Update openshift management token instructions

[agrare]

Service Account Tokens are no longer automatically generated when the service account gets created, oc sa new-token is deprecated, and oc create token has a limited duration (even if it can be years) and has not well documented default.

https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#manually-create-a-long-lived-api-token-for-a-serviceaccount describes how to create a long-lived service account token which matches what oc sa new-token would generate.

[agrare]

NOTE I dropped the leading # from here because the examples that this is included into do not have that (e.g. oc policy add-role-to-user -n $project_name admin -z $service_account_name) and it also made bash markdown think this was a comment

[Fryguy]

Alternatively, does it make sense to do something like the following to get directly at the token?

oc describe secret -n $project_name -o json $service_account_name-secret | jq -r .data.token

[agrare]

-o json isn't valid for oc describe but we could use oc get

This would require people have jq installed which I don't think we require anywhere else?

[Fryguy]

Sorry, yes oc get

[Fryguy]

ibm cloud docs have jq even so it feels so ubiquitous to me now, but yeah, maybe we err on the side of not having jq.

[agrare]

Here we go, oc get secret -o template $service_account_name-secret -n $project_name --template={{.data.token}

[Fryguy]

oh yeah I forgot you can do that - that's fantastic

[Fryguy]

think there's a typo in the template. Also, I think it's clearer if the template lives next to the -o template. Also typically you put the namespace first, then other options, then the object last.

So something like:

Suggested change

	oc get secret -o template $service_account_name-secret -n $project_name --template={{.data.token}
	oc get secret -n $project_name -o template --template={{.data.token}} $service_account_name-secret

[agrare]

Oh yeah missed last character while copy&pasting, fixed
NOTE I kept the namespace+name together instead of splitting them up with the -o template --template in the middle but I did keep the -o template --template together

[Fryguy]

Backported to spassky in commit a2d1ec3.

commit a2d1ec361e96128c8c2782b55afbe376d01ffedf
Author: Jason Frey <[email protected]>
Date:   Tue Sep 9 16:11:06 2025 -0400

    Merge pull request #1864 from agrare/update_openshift_token_instructions
    
    Update openshift management token instructions
    
    (cherry picked from commit e763a02a990437eaf163b131332be46f6e2aaec9)