OC-SECRETS-LINK(1)

📦
version 4.22.0 · 2 versions
, in nixpkgs unstable

Okay so real quick — this is oc secrets link, straight out of the OC SECRETS(1) manual, and it's from June 2016 if you were wondering how vintage we're going 🎀. Buckle up, we're linking secrets to service accounts and it's gonna be iconic.

✨ NAME ✨

oc secrets link — link secrets to a service account 🫶

✨ SYNOPSIS ✨

oc secrets link [OPTIONS]

🌸 DESCRIPTION 🌸

So like. You're linking secrets to a service account. That's the whole thing, no cap.

Why do you care? Because linking a secret enables a service account to automatically use that secret for some forms of authentication 💅. Basically you're handing the service account a little key and going "here bestie, use this." The way that works is lowkey magical but it's literally just one command, we love that for us ✨.

🦋 OPTIONS 🦋

  • --for=[mount] — this is the type of secret you're linking, and your choices are mount or pull. That's it, those are the two 💜. Default is mount if you don't say anything, which, fair.

👑 OPTIONS INHERITED FROM PARENT COMMANDS 👑

These aren't even ours, they're inherited, like a cute hand-me-down but for flags 🌈. Still gotta know them though, so here we go:

  • --as="" — username to impersonate for the operation. And like, the user could be a regular user or a service account in a namespace — either one, no judgement 💖.
  • --as-group=[] — group to impersonate for the operation. Plot twist: this flag can be repeated to specify multiple groups 🔥. Repeat away.
  • --as-uid="" — the UID to impersonate for the operation.
  • --as-user-extra=[] — user extras to impersonate for the operation. This flag can also be repeated to specify multiple values for the same key ✨.
  • --cache-dir="/homeless-shelter/.kube/cache" — the default cache directory. Yes, that's the actual path, I'm not making it up 😭.
  • --certificate-authority="" — path to a cert file for the certificate authority.
  • --client-certificate="" — path to a client certificate file for TLS.
  • --client-key="" — path to a client key file for TLS.
  • --cluster="" — the name of the kubeconfig cluster to use.
  • --context="" — the name of the kubeconfig context to use.
  • --disable-compression=false — if true, opt-out of response compression for all requests to the server.
  • --insecure-skip-tls-verify=false — if true, the server's certificate will not be checked for validity ⚠️. This will make your HTTPS connections insecure. Like, actually insecure. Be careful bestie 🙈.
  • --kubeconfig="" — path to the kubeconfig file to use for CLI requests.
  • --kuberc="" — path to the kuberc file to use for preferences. You can disable this by exporting the KUBECTL_KUBERC=false feature gate, or by turning off the feature with KUBERC=off 💅.
  • --match-server-version=false — require server version to match client version.
  • -n, --namespace="" — if present, the namespace scope for this CLI request.
  • --profile="none" — name of profile to capture. Gotta be one of (none|cpu|heap|goroutine|threadcreate|block|mutex) ⭐.
  • --profile-output="profile.pprof" — name of the file to write the profile to.
  • --request-timeout="0" — the length of time to wait before giving up on a single server request 🕐. Non-zero values should contain a corresponding time unit (e.g. 1s, 2m, 3h). A value of zero means don't timeout requests. Zero = infinite patience, main character energy honestly.
  • -s, --server="" — the address and port of the Kubernetes API server.
  • --tls-server-name="" — server name to use for server certificate validation. If it's not provided, the hostname used to contact the server is used 🎀.
  • --token="" — bearer token for authentication to the API server.
  • --user="" — the name of the kubeconfig user to use.
  • --warnings-as-errors=false — treat warnings received from the server as errors and exit with a non-zero exit code 💀. Dramatic, but honestly valid.

🔥 EXAMPLE 🔥

Okay here's where it gets good, copy these exactly, they're literally perfect 🍓:

# Add an image pull secret to a service account to automatically use it for pulling pod images
oc secrets link serviceaccount-name pull-secret --for=pull

# Add an image pull secret to a service account to automatically use it for both pulling and pushing build images
oc secrets link builder builder-image-secret --for=pull,mount

See that second one? --for=pull,mount — both at once. Ate, no crumbs 👑.

🧚 SEE ALSO 🧚

(iykyk, go read it, it's giving related content ✨)

🌺 HISTORY 🌺

June 2016, Ported from the Kubernetes man-doc generator — yes, this lore is from 2016, we stan an OG 💜.

Heads up bestie: this whole thing is from the Openshift CLI User Manuals, and the page itself is dated June 2016. Oof, vintage. But like, still slaps 💅✨

🌸 ok that's the whole page, you're basically an expert now, go link some secrets fr fr 🫶💖🎀

📦 where this page comes from