Answers: <p>Normally, when you create a <code>ServiceAccount</code> and associate it with a Pod, Kubernetes should automatically mount the service account token and certificate into the Pod at <code>/var/run/secrets/kubernetes.io/serviceaccount/</code>.</p>
  <p>You may have missed a step.</p>
  <pre><code>#!/bin/bash
  
  # Variables
  NAMESPACE=&quot;sa&quot;
  SERVICE_ACCOUNT=&quot;sa&quot;
  POD_NAME=&quot;my-pod&quot;
  IMAGE=&quot;nginx&quot;  # Replace with your image if different
  
  # Create the namespace
  kubectl create namespace $NAMESPACE
  
  # Create the service account
  kubectl create serviceaccount $SERVICE_ACCOUNT -n $NAMESPACE
  
  # Create a pod that uses the service account
  cat &lt;&lt;EOF | kubectl apply -f -
  apiVersion: v1
  kind: Pod
  metadata:
    name: $POD_NAME
    namespace: $NAMESPACE
  spec:
    serviceAccountName: $SERVICE_ACCOUNT
    containers:
    - name: my-container
      image: $IMAGE
      command: [&quot;/bin/sh&quot;, &quot;-c&quot;, &quot;sleep 3600&quot;]
  EOF
  
  # Wait for the pod to be running
  echo &quot;Waiting for pod to be running...&quot;
  kubectl wait --for=condition=Ready pod/$POD_NAME -n $NAMESPACE --timeout=120s
  
  # Verify the secrets are mounted
  echo &quot;Verifying the mounted secrets...&quot;
  kubectl exec -it $POD_NAME -n $NAMESPACE -- /bin/sh -c 'ls /var/run/secrets/kubernetes.io/serviceaccount/ &amp;&amp; cat /var/run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
  
  echo &quot;Script completed.&quot;
  </code></pre>
  
Answers: CC BY-SA 4.0
Answers: 2024-11-29T23:50:27.260Z
Answers: 2024-11-29T23:50:27.260Z
Answers: YassineLbk
Body: <p>I am new to Kubernetes and I am trying to understand some basic concepts such as serviceaccounts and secrets. As explained in the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting" rel="nofollow noreferrer">Kubernetes docs</a> each pod associated with a serviceaccount has its secret mounted at <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code> and the associated certificate is located is loacated at <code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code> to access the API-server.</p>
  <p>How can I mimic that? I've tried the following:</p>
  <pre><code>apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: sa
    namespace: sa
  ---
  apiVersion: v1
  kind: Secret
  metadata:
    name: sa
    namespace: sa
    annotations:
      kubernetes.io/service-account.name: sa
  type: kubernetes.io/service-account-token
  </code></pre>
  <p>and I am logging in into the container with:</p>
  <pre><code>⬢ [Docker] ❯ kubectl exec -it my-container --as system:serviceaccount:sa:sa -n spark -- /bin/sh
  $ ls /var/run
  lock  mount
  $ ls /var/run/secrets
  ls: cannot access '/var/run/secrets': No such file or directory
  $ 
  </code></pre>
  <p>unfortunately I cannot find neighter the <em>token</em> nor the <code>ca.crt</code>.</p>
  
Tags: <kubernetes><secret-management>
Title: Understanding Kubernetes serviceaccounts and mounted secrets
UserDisplayName: boraas
ThreadText: # Understanding Kubernetes serviceaccounts and mounted secrets
  
  (Asked by: username_0 on 2024-11-29)
  
  I am new to Kubernetes and I am trying to understand some basic concepts such as serviceaccounts and secrets. As explained in the [Kubernetes docs](https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting) each pod associated with a serviceaccount has its secret mounted at `/var/run/secrets/kubernetes.io/serviceaccount/token` and the associated certificate is located is loacated at `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` to access the API-server.
  
  How can I mimic that? I've tried the following:
  
  ```
  apiVersion: v1
  kind: ServiceAccount
  metadata:
    name: sa
    namespace: sa
  ---
  apiVersion: v1
  kind: Secret
  metadata:
    name: sa
    namespace: sa
    annotations:
      kubernetes.io/service-account.name: sa
  type: kubernetes.io/service-account-token
  
  ```
  
  and I am logging in into the container with:
  
  ```
  ⬢ [Docker] ❯ kubectl exec -it my-container --as system:serviceaccount:sa:sa -n spark -- /bin/sh
  $ ls /var/run
  lock  mount
  $ ls /var/run/secrets
  ls: cannot access '/var/run/secrets': No such file or directory
  $ 
  
  ```
  
  unfortunately I cannot find neighter the *token* nor the `ca.crt`.
  
  **Tags:** kubernetes, secret-management
  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_1 on 2024-11-29. Score: 0
  
  Normally, when you create a `ServiceAccount` and associate it with a Pod, Kubernetes should automatically mount the service account token and certificate into the Pod at `/var/run/secrets/kubernetes.io/serviceaccount/`.
  
  You may have missed a step.
  
  ```
  #!/bin/bash
  
  # Variables
  NAMESPACE="sa"
  SERVICE_ACCOUNT="sa"
  POD_NAME="my-pod"
  IMAGE="nginx"  # Replace with your image if different
  
  # Create the namespace
  kubectl create namespace $NAMESPACE
  
  # Create the service account
  kubectl create serviceaccount $SERVICE_ACCOUNT -n $NAMESPACE
  
  # Create a pod that uses the service account
  cat <<EOF | kubectl apply -f -
  apiVersion: v1
  kind: Pod
  metadata:
    name: $POD_NAME
    namespace: $NAMESPACE
  spec:
    serviceAccountName: $SERVICE_ACCOUNT
    containers:
    - name: my-container
      image: $IMAGE
      command: ["/bin/sh", "-c", "sleep 3600"]
  EOF
  
  # Wait for the pod to be running
  echo "Waiting for pod to be running..."
  kubectl wait --for=condition=Ready pod/$POD_NAME -n $NAMESPACE --timeout=120s
  
  # Verify the secrets are mounted
  echo "Verifying the mounted secrets..."
  kubectl exec -it $POD_NAME -n $NAMESPACE -- /bin/sh -c 'ls /var/run/secrets/kubernetes.io/serviceaccount/ && cat /var/run/secrets/kubernetes.io/serviceaccount/token && cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt'
  
  echo "Script completed."
  
  ```
  
  
  ---
  
  