# Secret token not generating **URL:** \ **Category:** General Discussions\ **Tags:** development\ **Created:** [August 1, 2021, 5:10pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923 "2021-08-01T17:10:17Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![deadlystryke](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@deadlystryke](https://discuss.kubernetes.io/u/deadlystryke)\ **Post date:** [August 1, 2021, 5:10pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/1 "2021-08-01T17:10:17Z")
Hi, I am new to K8s and this forum. Started to install K8s in my pc lab. I am able to open the k8s dashboard where it is asking for token and kubeconfig file, but my command is not generating any token. Below are the commands I am using: $ kubectl create serviceaccount dashboard -n default $ kubectl create clusterrolebinding dashboard-admin -n default --clusterrole=cluster-admin --serviceaccount=default:dashboard Above 2 are working fine. Below one is not generating any output : $ kubectl get secret $(kubectl get serviceaccount dashboard -o jsonpath=“{.secret[0].name}”) -o jsonpath=“{.data.token}” | base64 --decode What I am missing? Tried to google a lot but didn’t help. And I don’t know how to get CNI and CRI number? Please share commands for it, in case it is mandatory. Asking for help? Comment out what you need so we can get more information to help you! ### Cluster information: Kubernetes version:v1.21.3 Cloud being used: (put bare-metal if not on a public cloud) : Virtual box Installation method: From ISO Host OS: Ubuntu 20.04.2 LTS CNI and version: Calico CRI and version: You can format your yaml by highlighting it and pressing Ctrl-Shift-C, it will make your output easier to read. ---
**Author:** ![protosam](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/protosam/32/7732_2.png) [@protosam](https://discuss.kubernetes.io/u/protosam)\ **Post date:** [August 1, 2021, 5:53pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/2 "2021-08-01T17:53:21Z")
Break down that command see what was happening. Example: ```nohighlight kubectl get serviceaccount dashboard -o jsonpath="{.secret[0].name}" kubectl get secret OUTPUT_FROM_LAST_COMMAND -o jsonpath="{.data.token}" echo OUTPUT_FROM_LAST_COMMAND | base64 -D ``` Your problem is a typo in your jsonpath. ---
**Author:** ![deadlystryke](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@deadlystryke](https://discuss.kubernetes.io/u/deadlystryke)\ **Post date:** [August 2, 2021, 4:41am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/3 "2021-08-02T04:41:00Z")
> [@protosam](#): > > ```auto > kubectl get serviceaccount dashboard -o jsonpath="{.secret[0].name}" > kubectl get secret OUTPUT_FROM_LAST_COMMAND -o jsonpath="{.data.token}" > echo OUTPUT_FROM_LAST_COMMAND | base64 -D > > ``` Thanks protosam for your response. I tried to run the commands but there is no output of first command itself $ kubectl get serviceaccount dashboard -o jsonpath=“{.secret[0].name}” I also tried to run above command with sudo and I got error sudo kubectl get serviceaccount dashboard -o jsonpath=“{.secret[0].name}” [sudo] password for xxxxx: The connection to the server localhost:8080 was refused - did you specify the right host or port? Whereas if I check the status of all PODs namespace, those are in running state kubectl get pods --all-namespaces NAMESPACE NAME READY STATUS RESTARTS AGE kube-system calico-kube-controllers-76bf499b46-b7cdz 1/1 Running 3 13h kube-system calico-node-55cj4 1/1 Running 37 13h kube-system coredns-558bd4d5db-fhfcr 1/1 Running 3 13h kube-system coredns-558bd4d5db-x48nr 1/1 Running 3 13h kube-system etcd-master 1/1 Running 3 13h kube-system kube-apiserver-master 1/1 Running 4 13h kube-system kube-controller-manager-master 1/1 Running 9 13h kube-system kube-proxy-cmjn4 1/1 Running 3 13h kube-system kube-scheduler-master 1/1 Running 9 13h kubernetes-dashboard dashboard-metrics-scraper-856586f554-jwhw6 1/1 Running 3 13h kubernetes-dashboard kubernetes-dashboard-67484c44f6-wp9hm 1/1 Running 5 13h ---
**Author:** ![protosam](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/protosam/32/7732_2.png) [@protosam](https://discuss.kubernetes.io/u/protosam)\ **Post date:** [August 2, 2021, 5:32am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/4 "2021-08-02T05:32:46Z")
I still think it’s a typo in the jsonpath you’re using. You didn’t change it (I also didn’t correct it in my examples, just pointed out that the problem is a typo). ```nohighlight kubectl get serviceaccount dashboard -o yaml ``` Your pods have nothing to do with your secrets in this case. You created a service account and the API creates a token for that service account. ---
