So if I make an API key that has no scope, I can login, but making an API key scoped to a single cluster doesn’t work:
$ rancher login --token token-8cd4z:tr78ztgxb88jm8q2m7djf875dsdqqrv42qn8ptxh26qdf8fsvqqtwf https://ranchermgt-dev.blahblah.com/
FATA[0000] Bad response statusCode [401]. Status [401 Unauthorized]. Body: [message=clusterID does not match] from [https://ranchermgt-dev.blahblah.com/v3]
I’ve attempted providing --context during login as well, with the cluster:project style syntax:
$ rancher login --context c-hz88w:p-xmvb4 --token token-8cd4z:tr78ztgxb88jm8q2m7djf875dsdqqrv42qn8ptxh26qdf8fsvqqtwf https://ranchermgt-dev.blahblah.com/
FATA[0000] Bad response statusCode [401]. Status [401 Unauthorized]. Body: [message=clusterID does not match] from [https://ranchermgt-dev.blahblah.com/v3]
What gives? How can I provide API tokens that have narrow access to a specific cluster?