From 28d6a8ff1c519884f2f99d398ca5216558cb5f1d Mon Sep 17 00:00:00 2001 From: Andreas Kupries Date: Tue, 24 Jun 2025 14:56:05 +0200 Subject: [PATCH 1/9] Add Tokens example workflows page --- docs/api/workflows/tokens.md | 130 +++++++++++++++++++++++++++++++++++ 1 file changed, 130 insertions(+) create mode 100644 docs/api/workflows/tokens.md diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md new file mode 100644 index 00000000000..d41611f203f --- /dev/null +++ b/docs/api/workflows/tokens.md @@ -0,0 +1,130 @@ +--- +title: Tokens +--- + + + + + +## Feature Flag + +The Tokens Public API is available since Rancher v2.12.0 and is enabled by default. +It can be disabled by setting the `ext-tokens` feature flag to `false`. + +```sh +kubectl patch feature ext-tokens -p '{"spec":{"value":false}}' +``` + +## Creating a Token + +Only a **valid and active** Rancher user can create a Token. + +```bash +kubectl create -o jsonpath='{.status.value}' -f -< Date: Tue, 24 Jun 2025 17:21:36 +0200 Subject: [PATCH 2/9] Apply suggestions from code review Co-authored-by: Petr Kovar --- docs/api/workflows/tokens.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md index d41611f203f..e2957dd56a2 100644 --- a/docs/api/workflows/tokens.md +++ b/docs/api/workflows/tokens.md @@ -35,9 +35,9 @@ The default is empty. The `spec.kind` field can be set to the kind of token. The value "session" indicates a login token. -All other kinds, including the default (empy string) indicate some kind of derived token. +All other kinds, including the default (empty string) indicate some kind of derived token. -The `name` and `generateName` fields of the new token are ignored. The system automatically choosen a name using the prefix `token-`. +The `name` and `generateName` fields of the new token are ignored. The system automatically chooses a name using the prefix `token-`. ```bash kubectl create -o jsonpath='{.status.value}' -f -< Date: Thu, 26 Jun 2025 14:57:09 +0200 Subject: [PATCH 3/9] Apply suggestions from code review Co-authored-by: Peter Matseykanets --- docs/api/workflows/tokens.md | 13 +++---------- 1 file changed, 3 insertions(+), 10 deletions(-) diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md index e2957dd56a2..cd8d04b6827 100644 --- a/docs/api/workflows/tokens.md +++ b/docs/api/workflows/tokens.md @@ -37,7 +37,7 @@ The `spec.kind` field can be set to the kind of token. The value "session" indicates a login token. All other kinds, including the default (empty string) indicate some kind of derived token. -The `name` and `generateName` fields of the new token are ignored. The system automatically chooses a name using the prefix `token-`. +The `metadata.name` and `metadata.generateName` fields are ignored and the name of the new Token is automatically generated using the prefix `token-`. ```bash kubectl create -o jsonpath='{.status.value}' -f -< Date: Mon, 14 Jul 2025 10:26:37 +0200 Subject: [PATCH 4/9] Apply suggestions from code review Co-authored-by: Sunil Singh --- docs/api/workflows/tokens.md | 30 ++++++++++-------------------- 1 file changed, 10 insertions(+), 20 deletions(-) diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md index cd8d04b6827..24ec7f2c32b 100644 --- a/docs/api/workflows/tokens.md +++ b/docs/api/workflows/tokens.md @@ -8,8 +8,7 @@ title: Tokens ## Feature Flag -The Tokens Public API is available since Rancher v2.12.0 and is enabled by default. -It can be disabled by setting the `ext-tokens` feature flag to `false`. +The Tokens Public API is available for Rancher v2.12.0 and later, and is enabled by default. It can be disabled by setting the `ext-tokens` feature flag to `false` as shown in the example `kubectl` command below: ```sh kubectl patch feature ext-tokens -p '{"spec":{"value":false}}' @@ -17,7 +16,7 @@ kubectl patch feature ext-tokens -p '{"spec":{"value":false}}' ## Creating a Token -Only a **valid and active** Rancher user can create a Token. +Only a **valid and active** Rancher user can create a Token, otherwise you will get an error displayed (`Error from server (Forbidden)...