**Author:** ![deadlystryke](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@deadlystryke](https://discuss.kubernetes.io/u/deadlystryke)\ **Post date:** [August 2, 2021, 6:34am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/5 "2021-08-02T06:34:16Z")
I get that command from the tutorial, I was referring. Could you please point out what is wrong. Same command but with yaml format output is given below. $ kubectl get serviceaccount dashboard -o yaml apiVersion: v1 kind: ServiceAccount metadata: creationTimestamp: “2021-08-01T16:59:54Z” name: dashboard namespace: default resourceVersion: “7530” uid: da5a7d2a-927f-4943-a746-47125b6fc424 secrets: - name: dashboard-token-wqc7n ---
**Author:** ![protosam](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/protosam/32/7732_2.png) [@protosam](https://discuss.kubernetes.io/u/protosam)\ **Post date:** [August 2, 2021, 7:00am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/6 "2021-08-02T07:00:20Z")
I think it might help if you went through the [tutorial in the official documentation](https://kubernetes.io/docs/tutorials/kubernetes-basics/). Knowing what the `kubectl` commands are actually doing is going to help you out a lot in the long run. The dashboard isn’t as useful as `kubectl` itself. As for the answer to your problem, take a look at the output from the command I gave you. You see there is a key called `secrets`. In the command you’re running, `-o jsonpath="..."` is used to reference keys from objects in Kubernetes. The problem is that there’s a typo there. Compare that with the object you just got back from the last command I gave you carefully. ---
**Author:** ![deadlystryke](https://avatars.discourse-cdn.com/v4/letter/d/e480ec/32.png) [@deadlystryke](https://discuss.kubernetes.io/u/deadlystryke)\ **Post date:** [August 2, 2021, 7:05am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/7 "2021-08-02T07:05:45Z")
Thanks @protosam for sharing the link. In fact, that was my next question to share any good link to understand K8s. I will go through it to clear basics. Is there any video which can explain better on youtube or udemy? or K8s offical documentation is enough. ---
**Author:** ![protosam](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/protosam/32/7732_2.png) [@protosam](https://discuss.kubernetes.io/u/protosam)\ **Post date:** [August 2, 2021, 1:15pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/8 "2021-08-02T13:15:06Z")
I personally like the aloud.guru (rip Linux academy) videos. Though I don’t know how well they hold up for everyone. I had 8+ years of programming, web hosting, and Linux experience before ever watching that content; so my view point when watching them had a lot of holes already filled in. Like one really big knowledge component is the Linux bit. I learned Linux long ago, just poorly how to run lamp stacks, and then I got leagues better by reading the PDF from this site: [https://linuxcommand.org/tlcl.php](https://linuxcommand.org/tlcl.php) ---
**Author:** ![billfetters](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@billfetters](https://discuss.kubernetes.io/u/billfetters)\ **Post date:** [May 13, 2022, 4:40pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/9 "2022-05-13T16:40:49Z")
I’m having a similar issue… Docker-Desktop with Kubernetes… Just creating a service account does NOT create a secret. In fact, fresh install… NONE of the service accounts in all namespaces have a secret nor a token. Why is the API not creating them? ```auto me@mymachine local-cert % kubectl create serviceaccount my-admin serviceaccount/my-admin created me@mymachine % kubectl describe serviceaccount my-admin Name: my-admin Namespace: default Labels: Annotations: Image pull secrets: Mountable secrets: Tokens: Events: me@mymachine % kubectl get serviceaccount my-admin -o yaml apiVersion: v1 kind: ServiceAccount metadata: creationTimestamp: "2022-05-13T16:38:13Z" name: my-admin namespace: default resourceVersion: "7548" uid: 01b69374-367b-4cf3-a1e2-b7cfb01275e7 ``` Docker-Desktop (MAC) Version 4.8.1 (78998) Engine: 20.10.14 Compose: 1.29.2 Credential Helper: v0.6.4 Kubernetes: v1.24.0 Snyk: v1.827.0 I’ve tried this on Intel MAC, M1 Mac, and Windows 10 (AMD Ryzen 5). ---
**Author:** ![billfetters](https://avatars.discourse-cdn.com/v4/letter/b/e47c2d/32.png) [@billfetters](https://discuss.kubernetes.io/u/billfetters)\ **Post date:** [May 13, 2022, 10:11pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/10 "2022-05-13T22:11:26Z")
Docker-Desktop 4.7.1 includes the appropriate Kubernetes configuration for the controller manager and api service to automatically create secrets and tokens when creating a service account. Docker-Desktop 4.8.x does not have this configuration. Fresh install or resetting the Kubernetes cluster will prevent the secret and token from automatically being created upon service account creation ---
