MountVolume.SetUp failed for volume "istio-token":failed to fetch token: the API server do

院长技术

发布于 2022-03-10 21:17:04

1.5K0

发布于 2022-03-10 21:17:04

这里查看pod可能会发现有pod一直处于creating状态，通过describe命令可知“istio-token”找不到：

MountVolume.SetUp failed for volume "istio-token":failed to fetch token: the API server does not have TokenRequest endpoints enabled

看我们的k8s集群是否支持第三方令牌

{
  "name": "serviceaccounts/token",
  "singularName": "",
  "namespaced": true,
  "group": "authentication.k8s.io",
  "version": "v1",
  "kind": "TokenRequest",
  "verbs": [
    "create"
  ]
}

配置apiserver添加参数来支持第三方令牌（Third-party-jwt）

在/etc/kubernetes/manifests/kube-apiserver.yaml里添加：
- --service-account-signing-key-file=/etc/kubernetes/pki/sa.key
- --service-account-key-file=/etc/kubernetes/pki/sa.pub
- --service-account-issuer=api
- --service-account-api-audiences=api,vault,factors

本文参与?腾讯云自媒体分享计划，分享自作者个人站点/博客。

如有侵权请联系 cloudcommunity@tencent.com 删除

istio