`) when attempting to create a Token. ```bash kubectl create -o jsonpath='{.status.value}' -f -< Date: Mon, 14 Jul 2025 12:48:51 +0200 Subject: [PATCH 5/9] address comments, tab indentation --- docs/api/workflows/tokens.md | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md index 24ec7f2c32b..6b19112f299 100644 --- a/docs/api/workflows/tokens.md +++ b/docs/api/workflows/tokens.md @@ -34,25 +34,25 @@ A Token is always created for the user making the request. Attempting to create - The `metadata.name` and `metadata.generateName` fields are ignored and the name of the new Token is automatically generated using the prefix `token-`. -```bash -kubectl create -o jsonpath='{.status.value}' -f -< Date: Mon, 14 Jul 2025 12:56:22 +0200 Subject: [PATCH 6/9] added to sidebar, and imported into 2.12 setup --- sidebars.js | 3 +- .../version-2.12/api/workflows/tokens.md | 114 ++++++++++++++++++ versioned_sidebars/version-2.12-sidebars.json | 3 +- 3 files changed, 118 insertions(+), 2 deletions(-) create mode 100644 versioned_docs/version-2.12/api/workflows/tokens.md diff --git a/sidebars.js b/sidebars.js index a522e28d011..e8104011c45 100644 --- a/sidebars.js +++ b/sidebars.js @@ -1345,7 +1345,8 @@ const sidebars = { "label": "Example Workflows", "items": [ "api/workflows/projects", - "api/workflows/kubeconfigs" + "api/workflows/kubeconfigs", + "api/workflows/tokens" ] }, "api/api-reference", diff --git a/versioned_docs/version-2.12/api/workflows/tokens.md b/versioned_docs/version-2.12/api/workflows/tokens.md new file mode 100644 index 00000000000..6b19112f299 --- /dev/null +++ b/versioned_docs/version-2.12/api/workflows/tokens.md @@ -0,0 +1,114 @@ +--- +title: Tokens +--- + + + + + +## Feature Flag + +The Tokens Public API is available for Rancher v2.12.0 and later, and is enabled by default. It can be disabled by setting the `ext-tokens` feature flag to `false` as shown in the example `kubectl` command below: + +```sh +kubectl patch feature ext-tokens -p '{"spec":{"value":false}}' +``` + +## Creating a Token + +Only a **valid and active** Rancher user can create a Token, otherwise you will get an error displayed (`Error from server (Forbidden)...`) when attempting to create a Token. + +```bash +kubectl create -o jsonpath='{.status.value}' -f -< Date: Wed, 16 Jul 2025 09:49:41 +0200 Subject: [PATCH 7/9] Apply suggestions from code review Thanks for the review and corrections. Co-authored-by: Lucas Saintarbor --- docs/api/workflows/tokens.md | 7 +++---- versioned_docs/version-2.12/api/workflows/tokens.md | 7 +++---- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md index 6b19112f299..517657932dd 100644 --- a/docs/api/workflows/tokens.md +++ b/docs/api/workflows/tokens.md @@ -76,7 +76,7 @@ token-6fzgj user-jtghh 90d 22s box token-8nbrm user-jtghh 90d 20s jinx ``` -#### Viewing a Token +## Viewing a Token Admins can get any Token, while regular users can only get their own. @@ -94,7 +94,7 @@ NAME USER KIND TTL AGE DESCRIPTION token-chjc9 user-jtghh 90d 24s example ``` -#### Deleting a Token +## Deleting a Token Admins can delete any Token, while regular users can only delete their own. @@ -103,8 +103,7 @@ kubectl delete tokens.ext.cattle.io token-chjc9 token.ext.cattle.io "token-chjc9" deleted ``` - -#### Updating a Token +## Updating a Token Only the metadata fields `spec.description`, `spec.ttl`, and `spec.enabled` can be updated. All other `spec` fields are