kubebuilder: Got errors on kubebuilder v3 quick start

What broke? What’s expected?

Using the latest kubebuilder cli, quick start a new project based on the official document, got these errors:

  1. Enable the leader-election, then make run, got error:
go fmt ./...
go vet ./...
go run ./main.go
1.665666448465308e+09   ERROR   setup   unable to start manager {"error": "unable to find leader election namespace: not running in-cluster, please specify LeaderElectionNamespace"}
main.main
...
exit status 1
make: *** [run] Error 1
  1. After make deploy IMG=xxx/xxx:tag, the controller-pod got error:
1.6656687258729894e+09  ERROR   controller-runtime.client.config        unable to get kubeconfig        {"error": "open /var/run/secrets/kubernetes.io/serviceaccount/token: permission denied"}
sigs.k8s.io/controller-runtime/pkg/client/config.GetConfigOrDie
        /go/pkg/mod/sigs.k8s.io/controller-runtime@v0.13.0/pkg/client/config/config.go:153
main.main
        /workspace/main.go:68
runtime.main
        /usr/local/go/src/runtime/proc.go:250
  1. As the doc said Important: Run "make" to regenerate code after modifying this file, but make did not generate latest CRD fields.

Reproducing this issue

Just quick start a new project based on the official document, then will reproduce this issue.

KubeBuilder (CLI) Version

Version: main.version{KubeBuilderVersion:“3.7.0”, KubernetesVendor:“1.24.1”, GitCommit:“3bfc84ec8767fa760d1771ce7a0cb05a9a8f6286”, BuildDate:“2022-09-20T17:21:57Z”, GoOs:“darwin”, GoArch:“amd64”}

PROJECT version

No response

Plugin versions

No response

Other versions

No response

Extra Labels

No response

About this issue

  • Original URL
  • State: closed
  • Created 2 years ago
  • Comments: 15 (14 by maintainers)

Most upvoted comments

It seems possible it could be related to ServiceAccounts no longer auto-generating tokens by default as of kubernetes 1.24 (see changelog here: https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes).

If you update the config/rbac/service_account.yaml file and add this to the end of it:

automountServiceAccountToken: true

That should not be necessary. Service accounts still mount tokens by default in 1.24, they just do so using ephemerally generated tokens, not tokens stored in Secret API objects