Secret token not generating

General Discussions
1

Hi,

I am new to K8s and this forum. Started to install K8s in my pc lab. I am able to open the k8s dashboard where it is asking for token and kubeconfig file, but my command is not generating any token. Below are the commands I am using:

$ kubectl create serviceaccount dashboard -n default
$ kubectl create clusterrolebinding dashboard-admin -n default --clusterrole=cluster-admin --serviceaccount=default:dashboard

Above 2 are working fine. Below one is not generating any output :
$ kubectl get secret $(kubectl get serviceaccount dashboard -o jsonpath="{.secret[0].name}") -o jsonpath="{.data.token}" | base64 --decode

What I am missing? Tried to google a lot but didn’t help. And I don’t know how to get CNI and CRI number? Please share commands for it, in case it is mandatory.

Asking for help? Comment out what you need so we can get more information to help you!

Cluster information:

Kubernetes version:v1.21.3
Cloud being used: (put bare-metal if not on a public cloud) : Virtual box
Installation method: From ISO
Host OS: Ubuntu 20.04.2 LTS
CNI and version: Calico
CRI and version:

You can format your yaml by highlighting it and pressing Ctrl-Shift-C, it will make your output easier to read.

2

Break down that command see what was happening.

Example:

kubectl get serviceaccount dashboard -o jsonpath="{.secret[0].name}"
kubectl get secret OUTPUT_FROM_LAST_COMMAND -o jsonpath="{.data.token}"
echo OUTPUT_FROM_LAST_COMMAND | base64 -D

Your problem is a typo in your jsonpath.

3

Thanks protosam for your response. I tried to run the commands but there is no output of first command itself

$ kubectl get serviceaccount dashboard -o jsonpath=“{.secret[0].name}”

I also tried to run above command with sudo and I got error

sudo kubectl get serviceaccount dashboard -o jsonpath=“{.secret[0].name}”
[sudo] password for xxxxx:
The connection to the server localhost:8080 was refused - did you specify the right host or port?

Whereas if I check the status of all PODs namespace, those are in running state

kubectl get pods --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE
kube-system calico-kube-controllers-76bf499b46-b7cdz 1/1 Running 3 13h
kube-system calico-node-55cj4 1/1 Running 37 13h
kube-system coredns-558bd4d5db-fhfcr 1/1 Running 3 13h
kube-system coredns-558bd4d5db-x48nr 1/1 Running 3 13h
kube-system etcd-master 1/1 Running 3 13h
kube-system kube-apiserver-master 1/1 Running 4 13h
kube-system kube-controller-manager-master 1/1 Running 9 13h
kube-system kube-proxy-cmjn4 1/1 Running 3 13h
kube-system kube-scheduler-master 1/1 Running 9 13h
kubernetes-dashboard dashboard-metrics-scraper-856586f554-jwhw6 1/1 Running 3 13h
kubernetes-dashboard kubernetes-dashboard-67484c44f6-wp9hm 1/1 Running 5 13h

4

I still think it’s a typo in the jsonpath you’re using. You didn’t change it (I also didn’t correct it in my examples, just pointed out that the problem is a typo).

kubectl get serviceaccount dashboard -o yaml

Your pods have nothing to do with your secrets in this case. You created a service account and the API creates a token for that service account.

5

I get that command from the tutorial, I was referring. Could you please point out what is wrong. Same command but with yaml format output is given below.

$ kubectl get serviceaccount dashboard -o yaml

apiVersion: v1
kind: ServiceAccount
metadata:
creationTimestamp: “2021-08-01T16:59:54Z”
name: dashboard
namespace: default
resourceVersion: “7530”
uid: da5a7d2a-927f-4943-a746-47125b6fc424
secrets:

  • name: dashboard-token-wqc7n
6

I think it might help if you went through the tutorial in the official documentation. Knowing what the kubectl commands are actually doing is going to help you out a lot in the long run. The dashboard isn’t as useful as kubectl itself.

As for the answer to your problem, take a look at the output from the command I gave you. You see there is a key called secrets.

