service-account-secrets.md

Service Account Secrets

As of Kubernetes v1.24, secrets are no longer automatically created for service accounts.

You must create a secret manually.

You must also make the secret discoverable. You have two options:

Option 1 - Discovery By Name

Name your secret ${serviceAccountName}.service-account-token:

apiVersion: v1
kind: Secret
metadata:
  name: default.service-account-token
  annotations:
    kubernetes.io/service-account.name: default
type: kubernetes.io/service-account-token

This option is simpler than option 2, as you can create the secret and make it discoverable by name at the same time.

Option 2 - Discovery By Annotation

Annotate the service account with the secret name:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: default
  annotations:
    workflows.argoproj.io/service-account-token.name: my-token

This option is useful when the secret already exists, or the service account has a very long name.