immutable. Admins are able to extend the `spec.ttl` field, while regular users can only reduce the value. diff --git a/versioned_docs/version-2.12/api/workflows/tokens.md b/versioned_docs/version-2.12/api/workflows/tokens.md index 6b19112f299..517657932dd 100644 --- a/versioned_docs/version-2.12/api/workflows/tokens.md +++ b/versioned_docs/version-2.12/api/workflows/tokens.md @@ -76,7 +76,7 @@ token-6fzgj user-jtghh 90d 22s box token-8nbrm user-jtghh 90d 20s jinx ``` -#### Viewing a Token +## Viewing a Token Admins can get any Token, while regular users can only get their own. @@ -94,7 +94,7 @@ NAME USER KIND TTL AGE DESCRIPTION token-chjc9 user-jtghh 90d 24s example ``` -#### Deleting a Token +## Deleting a Token Admins can delete any Token, while regular users can only delete their own. @@ -103,8 +103,7 @@ kubectl delete tokens.ext.cattle.io token-chjc9 token.ext.cattle.io "token-chjc9" deleted ``` - -#### Updating a Token +## Updating a Token Only the metadata fields `spec.description`, `spec.ttl`, and `spec.enabled` can be updated. All other `spec` fields are immutable. Admins are able to extend the `spec.ttl` field, while regular users can only reduce the value. From f46a365c008aaefa5336112551aa405e1e4c0b5d Mon Sep 17 00:00:00 2001 From: Andreas Kupries Date: Wed, 23 Jul 2025 10:59:03 +0200 Subject: [PATCH 8/9] Apply suggestions from code review Co-authored-by: Lucas Saintarbor --- docs/api/workflows/tokens.md | 16 ++++++++-------- .../version-2.12/api/workflows/tokens.md | 16 ++++++++-------- 2 files changed, 16 insertions(+), 16 deletions(-) diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md index 517657932dd..6387ed01972 100644 --- a/docs/api/workflows/tokens.md +++ b/docs/api/workflows/tokens.md @@ -8,7 +8,7 @@ title: Tokens ## Feature Flag -The Tokens Public API is available for Rancher v2.12.0 and later, and is enabled by default. It can be disabled by setting the `ext-tokens` feature flag to `false` as shown in the example `kubectl` command below: +The Tokens Public API is available for Rancher v2.12.0 and later, and is enabled by default. You can disable the Tokens Public API by setting the `ext-tokens` feature flag to `false` as shown in the example `kubectl` command below: ```sh kubectl patch feature ext-tokens -p '{"spec":{"value":false}}' @@ -16,7 +16,7 @@ kubectl patch feature ext-tokens -p '{"spec":{"value":false}}' ## Creating a Token -Only a **valid and active** Rancher user can create a Token, otherwise you will get an error displayed (`Error from server (Forbidden)...`) when attempting to create a Token. +Only a **valid and active** Rancher user can create a Token. Otherwise, you will get an error displayed (`Error from server (Forbidden)...`) when attempting to create a Token. ```bash kubectl create -o jsonpath='{.status.value}' -f -< Date: Wed, 23 Jul 2025 11:02:08 +0200 Subject: [PATCH 9/9] address comment. fix unclosed example --- docs/api/workflows/tokens.md | 1 + versioned_docs/version-2.12/api/workflows/tokens.md | 1 + 2 files changed, 2 insertions(+) diff --git a/docs/api/workflows/tokens.md b/docs/api/workflows/tokens.md index 6387ed01972..a84e3a7255d 100644 --- a/docs/api/workflows/tokens.md +++ b/docs/api/workflows/tokens.md @@ -111,3 +111,4 @@ An example `kubectl` command to edit a Token: ```sh kubectl edit tokens.ext.cattle.io token-zp786 +``` diff --git a/versioned_docs/version-2.12/api/workflows/tokens.md b/versioned_docs/version-2.12/api/workflows/tokens.md index 6387ed01972..a84e3a7255d 100644 --- a/versioned_docs/version-2.12/api/workflows/tokens.md +++ b/versioned_docs/version-2.12/api/workflows/tokens.md @@ -111,3 +111,4 @@ An example `kubectl` command to edit a Token: ```sh kubectl edit tokens.ext.cattle.io token-zp786 +```