K
Q

Ingress nginx Unable to rotate token: failed to read token file "/var/run/secrets/kubernetes.io/serviceaccount/token"

2/9/2021

I am running nginx-ingress v0.44.0 on Kubernetes version v1.20.2, install ingress using helm chat ingress-nginx-3.23.0. nginx taking the traffic from the log file I see this error message.

E0209 23:21:41.300842       6 token_source.go:152] Unable to rotate token: failed to read token file "/var/run/secrets/kubernetes.io/serviceaccount/token": open /var/run/secrets/kubernetes.io/serviceaccount/token: permission denied
E0209 23:21:41.316286       6 token_source.go:152] Unable to rotate token: failed to read token file "/var/run/secrets/kubernetes.io/serviceaccount/token": open /var/run/secrets/kubernetes.io/serviceaccount/token: permission denied

Nignx is running uid 101 but serviceaccount directory owned by root user.

How to fix this error message?

Thanks

-- sfgroups
kubernetes
kubernetes-ingress
nginx
nginx-ingress

Similar Questions

How to Perform a SRV Look up in Kubernetes to use the port to perfom service call
How could you implement `kubectl apply -f stuff.yaml` with the java Kubernetes Client
Is it that I can't edit an AKS cluster on Azure?
Ingress doesn't work on Google Kubernetes Engine (GKE)
Determining reasonable values for quotas and limit ranges

2 Answers

2/10/2021

It's kinda odd, as I've tested I haven't experienced such a error.

You could use securityContext, set

  • fsGroup: 101 or
  • runAsUser/runAsGroup

But still the ingress-nginx sets appropriate securityContext (for example to bind on 80/443), so it should work.

-- kwarunek
Source: StackOverflow
3/10/2021

As @sfgroups mentioned solution is to make nignx not running uid 101 but 0. Add flag to installation command: --set controller.image.runAsUser=0.

Read: helm-nginx-ingress-installation.

-- Malgorzata
Source: StackOverflow