Update deployment credentials

The k8s cluster has a new certificate.  Also, new versions of k8s
don't automatically create long-lived tokens.  Update our instructions
to create one, and update our creds with a newly created token.

Change-Id: I52478fae7e364a9db1881652fb7ca2366b113e43

.zuul.yaml

diff --git a/.zuul.yaml b/.zuul.yaml
index f7cc30d..35c91f3 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -15,28 +15,28 @@
     name: deploy-zuul-credentials
     data:
       server: "https://10.0.0.1:443"
-      cert: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSURDekNDQWZPZ0F3SUJBZ0lRWW9OSEJiWlBvUXpEZ2JCMVNhOGFLekFOQmdrcWhraUc5dzBCQVFzRkFEQXYKTVMwd0t3WURWUVFERXlSbE5ETXhZVFU1WWkwNFptRTFMVFJsT1dRdFlqRTFZeTA1WmpNeE16UmpNR1psTUdFdwpIaGNOTVRreE1qSXdNVFl5TnpNMldoY05NalF4TWpFNE1UY3lOek0yV2pBdk1TMHdLd1lEVlFRREV5UmxORE14CllUVTVZaTA0Wm1FMUxUUmxPV1F0WWpFMVl5MDVaak14TXpSak1HWmxNR0V3Z2dFaU1BMEdDU3FHU0liM0RRRUIKQVFVQUE0SUJEd0F3Z2dFS0FvSUJBUUNoS2k4cTJ5d2N4WWR4OHlQQmZzMXlGUmJuZ1ZXK29GUzFYV1FlKy9pTgo4a2M4K05IU3I2RGNFQUtGVExnMTU3VTNiOE5TdG9MdEdUNUtoV010MHh2NEcrQVc5Qy9GNzFzWWhscThGdXkxCkphQWZOeCtydlZEeW80YnJ2bU1ubXAwWmpMZzNIUjVBMThXT2xBZW52OGtyRVZ2VnNYL1hZbnMzb2FWeUhGYVEKNzdDcUNlYWpqeS9uLzdSUlBKNDhReVVvVTNRZDRmV0xXQ0c5emxhNzZ4eHlFSVh0MWlMVGZ5NElGYk9pbFlYcwpUVzMvZ1ZObTRjZHZaQmtjeDlPWkNNZXN5aHBEK1ZTUkpuVkdUdHA5UmZVNWlHc3JiejdTVzh6S3ovVjI4amV4CjEzY2V0cWw4Mk5PUGs4cTRleDJsZmJibGdqUTJBSWIrZWNtYUJHaWQxWmtMQWdNQkFBR2pJekFoTUE0R0ExVWQKRHdFQi93UUVBd0lDQkRBUEJnTlZIUk1CQWY4RUJUQURBUUgvTUEwR0NTcUdTSWIzRFFFQkN3VUFBNElCQVFBawpuMEdRRGFYYW1Da2twY0ZneUI1bWlHd0s2NktLNnRqNG1Jc1ZDMG9DdWJ2bFQ0UDBFS2pJeDlad0hHeDJTK3ZiCnM1M2s4bmx5cHBtb1VYRXVxcUVLREpONlNMS3JhTFhWVGo4c1EwaExxbWltYTc4UmhTSVJMU3EraWJTMVlMSVcKakRvR3lzYXgzVE1mamEyRlU1ZC9IZXJHNHI5cWQxaXFMTnRiWU4xYWovUmJ3SUFvOFdqWE42WldkRDJic0hNaQpFVDFwbEQrSzhEb3E2R3MzbEt6c1k1Q1MyS1ZlSmVnWFhVc0dFMExIYjYwY3FvVldVMUhHc1NYTXJuTldrZVM0Cldrc0hSa0dpQVZBU21DMDZaZUM1d0lvSGNIYzJRTjhZTjdKTE9CV0FRUHhBRHlLc053OC9Eci8xS1VLdkZvZHkKSlhCNlhBS2pnUnFCdW9ROUJlMzkKLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo="
