-
Notifications
You must be signed in to change notification settings - Fork 38.7k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Improve error message for projected tokens when API is not enabled #83192
Improve error message for projected tokens when API is not enabled #83192
Conversation
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: liggitt The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
I guess this could give an inccorrect error if TokenRequest was enabled on the apiserver after kubelet startup, and the service account the pod is running as doesn't exist. |
/lgtm |
@liggitt @mikedanese Is it possible that this error may be thrown when |
BoundServiceAccountTokenVolume enables/disables auto-injected projected token volumes for service account tokens. A pod can manually specify a projected token volume as well. The kubelet doesn't care whether a projected token volume was auto-injected or manually specified in the pod. When it encounters that type of volume, it makes a token request to the API server to get a token to mount into the pod. If the token request APIs are unavailable, the kubelet will display this error. |
Thanks for the clarification @liggitt :) |
What type of PR is this?
/kind cleanup
What this PR does / why we need it:
Improves the error message returned from the kubelet if a token cannot be fetched because the API server doesn't have TokenRequest APIs enabled
Which issue(s) this PR fixes:
xref #83189
Does this PR introduce a user-facing change?:
/sig auth
/cc @mikedanese