Backup and restore a Kubernetes Serviceaccount Token

user_14055074 0
Viewed 234

does anyone know if there is a way to back up and restore a Serviceaccount in Kubernetes that always has the same token? We use service account tokens quite often (for example when they act as an oauth client in Openshift), and it would be nice if we could reproduce a Serviceaccount to have the same token in the event it's deleted.

I noticed that there is a way to manually create a service account token as described here. But, as far as I know this method will still auto generate the secret contents.

jwt openshift kubernetes
1 Answers

Fundamentally ability to reproduce a new serviceaccount to have the same old token poses security risk.

Ideally you should be taking periodic backup of ETCD which would have the secret token as well along with all other kubernetes resources. In case of unforeseen disaster you can restore ETCD from the backup and you will get back the secret token. You can use valero for the backup of the kubernetes cluster resources as well.

user_18394820
Related