From a0854784dcdc2a26bff3c5f39a687d6db73bc64a Mon Sep 17 00:00:00 2001 From: David Yu Date: Wed, 12 Jul 2023 09:31:04 -0700 Subject: [PATCH] Update website/content/docs/k8s/upgrade/index.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> --- website/content/docs/k8s/upgrade/index.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/website/content/docs/k8s/upgrade/index.mdx b/website/content/docs/k8s/upgrade/index.mdx index c6e1d56db9..0fbcae587d 100644 --- a/website/content/docs/k8s/upgrade/index.mdx +++ b/website/content/docs/k8s/upgrade/index.mdx @@ -248,7 +248,7 @@ If you upgrade Consul from a version that uses client agents to a version the us 1. Now that all services and gateways are using Consul dataplanes, disable client agents in your Helm chart by deleting the `client` stanza or setting `client.enabled` to `false` and running a `consul-k8s` or Helm upgrade. -1. If you have ACLs enabled, you will have some old ACL tokens that are now no longer needed. If you wish, you can manually clean up these tokens. +1. If `acls.manageSystemACLs` is set to `true`, outdated ACL tokens will persist a result of the upgrade. You can manually delete the tokens to declutter your Consul environment. Outdated connect-injector tokens have the following description: `token created via login: {"component":"connect-injector"}`. Do not delete the tokens that have a description where `pod` is a key, for example `token created via login: {"component":"connect-injector","pod":"default/consul-connect-injector-576b65747c-9547x"}`). The dataplane-enabled connect inject pods use these tokens.