<p dir="auto">Hello,</p>
<p dir="auto">I faced this issue: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="151262308" data-permission-text="Title is private" data-url="https://github.com/kubernetes/kubernetes/issues/24829" data-hovercard-type="issue" data-hovercard-url="/kubernetes/kubernetes/issues/24829/hovercard" href="https://github.com/kubernetes/kubernetes/issues/24829">#24829</a> with DNS, and it ended up being a problem with my <strong>ServiceAccount</strong> <code class="notranslate">secret</code> token that was <strong>invalid</strong>.</p>
<p dir="auto">I had 3 secrets in my <code class="notranslate">kube-system</code> <strong>ServiceAccount</strong> for some reason.</p>
<p dir="auto">I understand that when <code class="notranslate">secrets</code> are deleted, a new token is generated and associated with the <strong>ServiceAccount</strong>.</p>
<p dir="auto">I just don't understand how I ended up with 3 secrets, and how one (maybe 2?) was invalid.</p>
<ul dir="auto">
<li>How are secrets invalidated?</li>
<li>How are they created besides when there are none? Is it on <code class="notranslate">apiserver</code> start? on <code class="notranslate">kubelet</code> start?</li>
<li>It's obviously possible to have multiple tokens for a service account, but how can this happen automatically?</li>
</ul>
<p dir="auto">When invalidated, shouldn't these automatically generated tokens also be automatically removed from the <strong>ServiceAccount</strong>?</p>
<p dir="auto">Thanks</p>
<p dir="auto"><strong>Is this a request for help?</strong> (If yes, you should use our troubleshooting guide and community support channels, see <a href="http://kubernetes.io/docs/troubleshooting/" rel="nofollow">http://kubernetes.io/docs/troubleshooting/</a>.): bo</p>
<p dir="auto"><strong>What keywords did you search in Kubernetes issues before filing this one?</strong> (If you have found any duplicates, you should instead reply there.): etcd</p>
<p dir="auto"><strong>What happened</strong>:</p>
<ol dir="auto">
<li>I ran etcd in container, without binding its ports to the host.</li>
<li>I started k8s local cluster (<code class="notranslate">./hack/local-up-cluster.sh</code>)</li>
<li>Error <code class="notranslate">etcd appears to already be running...</code></li>
</ol>
<p dir="auto"><strong>What you expected to happen</strong>:</p>
<p dir="auto">I expect that <code class="notranslate">local-up-cluster.sh</code> will allow to run containerized instances of etcd which don't bring any conflict to the k8s etcd instance. Why? Because for some external software which is intended to run alongside Kubernetes (i.e. Calico) it's recommended to run separate etcd. I'm also working on the external runtime service, which will be running its own etcd instance.</p>