In the command you’re running, -o jsonpath="..." is used to reference keys from objects in Kubernetes. The problem is that there’s a typo there. Compare that with the object you just got back from the last command I gave you carefully.

7

Thanks @protosam for sharing the link. In fact, that was my next question to share any good link to understand K8s. I will go through it to clear basics.

Is there any video which can explain better on youtube or udemy? or K8s offical documentation is enough.

8

I personally like the aloud.guru (rip Linux academy) videos. Though I don’t know how well they hold up for everyone. I had 8+ years of programming, web hosting, and Linux experience before ever watching that content; so my view point when watching them had a lot of holes already filled in.

Like one really big knowledge component is the Linux bit. I learned Linux long ago, just poorly how to run lamp stacks, and then I got leagues better by reading the PDF from this site:

https://linuxcommand.org/tlcl.php

9

I’m having a similar issue… Docker-Desktop with Kubernetes… Just creating a service account does NOT create a secret. In fact, fresh install… NONE of the service accounts in all namespaces have a secret nor a token. Why is the API not creating them?

me@mymachine local-cert % kubectl create serviceaccount my-admin
serviceaccount/my-admin created
me@mymachine % kubectl describe serviceaccount my-admin
Name:                my-admin
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   <none>
Tokens:              <none>
Events:              <none>
me@mymachine % kubectl get serviceaccount my-admin -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: "2022-05-13T16:38:13Z"
  name: my-admin
  namespace: default
  resourceVersion: "7548"
  uid: 01b69374-367b-4cf3-a1e2-b7cfb01275e7

Docker-Desktop (MAC) Version 4.8.1 (78998)
Engine: 20.10.14
Compose: 1.29.2
Credential Helper: v0.6.4
Kubernetes: v1.24.0
Snyk: v1.827.0

I’ve tried this on Intel MAC, M1 Mac, and Windows 10 (AMD Ryzen 5).

10

Docker-Desktop 4.7.1 includes the appropriate Kubernetes configuration for the controller manager and api service to automatically create secrets and tokens when creating a service account.

Docker-Desktop 4.8.x does not have this configuration. Fresh install or resetting the Kubernetes cluster will prevent the secret and token from automatically being created upon service account creation

11

EDIT: This may not actually be the cause after a bit more reading, can you test the featureflag below and see if it resolves your issue?

In 1.24 this was disabled by default
See the MUST READ section of the changelog: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#no-really-you-must-read-this-before-you-upgrade

Relevant section:

  • The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the TokenRequest API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this guide. (#108309, @zshihang)

For more information on this, please see the KEP: KEP-2799: Reduction of Secret-based Service Account Tokens

12

Hi mrbobbytables and everyone,

After successful installation of k8 cluster, I was trying to deploy k8 dashboard by creating service account though the tokens are not getting generated , i listed all SA and it it showing 0 secrets for each SA .
Install Kubernetes Dashboard - Deploy Applications using UI (learnitguide.net) - i was refereeing this link for creating dashboard.
Could you pls help me out on this issue.

The Kubernetes version which i’m using is 1.24 and if secrets are being disabled by default then could you pls show me the method for generating these secrets.

Thank you

13

Hi Mridul_Rawat:

Please, take a look at this blog entry, for example:

Best regards,

Xavi

14

Hi guys,
In the context of K8S created in Azure, this flag is causing a problem since we cannot map the namespaces to Environment. The mapping fails with the message ‘Could not find any secrets associated with the Service Account.’. Has anyone been able to fix this somehow? I will try to turn off the feature gate ‘LegacyServiceAccountTokenNoAutoGeneration’ to see if it resolves my issue, but so far I could not find any workaround to fix that problem in Azure.

thanks,

15

We are facing the same issue in our project. After the aks upgrade to 1.24.3 the Kubernetes services endpoints are not created due to this missing secret error. We tried to create the secret after the SA, after the creation by serviceendpoint API, but it didn’t work.

16

So Finally I found the solution .

Now you need create Service Account first,

Then you need generate token for that service account using below cmds

kubectl create token serviceaccount -n namespace

Then you need to store the secret using below

apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:

kubectl apply -f secret.yml

kubectl describe secret serviceaccount -n namespace