Creating ServiceAccount Secrets in Kubernetes

Kubernetes ServiceAccount Secrets API Access

1 min read | by Jordi Prats

Starting Kubernetes 1.24, Secrets are not automatically generated when Service Accounts are created. Since we won't have a Secret generated when we create the ServiceAccount, how can we create ServiceAccount Secrets so that External Applications can access the Kubernetes API?

Assuming we create the sa-name ServiceAccount like this:

$ kubectl create sa sa-name
serviceaccount/sa-name created

We won't get any tokens:

$ kubectl get sa,secret
NAME                     SECRETS   AGE
serviceaccount/default   0         29s
serviceaccount/sa-name   0         6s

But we can request a new token by creating an empty secret with the annotation:

cat <<"EOF" | kubectl apply -f -
apiVersion: v1
kind: Secret
  name: demo
  annotations: sa-name

Kubernetes is going to populate the secret that we will be able to use with to access the Kubernetes API:

$ kubectl get secret demo -o json | jq '.data | keys[]'

Posted on 17/04/2023