Using Service tokens it's possible to authenticate to StackState without having configured a user account. This is useful for situations where you want to use StackState from headless services like a CI server. In such a scenario you typically don't want to provision a user account in your identity provider.
Manage service tokens
Service tokens can be managed via the . The following commands are available:
> sts service-token --help
Manage service tokens.
Usage:
sts service-token [command]
Available Commands:
create Create a service token
delete Delete a service token
list List service tokens
Use "sts service-token [command] --help" for more information about a command.
It's also possible to when installing StackState.
Create service tokens
To create a service token for an installed instance of StackState, you can use the new sts CLI.
From StackState v5.0, the old sts CLI has been renamed to stac and there is a new sts CLI. The command(s) provided here are for use with the new sts CLI.
sts service-token create
From StackState v5.0, the old sts CLI is called stac. The old CLI is now deprecated.
The new sts CLI replaces the stac CLI. It's advised to install the new sts CLI and upgrade any installed instance of the old sts CLI to stac. For details see:
Command not available in the stac CLI, use the new sts CLI.
Note that the service token will only be displayed once. It isn't possible to see the token again.
This command takes the following command line arguments:
Flag
Description
--name
The name of the service token
--expiration
The expiration date of the service token, the format is yyyy-MM-dd. The expiration is optional.
--roles
A comma separated list of roles to assign to the service token
For example, the command below will create a service token with the name my-service-token and the role stackstate-power-user:
From StackState v5.0, the old sts CLI has been renamed to stac and there is a new sts CLI. The command(s) provided here are for use with the new sts CLI.
From StackState v5.0, the old sts CLI is called stac. The old CLI is now deprecated.
The new sts CLI replaces the stac CLI. It's advised to install the new sts CLI and upgrade any installed instance of the old sts CLI to stac. For details see:
Command not available in the stac CLI, use the new sts CLI.
Set up a bootstrap service token
When installing StackState, it's possible to bootstrap it with a (temporary) service token. This allows for using the CLI without first interacting with StackState and obtaining an API token from the UI. In order to set this up, you can add the following snippet to the StackState configuration file:
To configure StackState to create a bootstrap service token on Kubernetes, The following values need to be added to the file authentication.yaml. For example
Follow the steps below to configure StackState to create a bootstrap service token:
In application_stackstate.conf - add the bootstrap token:
token - The token that will be created on the (initial) start of StackState.
roles - An array of roles that will be assigned to the bootstrap token.`
ttl - Optional. The time-to-live for the token, expressed as a duration string.
Restart StackState to apply the changes.
List service tokens
The ID, name, expiration date and roles of all created service tokens can be seen using the new sts CLI. For example:
From StackState v5.0, the old sts CLI has been renamed to stac and there is a new sts CLI. The command(s) provided here are for use with the new sts CLI.
> sts service-token list
ID | NAME | EXPIRATION | ROLES
107484341630693 | my-service-token | | [stackstate-power-user]
From StackState v5.0, the old sts CLI is called stac. The old CLI is now deprecated.
The new sts CLI replaces the stac CLI. It's advised to install the new sts CLI and upgrade any installed instance of the old sts CLI to stac. For details see:
Command not available in the stac CLI, use the new sts CLI.
Delete service tokens
A service token can be deleted using the new sts CLI. Pass the ID of the service token as an argument. For example:
From StackState v5.0, the old sts CLI has been renamed to stac and there is a new sts CLI. The command(s) provided here are for use with the new sts CLI.
> sts service-token delete 107484341630693
✅ Service token deleted: 107484341630693
From StackState v5.0, the old sts CLI is called stac. The old CLI is now deprecated.
The new sts CLI replaces the stac CLI. It's advised to install the new sts CLI and upgrade any installed instance of the old sts CLI to stac. For details see:
Command not available in the stac CLI, use the new sts CLI.
Use service tokens
Once created, a service token can be used to authenticate to StackState from a headless service. To do this you can either use the CLI or directly talk to the API.
StackState sts CLI
A service token can be used for authentication with the new sts CLI. It isn't possible to authenticate with service tokens using the stac CLI. For details, see the CLI documentation:
StackState APIs
To use a service token to talk directly to the StackState Base API or the StackState Admin API, add it to the header of the request in one of the following ways:
In the Authorization header:
> curl -X GET -H "Authorization: ApiKey <TOKEN>" http://localhost:8080/api/server/status
In the X-API-Key header:
> curl -X GET -H "X-API-Key: <TOKEN>" http://localhost:8080/api/server/status
