OCPBUGS-112723: Document that disabling Image Registry deletes companion SA tokens

[Divyanshi-13]

Summary

• Documents current behavior when the integrated Image Registry is set to Removed: the cluster can delete both the managed kubernetes.io/dockercfg pull secret and its companion kubernetes.io/service-account-token.
• Warns that those companion tokens must not be used as long-lived application API credentials, that kubernetes.io/legacy-token-last-used does not block this cleanup, and that cleanup can be selective across clusters.
• Clarifies the existing 4.16+ note so it is not read as covering dockercfg companion tokens. Product change remains RFE-9716.

Test plan

• Preview "Automatically generated image pull secrets" in Authentication and authorization.
• Confirm the bound service account token xref resolves.
• Confirm the text does not describe an opt-out or controller change from RFE-9716.

/cc @bergerhoffer

Made with Cursor

[openshift-ci-robot]

@Divyanshi-13: This pull request references Jira Issue OCPBUGS-112723, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Documents current behavior when the integrated Image Registry is set to Removed: the cluster can delete both the managed kubernetes.io/dockercfg pull secret and its companion kubernetes.io/service-account-token.
• Warns that those companion tokens must not be used as long-lived application API credentials, that kubernetes.io/legacy-token-last-used does not block this cleanup, and that cleanup can be selective across clusters.
• Clarifies the existing 4.16+ note so it is not read as covering dockercfg companion tokens. Product change remains RFE-9716.

Test plan

• Preview "Automatically generated image pull secrets" in Authentication and authorization.
• Confirm the bound service account token xref resolves.
• Confirm the text does not describe an opt-out or controller change from RFE-9716.

/cc @bergerhoffer

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hi @Divyanshi-13. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.