+      cert: "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUVMRENDQXBTZ0F3SUJBZ0lRVGo4MUIvVUh0VUxUOG1DMnNoVTRWVEFOQmdrcWhraUc5dzBCQVFzRkFEQXYKTVMwd0t3WURWUVFERXlReE5ESTFNR1l5TnkwME56QmhMVFJsTmpVdFlXRmlZeTA1TldZeE9EazJOall3TURBdwpJQmNOTWpReE1qQTBNakF3TVRRMVdoZ1BNakExTkRFeE1qY3lNVEF4TkRWYU1DOHhMVEFyQmdOVkJBTVRKREUwCk1qVXdaakkzTFRRM01HRXROR1UyTlMxaFlXSmpMVGsxWmpFNE9UWTJOakF3TURDQ0FhSXdEUVlKS29aSWh2Y04KQVFFQkJRQURnZ0dQQURDQ0FZb0NnZ0dCQU1jOUp4TmhXOEwvSmNvTjYxWTVxd1plVXdSQ2R1MUtzYWZ2Q29BaApORlRab1d2bUxSK2RIRytLbEpGOHcvenJ2UFVuUjc4N05nVXhzQlh6dWVOVWUzanVWcmhiWHJoQ2c1VmlTUjQyCjROYUlPc1hNK05GOGIrY3ZaS2dPV3hqWDRQMkRybUVEY21OQ0w5dGd6QmJwRkhtS1prcTFWYWNxaGVmcHJpT2cKZHZhYm0zK3NEUWttNVdQZVdpdHA2SHRlVEsrMkJPTkNzYncyMGpnTVIwQ0xlVTM2WFg3UVVUczQ3cHl6VzJIdgpIVlBMOWtxdVRlYVJJS1g1ZzlKKzV0bGpqamJUY280dEdtcXI3ekd4bDh5alNIWjZwdFFNODc4TXRiVXV0K3dJClhEbzRPL3hEa20zZzR2TG9SR1FLaytya0dxZHZjNkJOVUQyaGhzRWFEUWtGNmNrRkp2Tk42ZndXVkV2THl2S2QKUHlzK2VGdE9ORGV1N0dsR3U1OU9DS0FsU0M4amdnZ2ZiNlBXL0FhaE9rdWZjcmVxM2h3MTV6REQvUHdsSEIrMQpLY0dOem1UNFB4S0RLVHplYTQxU0JhNHA5UTZoVmVzcnY4ZEZXbnE5M0dNMkM1NUxsNlYrb1BOWmJINElmTjRQCmppVUVIZTBoajRzd3JMWVY2RzRXdWx4Uml3SURBUUFCbzBJd1FEQU9CZ05WSFE4QkFmOEVCQU1DQWdRd0R3WUQKVlIwVEFRSC9CQVV3QXdFQi96QWRCZ05WSFE0RUZnUVV6Q2hlLzdMWlZKNG5kTHl2S2MzNEZ6QnR6bll3RFFZSgpLb1pJaHZjTkFRRUxCUUFEZ2dHQkFLSEpEZXVnMXYwR0lzR2F2MEtNcVNGMFZlbEJ2VVpHek5WRk1rQlFIemxFCnV1R3lWTWZVZkZTbDhweXBHSUlHOW9QUlB1NWQyMGYxMFcyclJ1ZW1SQTlVN0JWeUVLVGhWUmljSndzV1ozcFEKdWpvandWcVh5MFdyM2VtZWIxSGR3RUw2bmJhaHFRdTM1ZzJ6UnBVTUE5enU5THVRSDNFT3p4ZVcyUjUyUXZOawpQbjdzMFA1NmhQdFpiWUFSUHNwMkdSazFBQytObi93c05YelhPYnd3cVM0blVzczdVc2RXZ1VmY0VoYVpnOGxLCmZLaVBKejVxSjMveXFqaXlpaFBYMEcwY0J5NndYSjY3TDlLQzRESFo1N1NiUXVhT05aRjZpOUhuUFArby9kcHkKVVJzRExOTFcyNDdIUXJUZnNMdUZ3Y2plNkZLYVZDU3F1cXJ4OFpvWitvLzFyTzVzVS8wencyVy93UlFqU1FTQwpFKzBPeSs0WGEwcHBFRHAwZ1JvWm1xTHFjQUJRa0p4TUFvUUttQ0JidlFSOUxwV1lkTE5oek9tYnU1dngyTjE2ClBrT2d6UW12UkRvaUwrWkR0QU9Nd3paaXU1blU0WUI2QzFJWHRUU21xbmVBOUdwS1IweFArbEpYbG1UdjFNV3MKanVqdzdZcXFXb1lFeC96dHZQeGErdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
       token: !encrypted/pkcs1-oaep
