// Module included in the following assemblies:
//
// * authentication/using-service-accounts-in-applications.adoc
// * pods/nodes-pods-secrets.adoc

:_mod-docs-content-type: CONCEPT
[id="auto-generated-sa-token-secrets_{context}"]
= Automatically generated image pull secrets

[role="_abstract"]
{product-title} automatically creates image pull secrets for each service account to integrate the internal image registry with user authentication.

[NOTE]
====
Prior to {product-title} 4.16, a long-lived service account API token secret was also generated for each service account that was created. Starting with {product-title} 4.16, this service account API token secret is no longer created.

After upgrading to {product-version}, any existing long-lived service account API token secrets are not deleted and will continue to function. For information about detecting long-lived API tokens that are in use in your cluster or deleting them if they are not needed, see "Long-lived service account API tokens in {product-title} (Red Hat Knowledgebase)".
====

This image pull secret is necessary to integrate the {product-registry} into the cluster's user authentication and authorization system.

However, if you do not enable the `ImageRegistry` capability or if you disable the integrated {product-registry} in the Cluster Image Registry Operator's configuration, an image pull secret is not generated for each service account.

When the integrated {product-registry} is disabled on a cluster that previously had it enabled, the previously generated image pull secrets are deleted automatically.
