quick question: is this a typo in the docs? trying to wrap my head around this setup but i'm stuck on why this token should be created in the data plane, but maybe it's a typo? source: https://docs.flyte.org/en/latest/deployment/deployment/multicluster.html#control-plane-deployment

From the second line it sounds like the communication is

control plane

->

data plane

, but the way the third line and onwards are phrased, it suggest that the token is for the service accounts that live in the data plane cluster. (That are created in each data plane cluster via helm)

@strong-soccer-41351 it might sound confusing, but essentially the way multicluster works in Flyte leverages a Kubernetes feature that lets you use bearer tokens to authenticate as the service account even outside the cluster (ref). So this is for the

control plane

->

data plane

communication and allow the flyteadmin instance running in your control plane to talk to the propeller instance in the dataplane cluster and perform operations in the dataplane K8s API server. In case you're interested, this is different to how Union handles multicluster at the project/domain level without having to deal with the underlying K8s constructs