<p>I'm trying to setup docker registry via Traefik, authenticated by a Service account bearer token. The problem is that the name of default service token secret is ended with some random characters, which can not be passed to the Ingress config, or can it?</p>

<p>Anyway, I want to somehow force Kubernetes to name the token in a predictable way.</p>

<p>The current solution is to create an API token manually.</p>

<pre><code>kind: Secret
metadata:
  name: account-token
  annotations:
    kubernetes.io/service-account.name: account
type: kubernetes.io/service-account-token
</code></pre>

<p>Unfortunately, the original randomly named token is still in the system, and can not be removed.</p>

<p>If it is created before Service account it is dropped, but when after then the randomized secret is.</p>

majkrzak
<p>It looks like <a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#to-create-additional-api-tokens" rel="nofollow noreferrer">creating additional API token</a> is the only existing solution. You are able to reference an existing service account and controller will update it with the newly generated token as described below:</p>

<blockquote>
  <p>To create additional API tokens for a service account, create a secret
  of type ServiceAccountToken with an annotation referencing the service
  account, and the controller will update it with a generated token.</p>
</blockquote>

<hr>

<blockquote>
  <p>Unfortunately, the original randomly named token is still in the
  system, and can not be removed.</p>
</blockquote>

<p>So what happens when you try to delete it / invalidate it the way described <a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#to-delete-invalidate-a-service-account-token" rel="nofollow noreferrer">here</a> ?</p>

<blockquote>
  <p>It will be recreated instantly. To avoid this, first it have to be
  removed from serviceaccount.secrests list. But it can not be complexly
  done via the yaml file. Or is there some api transaction that can be
  used during the config application?</p>
</blockquote>

<p>EDIT:</p>

<p>There are two solutions you may use to obtain your goal. When you edit the default ServiceAccount token it will become not valid any more and it won't be automatically recreated as in case when removing it:</p>

<p>1st is <strong>patching</strong> the token:</p>

<pre><code>kubectl patch secret default-token-jrc6q -p '{"data":{"token": "c29tZW90aGVyc2hpdAo="}}'
</code></pre>

<p>2nd is <strong>editing</strong> it:</p>

<pre><code>kubectl edit secret default-token-jrc6q  # and change token to any value you want
</code></pre>