-        - IDYYtDEJ/KSlML8e2ZUGqOSrO6juCIMdLfNJ2BmQOeM7Yma1ChN2X/sKVlY1Q96eGr1Zp
-          fvDXj40bcloRtxTpWH5Hq6aaE3IDsOCCu8UxLZcjxiN5hd+me4iDhHXOjN8S4vpy69pT+
-          enz2OgQo5YEzuAXmFIDMoYMyYiOtjgXYVc/jmu+FELCH7Fbjlc7gW9DXRospqIzF5YLjd
-          VJxrtiKtQvaD5S/cu0qut2JpXGwt4pZRL0WXlHhZpLJwZC1ObrRSANjA/G8/uQ68ciRqg
-          cr04DUNXLstiGp9EbnfFSYBaH9THXfipBLrd5W56UwCHBi0uhTLZC1oYPo0j6myZp1ZZk
-          NNuCV/bMYe/3hYezKoq+SU9shtEXpw6pmePM9gwbsylNPVwobPOgNQHfKPA3VmG24RRF6
-          V3O47OLcTvSKZOvASg3qpjRsOT+3fIYvXfCD/2kFTwgcJytBp9K8XS4UeZqvU50mslqm/
-          DhX79C+EOktRj8ghHAyfFEKkm7jS7nPlOUoyqKIXWrS5CmGo61uuBXTfKi8z8a3zgyDwU
-          77r95rp7mUh7FHr7IPTaVBrAM30TZfAeCb6kDjCb+e8LnL6pgqSdTp7k/Jz36nHjFWG33
-          2wFLvcY1kr+pAfSoGfvLokg+h8wnQSrE11UmgWJNSrWBbChY4f2zvip4oJegVQ=
-        - W5dQHaerYTzYOAnj/c8GrPHYr7ektCNiZJRpxWSGLPlTPKbacbPadOd3q+kncFZjFQEma
-          6/jytNiwcaKEf+GTdp0DT4s1wGL1LDVVm+5sc69Fby7d0uigD6e2MErQPi0FY+IDk8I1w
-          NWP0DkU7hgl+PUB79BeFvWlfvqsPeb1qeAoqoexfCJcncixxyeIlv0mifuuC6so6JTU4o
-          rpiI9MuLUZXFSj/kacGZoAWDhOTssGrOK4+fuOZMARCvOJ0wDg8Mlu6RT78OcSBuc3UsD
-          Bd4rsuQ2hXuIypeVq8qlmIIFAjM6O6jNxkKf2nlwG+nZTFN7eUwpNcxupO6te9HK9ZGaN
-          gBfneQ8LddJWnw/nAi1Xefvp3DNq1q/MPUGeEUwTzvR442YIdxH0uBLUDrkLs2w8loZMc
-          G7T8vNJ4KLC3wAf51gmxKE9n8WvpFYfMW6uFK62wBF4k4kJH5H7seEv+lOQI9cBm9IwWY
-          VgbrAzuCFzcXTLwyGwNXYsWRbgb2FjAQx4iJKAD89uSlWadiB+AF3fOZFzwOrg2DEDjX5
-          iDJ2PD53IehqfmnZptYQwwGm1Rxz05LxM2bKicFznJy0QXIFc+S3paqBBYRcd5434pQmh
-          DUPD3ulIHUKNdXwBgXZHfaf/JxPDF0KiXOlyNs8pkBz1oZAEyQTowRKKT2XC9M=
+        - XfnHWwSr3FSEGRwKCBVHceFO1whWdpVhUrIfptqlHm/J0V4P/4mkaD18lcZiiYBtAVpJ8
+          tmUkgIUNZAXzmFz4t5WO881qyaplTiXkiWYe+x3RYzyNFMirv8hqco1++u+Jwc3GxwSs6
+          q2+gQAzR1wJlCP5Qp17DET/iQTt4ywMbhcszm+E/Iiyl441Q4R0o7Cmo6l23yrybqxJLN
+          q9Anyxqt4Zr0+qKFUAihze+/mCVnjN4Zk1zR5NeeaBrUECSppCK0B2lNL6mjJ8nDIu7hD
+          9BsFUGJsN7HC24qNG6RLHx+uMqxx+xJ+4Z+gQvwiol0Bl+yw37e2kpk7AfG6wdtG4yv9m
+          LgmL1b8Xhrxf4td/VvWuoEIa6ypbrtqLgsQ4B24KAuWAi8cUBH3hRAzwtjgSoeZt34GUw
