{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16230","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16230/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16230/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16230/events","html_url":"https://github.com/kubernetes/kubernetes/issues/16230","id":113142095,"number":16230,"title":"How to access Kubernetes service from pods started via /etc/kubernetes/manifests?","user":{"login":"eliaslevy","id":725218,"avatar_url":"https://avatars.githubusercontent.com/u/725218?v=3","gravatar_id":"","url":"https://api.github.com/users/eliaslevy","html_url":"https://github.com/eliaslevy","followers_url":"https://api.github.com/users/eliaslevy/followers","following_url":"https://api.github.com/users/eliaslevy/following{/other_user}","gists_url":"https://api.github.com/users/eliaslevy/gists{/gist_id}","starred_url":"https://api.github.com/users/eliaslevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eliaslevy/subscriptions","organizations_url":"https://api.github.com/users/eliaslevy/orgs","repos_url":"https://api.github.com/users/eliaslevy/repos","events_url":"https://api.github.com/users/eliaslevy/events{/privacy}","received_events_url":"https://api.github.com/users/eliaslevy/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":4,"created_at":"2015-10-24T06:43:49Z","updated_at":"2015-10-24T16:11:19Z","closed_at":null,"body":"It appears that pods started by dropping a pod spec into `/etc/kubernetes/manifests` are not associated with the default service account, and don't have `/var/run/secrets/kubernetes.io/serviceaccount/ca.crt` and `/var/run/secrets/kubernetes.io/serviceaccount/token` mounted within their container.  Adding `{spec: {serviceAccount: guest}}` appears to have had no effect on this.\r\n\r\nHow is a pod started via the manifest directory supposed to authenticate with the kubernetes service?"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/150830261","html_url":"https://github.com/kubernetes/kubernetes/issues/16230#issuecomment-150830261","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/16230","id":150830261,"user":{"login":"eliaslevy","id":725218,"avatar_url":"https://avatars.githubusercontent.com/u/725218?v=3","gravatar_id":"","url":"https://api.github.com/users/eliaslevy","html_url":"https://github.com/eliaslevy","followers_url":"https://api.github.com/users/eliaslevy/followers","following_url":"https://api.github.com/users/eliaslevy/following{/other_user}","gists_url":"https://api.github.com/users/eliaslevy/gists{/gist_id}","starred_url":"https://api.github.com/users/eliaslevy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/eliaslevy/subscriptions","organizations_url":"https://api.github.com/users/eliaslevy/orgs","repos_url":"https://api.github.com/users/eliaslevy/repos","events_url":"https://api.github.com/users/eliaslevy/events{/privacy}","received_events_url":"https://api.github.com/users/eliaslevy/received_events","type":"User","site_admin":false},"created_at":"2015-10-24T16:11:19Z","updated_at":"2015-10-24T16:11:19Z","body":"I could do that, but it would defeat the purpose of nodes self-registering their metadata labels without requiring some external process that iterates over the nodes.  If that were the only choice, then I might as well run a script that iterates over the node instances, use the AWS CLI to fetch the instance metadata and use kubectl to update the labels, which saves me the trouble of having to define a container image and placing it on a registry.\r\n\r\nIn any case, I think I can do it by using the kubelet client certificate and mounting it into the container.  I'll test that later today."}}