API tokens

API tokens authenticate requests to the Cloudfleet API. They give programmatic access to the Cloudfleet API and CFKE clusters, for example from scripts or CI pipelines. A token consists of an access token ID and a secret.

API tokens are not designed for human users. Human users should authenticate with SSO against the CLI, the CFKE control plane, or the Cloudfleet Console. API tokens are designed for machines, such as CI/CD pipelines, scripts, or other automation tools.

Depending on their permissions, API tokens give privileged access to your organization’s resources. You can create multiple API tokens, each with different permissions. For example, you can create a token with read-only access to your organization’s resources, or a token with full access to all resources.

Token secrets are sensitive. Treat them like passwords: keep them secure and do not share them publicly. If you think a secret is compromised, you can revoke it at any time.

Create an API token

  1. Go to the API tokens page.
  2. Click the Create button.
  3. Enter a human-friendly name for the token.
  4. Select a role for the token. You can choose Administrator or User.
  5. Click the Save button.
  6. Copy the access Token ID and secret. Store the secret in a secure location. You cannot see the token again.

To create a token with the CLI, run the following command:

bash 
cloudfleet tokens create --name HUMAN_FRIENDLY_NAME --role ROLE

Replace HUMAN_FRIENDLY_NAME with a human-friendly name for the token. Replace ROLE with the role for the token: Administrator or User.

List the existing tokens

  1. Go to the API tokens page. The page lists all the tokens that you created.
bash 
cloudfleet tokens list

Regenerate the secret of a token

You can regenerate the secret of a token at any time. Regeneration invalidates the old secret and generates a new one.

  1. Go to the API tokens page.
  2. Click the Regenerate button next to the token whose secret you want to rotate.
  3. Copy the new secret. Store the secret in a secure location. You cannot see the token again.

To regenerate the secret of a token with the CLI, run the following command:

bash 
cloudfleet tokens --profile cloudfleetou regenerate 2iKo4Asy51EUx2gpJFW76t

Delete a token

  1. Go to the API tokens page.
  2. Click the Delete button next to the token you want to delete.
  3. Confirm the deletion.
bash 
cloudfleet tokens --profile cloudfleetou delete TOKEN_ID

Configure the CLI to use a token

To use a token with the CLI, add a new profile to the CLI configuration with the following command:

bash 
cloudfleet auth add-profile token \
  PROFILE_NAME ORGANIZATION_ID TOKEN_ID --token-secret-stdin

Replace the placeholders:

  • PROFILE_NAME: a name for the profile.
  • ORGANIZATION_ID: the ID of the organization for the token.
  • TOKEN_ID: the access token ID.

The --token-secret-stdin flag reads the token secret from standard input, or prompts for it in an interactive terminal. The secret stays out of your shell history and ps output.

You can also authenticate with environment variables, without a profile. The CLI automatically recognizes the following environment variables:

bash 
export CLOUDFLEET_ORGANIZATION_ID=your-organization-id
export CLOUDFLEET_ACCESS_TOKEN_ID=your-token-id
export CLOUDFLEET_ACCESS_TOKEN_SECRET=your-token-secret

Environment variables are useful for CI/CD pipelines, scripts, and other automated workflows that should not store credentials in configuration files.

Use API tokens to access CFKE clusters

If you run the cloudfleet clusters kubeconfig command with a profile that uses a token, the token authenticates you against the CFKE cluster. As with regular user accounts, the role of the token determines its permissions in the cluster. The Cloudfleet Administrator and User roles become the Kubernetes cluster-admin and view roles, respectively. (See User management for more information on how user and token roles map to Kubernetes permissions.)

Each API token maps to a Kubernetes user. The user name is the token ID with the prefix service-account-, converted to lowercase. For example, an API key with ID nFYyVdtg8K1aDujwk3YFh1 becomes service-account-nfyyvdtg8k1adujwk3yfh1 in the cluster.

To grant more permissions to a token in Kubernetes RBAC, create a RoleBinding or ClusterRoleBinding for the token. For example, this RoleBinding grants a token with ID nFYyVdtg8K1aDujwk3YFh1 the cluster-admin role in the your-namespace Namespace:

yaml 
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
    name: cluster-admin-binding
    namespace: your-namespace
subjects:
    - kind: User
      name: service-account-nfyyvdtg8k1adujwk3yfh1
      apiGroup: rbac.authorization.k8s.io
roleRef:
    kind: ClusterRole
    name: cluster-admin
    apiGroup: rbac.authorization.k8s.io

For more information about permissions in Kubernetes, see the Kubernetes RBAC documentation.

Previous
← Service quotas
Next
Single Sign-On (SSO) →
On this page