Kubernetes service account secret

TIPS之 Kubernetes ServiceAccount 无法生成 token Secret排查

Kubernetes P ServiceAccount 无法生成 token Secret排查

Posted by 董江 on Tuesday, October 8, 2024

Kubernetes ServiceAccount 无法生成 token Secret排查

1. 现象

创建 ServiceAccount 不会自动生成 Secret 需要对其手动创建

cat<<EOF | kubectl apply -f -
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test
  namespace: default
EOF

$ kubectl get serviceaccounts cby
NAME                     SECRETS   AGE
test                     0         9s

2. 排查思路

手动创建 Secret 并与 ServiceAccount 进行关联绑定

cat<<EOF | kubectl apply -f -
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: test
  annotations:
    kubernetes.io/service-account.name: "test"
EOF

查询 ServiceAccount

$ kubectl describe serviceaccounts test
Name:                test
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              test
Events:              <none>
$
$
$ kubectl describe secrets test
Name:         test
Namespace:    default
Labels:       <none>
Annotations:  kubernetes.io/service-account.name: test
 
Type:  kubernetes.io/service-account-token
 
Data

====
 
ca.crt:     xxxx bytes
namespace:  7 bytes
token:      <base64 string>

解决

  1. kubernetes v1.24.0 更新之后进行创建 ServiceAccount 不会自动生成 Secret 需要对其手动创建。
  2. 如果你还想要自动生成 Secret，那么可以给 kube-controller-manager 配置特性 LegacyServiceAccountTokenNoAutoGeneration=false

「如果这篇文章对你有用,请随意打赏」

Kubeservice博客

如果这篇文章对你有用,请随意打赏

使用微信扫描二维码完成支付

CATALOG
    FEATURED TAGS
    agent apiserver application bandwidth-limit cgo cgroupfs ci/cd client-go cloudnative cncf cni community container container-network-interface containerd controller coredns crd custom-controller deployment docker docker-build docker-image drop ebpf ecology egress etcd gitee github gitlab golang governance hpa http2 image ingress iptables jobs kata kata-runtime kernel kind kubelet kubenetes kubernetes library linux-os logging loki metrics monitor namespace network network-troubleshooting node nodeport pingmesh pod prestop prometheus proxyless pvc rollingupdate schedule scheduler serverless sidecar sigtrem systemd throttling timeout tools traceroute