MountVolume.SetUp failed for volume "kube-api-access-cvwdt" : object "default"/"kube-root-ca.crt" not registered

user_18238338 0
Viewed 1750

I'm just trying to run a simple batch job and getting this error "MountVolume.SetUp failed for volume "kube-api-access-cvwdt" : object "default"/"kube-root-ca.crt" not registered"

Here's my logs when running describe pod on that pod

  Normal   Scheduled    59s                default-scheduler  Successfully assigned default/stock-api to ip-192-168-63-5.us-west-2.compute.internal
  Normal   Pulling      58s                kubelet            Pulling image "mpriv32/stockapi:latest"
  Normal   Pulled       38s                kubelet            Successfully pulled image "mpriv32/stockapi:latest" in 19.862095063s
  Normal   Created      35s                kubelet            Created container stock-api
  Normal   Started      35s                kubelet            Started container stock-api
  Warning  FailedMount  33s (x3 over 34s)  kubelet            MountVolume.SetUp failed for volume "kube-api-access-cvwdt" : object "default"/"kube-root-ca.crt" not registered

My job.yaml file to create the pod

apiVersion: v1
kind: Pod
metadata:
  name: stock-api
  labels:
    app: stock-api

spec:
  containers:
  - name: stock-api
    image: mpriv32/stock-api:latest
    envFrom:
    - secretRef:
        name: api-credentials
  restartPolicy: Never

Just in case it makes a difference, I'm trying to run this on EKS

amazon-eks kubernetes
1 Answers

You might be facing a bug on the kubelet that is discussed here and was fixed in K8s 1.23.6.

Failure should be sporadic, so a simple recreation of your Pod might already fix it. More reliably, you could upgrade K8s or disable automountServiceAccountToken. This stops the CA in question from being mounted into your Pod. Since the CA is only required, if your Pod needs to talk to the Kube API server, this is a sensible security measure anyway.

user_23858080
Related