Why openshift creates two secrets when I create a serviceaccount

Question

I have created a serviceaccount with edit permission on openshift:

oc create serviceaccount gitlab-ci
oc policy add-role-to-user edit system:serviceaccount:test-project:gitlab-ci

but when I check the secrets, I see two secrets regarding the serviceaccount, both have the same structure but with a different values:

What are the uses of two secrets and why can't we handle it via one secret?

Answer 1

The anser is in the documentation: Understanding and creating service accounts:

Each service account automatically contains two secrets:

• An API token
• Credentials for the OpenShift Container Registry