A mountable secret and token are not automatically generated in serviceaccount

user_15301426 0
Viewed 567

I downloaded Kubernetes for integration with Jenkins and created a Serviceaccount, but the secret is not automatically created.

In the past, I remember that a Secret was automatically created and the Token was mounted when Serviceaccount was created.

How can I automatically create a Secret as before?

service-accounts kubernetes
3 Answers

As mentioned by @P.... In kubernetes version 1.24 this behaviour has been changed, the LegacyServiceAccountTokenNoAutoGeneration feature gate is enabled by default in 1.24.

New secrets containing service account tokens are no longer auto-generated and are not automatically ambient in secrets in 1.24+. Existing secrets containing service account tokens are still usable.

API clients scraping token content from auto-generated Secret API objects must start using the TokenRequest API to obtain a token (preferred, available in all supported versions), or you can explicitly request a secret-based token if a secret-based token is desired/needed.

Refer manually create a service account API token to explicitly request a secret-based token.

user_157451530

You can put the below two manifests into YAML files and and apply them or you can do it from the command line like this:

$ kubectl apply -f - <<EOF
apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins-user
EOF


$ kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: jenkins-user-secret
  annotations:
    kubernetes.io/service-account.name: jenkins-user
type: kubernetes.io/service-account-token
EOF

Here we have a secret which holds a certificate and a token:

$ kubectl get secret
NAME               TYPE                                  DATA   AGE
jenkins-user-secret   kubernetes.io/service-account-token   3      4s
user_56756760

You can enabled it using the option automountServiceAccountToken: true

apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
automountServiceAccountToken: true

else remove the option automountServiceAccountToken , by default it will create secret

apiVersion: v1
kind: ServiceAccount
metadata:
  name: jenkins
user_191584740
Related