# After an upgrade to Flux 2.10, OCIRepositories with provider: aws and a spec.serviceAccountName stop getting credentials. What is missing?

Flux CD, Medium (Advanced), Security. https://k8wiz.com/uquiz/after-an-upgrade-to-flux-210-ocirepositories-with-provider-aws-and-a-specserviceaccountname-stop-getting-credentials-what-is-mis

- A. The ObjectLevelWorkloadIdentity feature gate on source-controller
- B. An IRSA role-arn annotation on the source-controller ServiceAccount
- C. A credential.auth.fluxcd.io/provider annotation on every OCIRepository
- D. RBAC that lets source-controller create serviceaccounts/token

**Answer:** RBAC that lets source-controller create serviceaccounts/token

**Explanation:** Object identity asks the TokenRequest API for a token for the named ServiceAccount, which needs create on serviceaccounts/token. Flux 2.10 removed that verb from its default RBAC, so you bind a ClusterRole granting it before upgrading. The ObjectLevelWorkloadIdentity gate is retired in 2.10 because the feature is always on.