.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Introduced in version 2.6.6`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `Introduced in version 2.6.6`), `.`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-token-ttl-minutes"
}, `kubeconfig-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes used to determine when a kubeconfig token that was generated by the CLI expires. Tokens are generated by the CLI when `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-token-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Time to live (TTL) duration in minutes, used to determine when a kubeconfig token that was generated by the CLI expires. Tokens are generated by the CLI when `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#kubeconfig-generate-token"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-generate-token`)), ` is false. When the token is expired, the API will reject the token. This setting can not be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-generate-token`)), ` is false. When the token is expired, the API rejects the token. This setting can't be larger than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "#auth-token-max-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
@@ -709,26 +713,23 @@ function MDXContent(_param) {
}, `auth-token-max-ttl-minutes`)), `.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Deprecated since version 2.6.6, and will be removed in 2.8.0: This setting will be replaced with the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "strong",
"href": "#kubeconfig-default-token-ttl-minutes"
}, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "a"
}, `kubeconfig-default-token-TTL-minutes`)), `.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `Deprecated since Rancher v2.6.6.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "auth-token-max-ttl-minutes"
}, `auth-token-max-ttl-minutes`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Maximum Time to Live (TTL) in minutes allowed for auth tokens. If a user attempts to create a token with a TTL greater than `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `, Rancher will set the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
}, `auth-token-max-ttl-minutes`), `, Rancher sets the token TTL to the value of `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `auth-token-max-ttl-minutes`), `. Auth tokens are tokens created for authenticating API requests.
}, `auth-token-max-ttl-minutes`), `. Auth tokens are tokens created for authenticating API requests. The default value is `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("inlineCode", {
parentName: "p"
}, `0`), `, which means that tokens never expire.
`, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("strong", {
parentName: "p"
}, `Changed in version 2.6.6: Applies to all kubeconfig tokens and api tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h4", {
}, `Rancher v2.6.6 and later: Applies to all kubeconfig tokens and api tokens.`)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h3", {
"id": "kubeconfig-generate-token"
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI will contain a valid token. When false, the kubeconfig will contain a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
}, `kubeconfig-generate-token`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `When true, kubeconfigs requested through the UI contain a valid token. When false, the kubeconfig contains a command that uses the Rancher CLI to prompt the user to log in. `, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("a", {
parentName: "p",
"href": "/v2.6/reference-guides/cli-with-rancher/kubectl-utility#authentication-with-kubectl-and-kubeconfig-tokens-with-ttl"
}, `The CLI then will retrieve and cache a token for the user`), `.`));
}, `The CLI then retrieves and caches a token for the user`), `.`));
}
MDXContent.isMDXComponent = true;
assets/js/main.c2182cb5.js → assets/js/main.65a00d82.js
+1 -1
View File
File diff suppressed because one or more lines are too long
assets/js/runtime~main.33de91bf.js → assets/js/runtime~main.0dbe9167.js
+1 -1
View File
File diff suppressed because one or more lines are too long
cluster-provisioning/rke-clusters/options.html
+4 -4
View File
File diff suppressed because one or more lines are too long
contribute-to-rancher.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/container-network-interface-providers.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/deprecated-features-in-v2.5.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/dockershim.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/general-faq.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/install-and-configure-kubectl.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/rancher-is-no-longer-needed.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/security.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/technical-items.html
+4 -4
View File
File diff suppressed because one or more lines are too long
faq/telemetry.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/air-gapped-upgrades.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-aks.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-amazon-eks.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rollbacks.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/troubleshooting.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrade-a-hardened-cluster-to-k8s-v1-25.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/upgrades.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-references.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-references/feature-flags.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-references/helm-chart-options.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-references/tls-settings.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-requirements.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-requirements/dockershim.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-requirements/install-docker.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/installation-requirements/port-requirements.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/docker-install-commands.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/infrastructure-private-registry.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-kubernetes.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/install-rancher-ha.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/air-gapped-helm-cli-install/publish-images.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-kubernetes.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/install-rancher.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-behind-an-http-proxy/set-up-infrastructure.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/certificate-troubleshooting.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/roll-back-docker-installed-rancher.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/other-installation-methods/rancher-on-a-single-node-with-docker/upgrade-docker-installed-rancher.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/add-tls-secrets.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/bootstrap-password.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/choose-a-rancher-version.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/custom-ca-root-certificates.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/helm-version-requirements.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/local-system-charts.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/update-rancher-certificate.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/resources/upgrade-cert-manager.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/upgrade-and-roll-back-kubernetes.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/installation-and-upgrade/upgrade-kubernetes-without-upgrading-rancher.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/overview.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/aws-marketplace.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/aws.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/azure.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/digitalocean.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/equinix-metal.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/gcp.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/helm-cli.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/hetzner-cloud.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/linode.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/outscale-qs.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/prime.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-rancher-manager/vagrant.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-workloads.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-workloads/nodeports.html
+4 -4
View File
File diff suppressed because one or more lines are too long
getting-started/quick-start-guides/deploy-workloads/workload-ingress.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/configure-alerts-for-periodic-scan-on-a-schedule.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/create-a-custom-benchmark-version-to-run.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/enable-alerting-for-rancher-cis-benchmark.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/install-rancher-cis-benchmark.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/run-a-scan-periodically-on-a-schedule.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/run-a-scan.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/skip-tests.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/uninstall-rancher-cis-benchmark.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/cis-scan-guides/view-reports.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/configure-layer-7-nginx-load-balancer.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/enable-api-audit-log-in-downstream-clusters.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/enable-api-audit-log.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/enable-experimental-features.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/enable-experimental-features/continuous-delivery.html
+4 -4
View File
File diff suppressed because one or more lines are too long
how-to-guides/advanced-user-guides/enable-experimental-features/istio-traffic-management-features.html
+4 -4
View File
File diff suppressed because one or more lines are too long

Some files were not shown because too many files have changed in this diff Show More