operator not detecting incluster config

[srgvg]

I'm deploying a shell operator in a cluster with a deployment. Did the same thing previously on another cluster without problems. The main thing that changed on this new cluster, is avoiding running the shell-operator as root. My Dockerfile is

# https://flant.github.io/shell-operator/RUNNING.html
FROM ghcr.io/flant/shell-operator:latest

# Install Gcloud to send to pub/sub
RUN apk add --update curl python3 jo findutils && \
    curl -sSL --connect-timeout 5 -L https://sdk.cloud.google.com -o /tmp/gcl && \
    bash /tmp/gcl --install-dir=/gcloud --disable-prompts
ENV PATH=$PATH:/gcloud/google-cloud-sdk/bin

# add shell-operator hooks
ADD hooks /hooks

# APP usedr
RUN     addgroup -S appgroup -g 1000 && \
        adduser -S appuser -G appgroup -u 1000 && \
        mkdir /var/run/shell-operator && \
        chown appuser:appgroup /var/run/shell-operator

# USER nobody  https://stackoverflow.com/questions/49720308/kubernetes-podsecuritypolicy-set-to-runasnonroot-container-has-runasnonroot-and
USER appuser

In the current case, it seems the operator cannot detect it's running in-cluster:

time="2023-10-30T09:52:45Z" level=info msg="Enable kubernetes binding for hook" binding= hook=events-hook.sh queue=main task=EnableKubernetesBindings
time="2023-10-30T09:52:45Z" level=error msg="E1030 09:52:45.457581       7 memcache.go:265] couldn't get current server API group list: Get \"http://localhost:8080/api?timeout=32s\": dial tcp 127.0.0.1:8080: connect: connection refused\n" source=klog
time="2023-10-30T09:52:45Z" level=error msg="kubernetes[0]: Cannot get GroupVersionResource info for apiVersion 'kustomize.toolkit.fluxcd.io/v1' kind 'Kustomization' from api-server. Possibly CRD is not created before informers are started. Error was: apiVersion 'kustomize.toolkit.fluxcd.io/v1', kind 'Kustomization' is not supported by cluster: apiVersion 'kustomize.toolkit.fluxcd.io/v1' has no supported resources in cluster: Get \"http://localhost:8080/api?timeout=32s\": dial tcp 127.0.0.1:8080: connect: connection refused"
time="2023-10-30T09:52:45Z" level=error msg="Enable Kubernetes binding for hook failed. Will retry after delay. Failed count is 7363. Error: run monitor: apiVersion 'kustomize.toolkit.fluxcd.io/v1', kind 'Kustomization' is not supported by cluster: apiVersion 'kustomize.toolkit.fluxcd.io/v1' has no supported resources in cluster: Get \"http://localhost:8080/api?timeout=32s\": dial tcp 127.0.0.1:8080: connect: connection refused" binding= hook=events-hook.sh queue=main task=EnableKubernetesBindings

The process does have the expected KUBERNETES_* environment variables:

flux-pubsub-publisher-7fbb766fc5-w2fmr:/$ cat /proc/$(pgrep shell-operator)/environ | sed 's/\x0/\n/g' | sort | grep KUBE
KUBERNETES_PORT=tcp://172.34.64.1:443
KUBERNETES_PORT_443_TCP=tcp://172.34.64.1:443
KUBERNETES_PORT_443_TCP_ADDR=172.34.64.1
KUBERNETES_PORT_443_TCP_PORT=443
KUBERNETES_PORT_443_TCP_PROTO=tcp
KUBERNETES_SERVICE_HOST=172.34.64.1
KUBERNETES_SERVICE_PORT=443
KUBERNETES_SERVICE_PORT_HTTPS=443

What am I missing?

[srgvg]

OK, never mind, spec.automountServiceAccountToken was set to false. A "sane" default from using cdk8s.