{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22351","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22351/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22351/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22351/events","html_url":"https://github.com/kubernetes/kubernetes/issues/22351","id":137864705,"number":22351,"title":"Can not authenticate with service-account default token","user":{"login":"erimatnor","id":819732,"avatar_url":"https://avatars.githubusercontent.com/u/819732?v=3","gravatar_id":"","url":"https://api.github.com/users/erimatnor","html_url":"https://github.com/erimatnor","followers_url":"https://api.github.com/users/erimatnor/followers","following_url":"https://api.github.com/users/erimatnor/following{/other_user}","gists_url":"https://api.github.com/users/erimatnor/gists{/gist_id}","starred_url":"https://api.github.com/users/erimatnor/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/erimatnor/subscriptions","organizations_url":"https://api.github.com/users/erimatnor/orgs","repos_url":"https://api.github.com/users/erimatnor/repos","events_url":"https://api.github.com/users/erimatnor/events{/privacy}","received_events_url":"https://api.github.com/users/erimatnor/received_events","type":"User","site_admin":false},"labels":[{"id":173493827,"url":"https://api.github.com/repos/kubernetes/kubernetes/labels/team/cluster","name":"team/cluster","color":"d2b48c","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2016-03-02T12:41:39Z","updated_at":"2016-11-16T01:18:09Z","closed_at":null,"body":"I have a pod that uses the default service account token in the pod to speak to the API server. However, sometimes this token cannot be used to authenticate with the API server and the logs give this error:\n\n```\nE0302 12:32:50.114892       7 handlers.go:37] Unable to authenticate the request due to an error: crypto/rsa: verification error\n```\n\nThe same thing happens when manually reading the token from the service account secret with `kubectl` and using the token to `curl` the API server using the token.\n\nIt appears that the token signature is invalid and that the token is either bad or the API server has changed its signing key and not updated the token.\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/260824100","html_url":"https://github.com/kubernetes/kubernetes/issues/22351#issuecomment-260824100","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/22351","id":260824100,"user":{"login":"liggitt","id":980082,"avatar_url":"https://avatars.githubusercontent.com/u/980082?v=3","gravatar_id":"","url":"https://api.github.com/users/liggitt","html_url":"https://github.com/liggitt","followers_url":"https://api.github.com/users/liggitt/followers","following_url":"https://api.github.com/users/liggitt/following{/other_user}","gists_url":"https://api.github.com/users/liggitt/gists{/gist_id}","starred_url":"https://api.github.com/users/liggitt/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/liggitt/subscriptions","organizations_url":"https://api.github.com/users/liggitt/orgs","repos_url":"https://api.github.com/users/liggitt/repos","events_url":"https://api.github.com/users/liggitt/events{/privacy}","received_events_url":"https://api.github.com/users/liggitt/received_events","type":"User","site_admin":false},"created_at":"2016-11-16T01:18:09Z","updated_at":"2016-11-16T01:18:09Z","body":"The service account public key has to be the same for all. In an HA setup that means you need to explicitly give it to each apiserver (recommended) or make all the apiservers use the same serving cert/private TLS key (not recommended)"}}
{"actor":{"display_login":"liggitt"}}