<p>does anyone know if there is a way to back up and restore a Serviceaccount in Kubernetes that always has the same token? We use service account tokens quite often (for example when they act as an oauth client in Openshift), and it would be nice if we could reproduce a Serviceaccount to have the same token in the event it's deleted.</p>
<p>I noticed that there is a way to manually create a service account token as described <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-service-account-api-token" rel="nofollow noreferrer">here</a>. But, as far as I know this method will still auto generate the secret contents.</p>

<p>Fundamentally ability to reproduce a new serviceaccount to have the same old token poses security risk.</p>
<p>Ideally you should be taking periodic backup of ETCD which would have the secret token as well along with all other kubernetes resources. In case of unforeseen disaster you can restore ETCD from the backup and you will get back the secret token. You can use <a href="https://velero.io/docs/main/" rel="nofollow noreferrer">valero</a> for the backup of the kubernetes cluster resources as well.</p>
