Mint short-lived IAM token

OAuth->IAM token, ~12h TTL; feed to API/Terraform via YC_TOKEN env

export YC_TOKEN=$(yc iam create-token)
tool
yc32 commands
tags
yciamsecuritysecrets

More yc commands

  • Service account for CI
    yc iam service-account create --name sa-ci --description 'CI deployer'

    Create SA for pipelines; bind least-privilege roles separately

  • Authorized key for SA
    yc iam key create --service-account-name sa-ci --output key.json

    Authorized key JSON for non-interactive auth; note: rotate & vault it

  • Grant role to SA
    yc resource-manager folder add-access-binding <id> --role editor --service-account-name sa-ci

    Scope-bind a role at folder level; prefer narrow roles over editor

  • Write kubeconfig for cluster
    yc managed-kubernetes cluster get-credentials <name> --external --force

    Merge external endpoint into kubeconfig; drop --external for internal VPC

  • List clusters as JSON
    yc managed-kubernetes cluster list --format json | jq -r '.[]|[.name,.status,.id]|@tsv'

    Tabulate cluster name/status/id for scripting and audits

all 32 yc commands