nsc bazel create-token generates a revocable token that’s pre-scoped to the
permissions needed for Bazel Remote Execution, so
CI/CD pipelines and other non-interactive environments can authenticate
without going through the interactive login flow. It’s a narrower,
purpose-built counterpart to nsc token create — instead
of specifying a --grant yourself, the token is automatically scoped to what
Remote Execution needs.
The generated token is written to a JSON file that can be passed to
nsc bazel setup to provision short-lived
credentials for the execution cluster. See
Remote Execution from CI for the
full flow. Like other revocable tokens, it can be revoked at any time
from cloud.namespace.so/user/sessions
or with nsc token revoke.
Usage
Example
1
Create a token
Create a token with a 10-day expiration and write it to
rbe-token.json:2
Configure Bazel
Pass the token file to
nsc bazel setup to configure a bazelrc that
authenticates with it:Options
—expires_in
Duration until the token expires. Defaults to2160h (90 days). Available
time units are: h (hours), d (days), w (weeks), and y (years).
—scope
Set the scope of the generated access token. Valid options:tenant, user.
Defaults to user. Tokens with user scope are bound to the tenant
membership of the current user; tenant scope isn’t tied to a specific
user’s workspace membership.
—token
Write the token to this file in JSON format. Defaults totoken.json. Pass
this file to nsc bazel setup --token <path> to authenticate with it.
Related Topics
- nsc token create - Create a general-purpose revocable token with custom grants
- nsc token revoke - Revoke a token
- Bazel Remote Execution - Run Bazel actions on Namespace compute