**Author:** ![mrbobbytables](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/mrbobbytables/32/7_2.png) [@mrbobbytables](https://discuss.kubernetes.io/u/mrbobbytables)\ **Post date:** [May 14, 2022, 10:09am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/11 "2022-05-14T10:09:04Z")
> [@billfetters](#): > > Kubernetes: v1.24.0 EDIT: This may not actually be the cause after a bit more reading, can you test the featureflag below and see if it resolves your issue? * * * In 1.24 this was disabled by default See the MUST READ section of the changelog: [https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#no-really-you-must-read-this-before-you-upgrade](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#no-really-you-must-read-this-before-you-upgrade) Relevant section: - The `LegacyServiceAccountTokenNoAutoGeneration` feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the [TokenRequest](https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/) API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this [guide](https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets). ([#108309](https://github.com/kubernetes/kubernetes/pull/108309), [@zshihang](https://github.com/zshihang)) For more information on this, please see the KEP: [KEP-2799: Reduction of Secret-based Service Account Tokens](https://github.com/kubernetes/enhancements/tree/master/keps/sig-auth/2799-reduction-of-secret-based-service-account-token) ---
**Author:** ![Mridul\_Rawat](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/mridul_rawat/32/9709_2.png) [@Mridul\_Rawat](https://discuss.kubernetes.io/u/Mridul_Rawat)\ **Post date:** [May 23, 2022, 5:44am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/12 "2022-05-23T05:44:57Z")
Hi mrbobbytables and everyone, After successful installation of k8 cluster, I was trying to deploy k8 dashboard by creating service account though the tokens are not getting generated , i listed all SA and it it showing 0 secrets for each SA . [Install Kubernetes Dashboard - Deploy Applications using UI (learnitguide.net)](https://www.learnitguide.net/2020/10/install-kubernetes-dashboard-deploy.html) - i was refereeing this link for creating dashboard. Could you pls help me out on this issue. The Kubernetes version which i’m using is 1.24 and if secrets are being disabled by default then could you pls show me the method for generating these secrets. Thank you ---
**Author:** ![xavi](https://avatars.discourse-cdn.com/v4/letter/x/8e8cbc/32.png) [@xavi](https://discuss.kubernetes.io/u/xavi)\ **Post date:** [May 24, 2022, 6:12pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/13 "2022-05-24T18:12:12Z")
Hi Mridul\_Rawat: Please, take a look at this blog entry, for example: > **[BIG change in K8s 1.24 about ServiceAccounts and their Secrets](https://itnext.io/big-change-in-k8s-1-24-about-serviceaccounts-and-their-secrets-4b909a4af4e0)** > > K8s won’t generate Secrets any longer automatically for ServiceAccounts Best regards, Xavi ---
**Author:** ![Phil1972](https://avatars.discourse-cdn.com/v4/letter/p/85e7bf/32.png) [@Phil1972](https://discuss.kubernetes.io/u/Phil1972)\ **Post date:** [September 21, 2022, 1:05pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/14 "2022-09-21T13:05:35Z")
Hi guys, In the context of K8S created in Azure, this flag is causing a problem since we cannot map the namespaces to Environment. The mapping fails with the message ‘Could not find any secrets associated with the Service Account.’. Has anyone been able to fix this somehow? I will try to turn off the feature gate ‘LegacyServiceAccountTokenNoAutoGeneration’ to see if it resolves my issue, but so far I could not find any workaround to fix that problem in Azure. thanks, ---
**Author:** ![Eder\_Roger](https://sea2.discourse-cdn.com/flex016/user_avatar/discuss.kubernetes.io/eder_roger/32/10970_2.png) [@Eder\_Roger](https://discuss.kubernetes.io/u/Eder_Roger)\ **Post date:** [October 7, 2022, 3:19pm UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/15 "2022-10-07T15:19:34Z")
We are facing the same issue in our project. After the aks upgrade to 1.24.3 the Kubernetes services endpoints are not created due to this missing secret error. We tried to create the secret after the SA, after the creation by serviceendpoint API, but it didn’t work. ---
**Author:** ![PNKJ\_Gupta](https://avatars.discourse-cdn.com/v4/letter/p/f17d59/32.png) [@PNKJ\_Gupta](https://discuss.kubernetes.io/u/PNKJ_Gupta)\ **Post date:** [October 11, 2022, 11:38am UTC](https://discuss.kubernetes.io/t/secret-token-not-generating/16923/16 "2022-10-11T11:38:37Z")
So Finally I found the solution . Now you need create Service Account first, Then you need generate token for that service account using below cmds _kubectl create token serviceaccount -n namespace_ Then you need to store the secret using below _apiVersion: v1_ _kind: Secret_ _type: [kubernetes.io/service-account-token](http://kubernetes.io/service-account-token)_ _metadata:_ - name: admin-user\* - namespace: kubernetes-dashboard\* - annotations:\* - [kubernetes.io/service-account.name:](http://kubernetes.io/service-account.name:) “admin-user”\* _kubectl apply -f secret.yml_ _kubectl describe secret serviceaccount -n namespace_