为何新建的Kubernetes ServiceAccount显示关联0个Secret？

问题现象 #

在Kubernetes 1.24.3版本中，创建名为deployer的ServiceAccount，并手动创建了关联的token-secret，但执行kubectl get sa deployer时，输出中的SECRETS字段显示为0。不过实际该Secret中的token可以正常用于API认证，功能不受影响。

相关配置与验证信息 #

创建资源的YAML配置 #

kubectl apply -f - << EOF
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: deployer
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployer-role
rules:
- apiGroups: ["", "extensions", "apps"]
  resources:
  - deployments
  verbs: ["list", "get", "describe", "apply", "delete", "patch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: deployer-crb
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: deployer-role
subjects:
- kind: ServiceAccount
  name: deployer
  namespace: default
---
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: token-secret
  annotations:
    kubernetes.io/service-account.name: deployer
EOF

ServiceAccount查看输出 #

cyber@manager1:~$ kubectl get sa deployer
NAME       SECRETS   AGE
deployer   0         4m32s

cyber@manager1:~$ kubectl get sa deployer -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"ServiceAccount","metadata":{"annotations":{},"name":"deployer","namespace":"default"}}
  creationTimestamp: "2022-10-13T08:36:54Z"
  name: deployer
  namespace: default
  resourceVersion: "2129964"
  uid: cd2bf19f-92b2-4830-8b5a-879914a18af5

关联Secret信息 #

cyber@manager1:~$ kubectl get secrets token-secret -o yaml
apiVersion: v1
data:
  ca.crt: <REDACTED>
  namespace: ZGVmYXVsdA==
  token: <REDACTED>
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {"apiVersion":"v1","kind":"Secret","metadata":{"annotations":{"kubernetes.io/service-account.name":"deployer"},"name":"token-secret","namespace":"default"},"type":"kubernetes.io/service-account-token"}
    kubernetes.io/service-account.name: deployer
    kubernetes.io/service-account.uid: cd2bf19f-92b2-4830-8b5a-879914a18af5
  creationTimestamp: "2022-10-13T08:36:54Z"
  name: token-secret
  namespace: default
  resourceVersion: "2129968"
  uid: d960c933-5e7b-4750-865d-e843f52f1b48
type: kubernetes.io/service-account-token

功能验证命令 #

kubectl get pods --token `cat ./token` -s https://192.168.49.2:8443 --certificate-authority /home/cyber/.minikube/ca.crt --all-namespaces

Kubernetes版本信息 #

cyber@manager1:~$ kubectl version
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short.  Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:"1", Minor:"25", GitVersion:"v1.25.0", GitCommit:"a866cbe2e5bbaa01cfd5e969aa3e033f3282a8a2", GitTreeState:"clean", BuildDate:"2022-08-23T17:44:59Z", GoVersion:"go1.19", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.7
Server Version: version.Info{Major:"1", Minor:"24", GitVersion:"v1.24.3", GitCommit:"aef86a93758dc3cb2c658dd9657ab4ad4afc21cb", GitTreeState:"clean", BuildDate:"2022-07-13T14:23:26Z", GoVersion:"go1.18.3", Compiler:"gc", Platform:"linux/amd64"}

原因分析 #

这个现象是Kubernetes 1.24版本引入的重大变更导致的：

1. 从1.24版本开始，Kubernetes默认不再为ServiceAccount自动创建关联的Token Secret，转而推荐使用TokenRequest API获取临时token。
2. 对于手动创建的kubernetes.io/service-account-token类型Secret，即使通过kubernetes.io/service-account.name注解关联了ServiceAccount，Kubernetes控制平面不会再将该Secret计入ServiceAccount的SECRETS字段统计。这个字段现在仅统计由控制平面自动创建的Secret。
3. 虽然SECRETS计数显示为0，但Secret与ServiceAccount的实际绑定关系是有效的——从Secret的注解可以看到，kubernetes.io/service-account.uid已经正确匹配了ServiceAccount的UID，因此token可以正常通过API认证，功能不受影响。

内容的提问来源于stack exchange，提问作者E235