Configure your access tokens for Supply Chain Security Tools - Store

This topic tells you how to configure your access tokens for Supply Chain Security Tools (SCST) - Store.

The access token is a Bearer token used in the HTTP request header Authorization. For example, Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IjhMV0....

Service accounts are required to have associated access tokens. Before Kubernetes 1.24, service accounts generated access tokens automatically. As of Kubernetes 1.24, a secret must be applied manually.

By default, SCST - Store includes a read-write service account installed with an access token generated. This service account is cluster-wide. If you want to create your own service accounts, see Retrieve and create service accounts for SCST - Store.

Setting the Access Token

When using the insight plug-in, you must set the METADATA_STORE_ACCESS_TOKEN environment variable, or use the --access-token flag. VMware discourages using the --access-token flag as the token appears in your shell history.

The following command retrieves the access token from the default metadata-store-read-write-client service account and stores it in METADATA_STORE_ACCESS_TOKEN:

export METADATA_STORE_ACCESS_TOKEN=$(kubectl get secrets metadata-store-read-write-client -n metadata-store -o jsonpath="{.data.token}" | base64 -d)

Additional Resources

check-circle-line exclamation-circle-line close-line
Scroll to top icon