<p>Normally, when you create a <code>ServiceAccount</code> and associate it with a Pod, Kubernetes should automatically mount the service account token and certificate into the Pod at <code>/var/run/secrets/kubernetes.io/serviceaccount/</code>.</p>
<p>You may have missed a step.</p>
<pre><code>#!/bin/bash

# Variables
NAMESPACE=&quot;sa&quot;
SERVICE_ACCOUNT=&quot;sa&quot;
POD_NAME=&quot;my-pod&quot;
IMAGE=&quot;nginx&quot;  # Replace with your image if different

# Create the namespace
kubectl create namespace $NAMESPACE

# Create the service account
kubectl create serviceaccount $SERVICE_ACCOUNT -n $NAMESPACE

# Create a pod that uses the service account
cat &lt;&lt;EOF | kubectl apply -f -
apiVersion: v1
kind: Pod
metadata:
  name: $POD_NAME
  namespace: $NAMESPACE
spec:
  serviceAccountName: $SERVICE_ACCOUNT
  containers:
  - name: my-container
    image: $IMAGE
    command: [&quot;/bin/sh&quot;, &quot;-c&quot;, &quot;sleep 3600&quot;]
EOF

# Wait for the pod to be running
echo &quot;Waiting for pod to be running...&quot;
kubectl wait --for=condition=Ready pod/$POD_NAME -n $NAMESPACE --timeout=120s

# Verify the secrets are mounted
echo &quot;Verifying the mounted secrets...&quot;
kubectl exec -it $POD_NAME -n $NAMESPACE -- /bin/sh -c 'ls /var/run/secrets/kubernetes.io/serviceaccount/ &amp;&amp; cat /var/run/secrets/kubernetes.io/serviceaccount/token &amp;&amp; cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt'

echo &quot;Script completed.&quot;
</code></pre>

CC BY-SA 4.0
2024-11-29T23:50:27.260Z
2024-11-29T23:50:27.260Z
YassineLbk
<p>I am new to Kubernetes and I am trying to understand some basic concepts such as serviceaccounts and secrets. As explained in the <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#opt-out-of-api-credential-automounting" rel="nofollow noreferrer">Kubernetes docs</a> each pod associated with a serviceaccount has its secret mounted at <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code> and the associated certificate is located is loacated at <code>/var/run/secrets/kubernetes.io/serviceaccount/ca.crt</code> to access the API-server.</p>
<p>How can I mimic that? I've tried the following:</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa
  namespace: sa
---
apiVersion: v1
kind: Secret
metadata:
  name: sa
  namespace: sa
  annotations:
    kubernetes.io/service-account.name: sa
type: kubernetes.io/service-account-token
</code></pre>
<p>and I am logging in into the container with:</p>
<pre><code>⬢ [Docker] ❯ kubectl exec -it my-container --as system:serviceaccount:sa:sa -n spark -- /bin/sh
$ ls /var/run
lock  mount
$ ls /var/run/secrets
ls: cannot access '/var/run/secrets': No such file or directory
$ 
</code></pre>
<p>unfortunately I cannot find neighter the <em>token</em> nor the <code>ca.crt</code>.</p>

<kubernetes><secret-management>
Understanding Kubernetes serviceaccounts and mounted secrets
boraas
# Understanding Kubernetes serviceaccounts and mounted secrets

(Asked by: username_0 on 2024-11-29)

I am new to Kubernetes and I am trying to understand some basic concepts such as serviceaccounts and secrets. As explained in the Kubernetes docs each pod associated with a serviceaccount has its secret mounted at /var/run/secrets/kubernetes.io/serviceaccount/token and the associated certificate is located is loacated at /var/run/secrets/kubernetes.io/serviceaccount/ca.crt to access the API-server.
How can I mimic that? I've tried the following:
apiVersion: v1
kind: ServiceAccount
metadata:
  name: sa
  namespace: sa
---
apiVersion: v1
kind: Secret
metadata:
  name: sa
  namespace: sa
  annotations:
    kubernetes.io/service-account.name: sa
type: kubernetes.io/service-account-token

and I am logging in into the container with:
⬢ [Docker] ❯ kubectl exec -it my-container --as system:serviceaccount:sa:sa -n spark -- /bin/sh
$ ls /var/run
lock  mount
$ ls /var/run/secrets
ls: cannot access '/var/run/secrets': No such file or directory
$ 

unfortunately I cannot find neighter the token nor the ca.crt.

**Tags:** kubernetes, secret-management


---

## 1 answers

### Answer by username_1 on 2024-11-29. Score: 0

Normally, when you create a ServiceAccount and associate it with a Pod, Kubernetes should automatically mount the service account token and certificate into the Pod at /var/run/secrets/kubernetes.io/serviceaccount/.
You may have missed a step.
#!/bin/bash

# Variables
NAMESPACE="sa"
SERVICE_ACCOUNT="sa"
POD_NAME="my-pod"
IMAGE="nginx"  # Replace with your image if different

# Create the namespace
kubectl create namespace $NAMESPACE

# Create the service account
kubectl create serviceaccount $SERVICE_ACCOUNT -n $NAMESPACE

# Create a pod that uses the service account
cat <


---

