# A role that mints short-lived Rancher tokens from the "admin" service account.
# Reading rancher/creds/ci returns a lease-bound token deleted from Rancher on
# revoke. Minted tokens inherit the admin service account's RBAC; only cluster
# and TTL are scoped per-token.
---
service_account: admin
description: "CI/CD ephemeral Rancher token"
ttl: 3600      # seconds (1h)
max_ttl: 28800 # seconds (8h)