"Environment token management tokens" vs "Cluster tokens"

[waikeat_chan]

Still don't understand much after reading documentation.

What is/are the difference between them?

Best Regards,

Wai Keat

[Babar_Qayyum]

Hello @waikeat_chan 

Environment API tokens are specific to a particular environment, whereas, the cluster API tokens manage the cluster even containing more than one environment especially in the case of Dynatrace Managed.

https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-managed/cluster-api/cluster...

Regards,

Babar

[Radoslaw_Szulgo · Accepted solution]

Thank you very much for your post! Indeed we need to extend and update our documentation page:

https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-managed/cluster-api/basics/...

In particular:

• Environment token management tokens - is the token to authenticate with Cluster API v2 /environments/{id}/tokenManagementToken endpoint. It allows you to create a token with TokenManagement scope for a specified environment. It can be helpful if you need to start automation of many environments and generate respective tokens. Token is valid 24h due to its power and security impact if it gets leaked.
  
  
• Cluster token - is a token that you use to interact with Cluster API v1 or Cluster API v2 - so cluster context. 

[tarjei]

Is there a way to get to the same functionality as the Environment token management token, but something that does not invalidate after 24hrs? 

We would like to have a job which runs every 24 hours and syncs all 350 environment tokens for other automation.

[Radoslaw_Szulgo]

Yes, you can override that 24h expiration time by using AP. If you use "0" days it doesn't expire:

curl -X POST "https://cluster-host/api/cluster/v2/tokens" -H "accept: application/json; charset=utf-8" -H "Authorization: Api-Token dt0c01.token" -H "Content-Type: application/json; charset=utf-8" -d "{\"name\":\"my-token-name\",\"expiresIn\":{\"value\":0,\"unit\":\"DAYS\"},\"scopes\":[\"EnvironmentTokenManagement\"]}"

[tarjei]

Hi!
Is this documented anywhere? Which access rights does the api user performing this require?

[Radoslaw_Szulgo]

Yes - see available scopes:

https://www.dynatrace.com/support/help/setup-and-configuration/dynatrace-managed/cluster-api/cluster...