+          hsfV4P7Agq14Tw9QjxttCYwYdQ51aroYh8IJGrygxj1IBKNVkBJBeHJa8cGDJjBiXztNn
+          dQERkd1AmAlzaQqmmZ2dWbo7WJmtSIpv7D/f6E6G4ST2kfFwAclLeEPyaKsdGYlsTTTcU
+          tL5Vc9OSGIglxibh+3mhSpv4sIZ2ZAlXdSGA6RTBphtZGL8ueAi2pHVK+5tLbbRg2GeDK
+          d+AOAUYNfTQzLXejdlKT6qyuqpbZyqtOtw2pP1z6zbDrPoZ3i7cFH8ubSbgegs=
+        - kXL999us0XesqsCvef4ljmrjGeSy4mRywHCBGWCDwrOHTpNuaXPIfNiG07APID76kT20c
+          g4kpqHhfJc3/r3FFRKi3XpV4VUjOer+65s3/HbfJjAHSsncvRS9xywTSz6z6h7xhfjoVd
+          4eNnULpwHJvhrBcen57wYrnSDcX1j8vxUGhkfMHqknEDNDmU5FEmjzwtWdJHJWlnWJMTY
+          pS/oyXu89mPIz1M4SsvTrQPViRLVQVqWrIlF/m6wPskSIoqXHLfXFCAO8/2MSFLqSyq3n
+          vSC1H+w5BjxoJAWQiyasLb4gQULpZ04xC+M4P3fFua3Y4tO7nY4TY5q8x9lOjtOK/Ws2J
+          9jEaI3GszDrINjD1mEb23mkBKbdWxz0Xne25GoozYE+5Y5c6cDTVxomc3I9IL4Ds6iXn2
+          JQ4zN0PWk0o4oqX1lP2sWpdSuWkvzkSUYQvp7pF6GGDlsK/6p0eSA5yMf1rxcaGJynLFv
+          ix5cu9S+LTTry8Otyp674af2fuFPRXisaY/BjHHeY9hkcp6wQh2gvrAA5ZYQflHspJjLK
+          VH1pht/tpyTejExhElYKNf5enGy/MhSZYviPuI6LFBs7tC+ZatLM/Do8IGMBJAxhDXRzl
+          HG8fHjwQKiUvcootbYgNiJUDUCKKjtBpEC3BPABzS3Dt4FMvwQqm4drIgTo27o=
       db_password: !encrypted/pkcs1-oaep
         - EhY0ajVtaLdoicAm35bdhZcrDRsz1YVAvA4rWyLUU3H8PQpNO78KNwROzGTQCQ1se2r+X
           QvqZVURNfHJAYasaB3qQ1GIVdj8kmOYKBFQbPO0slY+zQx57jvQvd8yL0W8gDohSbCX5N

README.md

diff --git a/README.md b/README.md
index d9379c7..1beffdb 100644
--- a/README.md
+++ b/README.md
@@ -239,3 +239,25 @@
   --clusterrole cluster-admin \
   --user system:serviceaccount:zuul:zuul-deployment
 ```
+
+## Create a long-lived service account token for self-deployment
+```sh
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: Secret
+metadata:
+  name: zuul-deployment-secret
+  namespace: zuul
+  annotations:
+    kubernetes.io/service-account.name: zuul-deployment
+type: kubernetes.io/service-account-token
+EOF
+```
+
+Extract the token with:
+```sh
+kubectl -n zuul get secret/zuul-deployment-secret -o yaml
+```
+
+And decode the base64 value (to reveal another base64 value) and
+escrypt that as a Zuul secret.