rotate-sa-tokens.sh

#!/bin/sh -eu

NAMESPACE=default
SERVICEACCOUNT=default

oc -n "$NAMESPACE" serviceaccounts new-token "$SERVICEACCOUNT"

NEW_SECRET_NAME=$(
    oc get secrets \
        --field-selector='type=kubernetes.io/service-account-token' \
        --output=go-template='{{range .items}}{{if eq (index .metadata.annotations "kubernetes.io/service-account.name") "'"$SERVICEACCOUNT"'"}}{{.metadata.name}}{{"\n"}}{{end}}{{end}}' \
        --sort-by='.metadata.creationTimestamp' |
        tail -n1
)

oc -n "$NAMESPACE" patch serviceaccount "$SERVICEACCOUNT" --type=json --patch='[
    {"op": "replace", "path":"/imagePullSecrets", "value": []},
    {"op": "replace", "path":"/secrets", "value": [{"name":"'"$NEW_SECRET_NAME"'"}]},
]'