We don't have our Kube API exposed and all of management traffic is proxied through Rancher. I thought there was a URL that allowed serviceaccount tokens through, but can't find it. Is my only option to create a service account in Rancher and replace the API key every 90 days?

In global settings you can change

auth-token-max-ttl-minutes

to whatever you want... Then any new token will have that age limit https://ranchermanager.docs.rancher.com/api/api-tokens#auth-token-max-ttl-minutes

@limited-engine-76466 I believe this is what you're looking for https://ranchermanager.docs.rancher.com/how-to-guides/new-user-guides/authentication-permissions-and-global-configuration/jwt-authentication

Thank you!

is this code documentation up-to-date and accurate ? I tried setting token to <0 and it instantly expires. What am i doing wrong.

https://github.com/rancher/rancher/blob/main/pkg/apis/ext.cattle.io/v1/types.go#L66-L69

``` // This default is provided by the

auth-token-max-ttl-minutes

setting.

// Note that this default is also the maximum specifiable TTL.

// A value <= 0 there enables non-expiring tokens.```

yup. just confirmed testing on local rancher instance.