我正在使用 golang 库 client-go连接到正在运行的本地 kubrenets。首先，我从示例中获取了代码:out-of-cluster-client-configuration .

运行这样的代码: $ KUBERNETES_SERVICE_HOST=localhost KUBERNETES_SERVICE_PORT=6443 go run ./main.go 导致以下错误:

panic: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory

goroutine 1 [running]:

/var/run/secrets/kubernetes.io/serviceaccount/

我不太确定我缺少配置的哪一部分。我研究了以下链接:

• https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins

• https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/

但是没有运气。 我想我需要让 client-go 知道要使用哪个 token /serviceAccount，或者以每个人都可以连接到其 api 的方式配置 kubectl。

这是我的 kubectl 的状态，虽然有一些命令结果:

$ kubectl 配置 View

apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://localhost:6443
  name: docker-for-desktop-cluster
contexts:
- context:
    cluster: docker-for-desktop-cluster
    user: docker-for-desktop
  name: docker-for-desktop
current-context: docker-for-desktop
kind: Config
preferences: {}
users:
- name: docker-for-desktop
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED

$ kubectl 获取服务账户

NAME        SECRETS   AGE
default     1         3d
test-user   1         1d

$ kubectl describe serviceaccount 测试用户

Name:                test-user
Namespace:           default
Labels:              <none>
Annotations:         <none>
Image pull secrets:  <none>
Mountable secrets:   test-user-token-hxcsk
Tokens:              test-user-token-hxcsk
Events:              <none>

$ kubectl get secret test-user-token-hxcsk -o yaml

apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0......=
  namespace: ZGVmYXVsdA==
  token: ZXlKaGJHY2lPaUpTVXpJMU5pSX......=
kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: test-user
    kubernetes.io/service-account.uid: 984b359a-6bd3-11e8-8600-XXXXXXX
  creationTimestamp: 2018-06-09T10:55:17Z
  name: test-user-token-hxcsk
  namespace: default
  resourceVersion: "110618"
  selfLink: /api/v1/namespaces/default/secrets/test-user-token-hxcsk
  uid: 98550de5-6bd3-11e8-8600-XXXXXX
type: kubernetes.io/service-account-token

最佳答案

这个答案可能有点过时，但我会尝试为 future 遇到相同/相似问题的读者提供更多视角/基准。

长话短说

以下错误:

panic: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory

很可能与 /var/run/secrets/kubernetes.io/serviceaccount 位置缺少 token 有关，当使用 in -集群客户端配置。此外，它可能与在集群外部使用 in-cluster-client-configuration 代码有关(例如，直接在笔记本电脑上运行此代码或在纯Docker 容器)。

您可以检查以下命令以进一步解决您的问题(假设此代码在 Pod 中运行):

• $ kubectl get serviceaccount X -o yaml:
  • 寻找:automountServiceAccountToken: false
• $ kubectl describe pod XYZ
  • 寻找:containers.mounts 和 volumeMounts 安装了 Secret

引用官方文档:

Authenticating inside the cluster

This example shows you how to configure a client with client-go to authenticate to the Kubernetes API from an application running inside the Kubernetes cluster.

client-go uses the Service Account token mounted inside the Pod at the /var/run/secrets/kubernetes.io/serviceaccount path when the rest.InClusterConfig() is used.

-- Github.com: Kubernetes: client-go: Examples: in cluster client configuration

如果您使用 ~/.kube/config 向 Kubernetes API 进行身份验证，您应该使用 out-of-cluster-client-configuration.

附加信息:

当代码在 Pod 中运行时，我添加了额外的信息作为进一步故障排除的更多引用。

• automountServiceAccountToken: false

In version 1.6+, you can opt out of automounting API credentials for a service account by setting automountServiceAccountToken: false on the service account:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: go-serviceaccount
automountServiceAccountToken: false

In version 1.6+, you can also opt out of automounting API credentials for a particular pod:

apiVersion: v1
kind: Pod
metadata:
  name: sdk
spec:
 serviceAccountName: go-serviceaccount
 automountServiceAccountToken: false

-- Kubernetes.io: Docs: Tasks: Configure pod container: Configure service account

• $ kubectl describe pod XYZ:

挂载 servicAccount token 后，Pod 定义应如下所示:

<-- OMITTED --> 
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from go-serviceaccount-token-4rst8 (ro)
<-- OMITTED --> 
Volumes:
  go-serviceaccount-token-4rst8:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  go-serviceaccount-token-4rst8
    Optional:    false

如果不是:

<-- OMITTED --> 
    Mounts:         <none>
<-- OMITTED --> 
Volumes:            <none>

其他资源:

• Kubernetes.io: Docs: Reference: Access authn authz: Authentication

关于go - 无法从 client-go -/serviceaccount/token : no such file 连接到 kubectl，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/50784830/