<p>I have used <code>kubectl create serviceaccount sa1</code> to create service account. Then I used <code>kubectl get serviceaccount sa1 -oyaml</code> command to get service account info. But it returns as below.</p>
<pre><code>apiVersion: v1
kind: ServiceAccount
metadata:
  creationTimestamp: &quot;2022-05-16T08:03:50Z&quot;
  name: sa1
  namespace: default
  resourceVersion: &quot;19651&quot;
  uid: fdddacba-be9d-4e77-a849-95ca243781cc
</code></pre>
<p>I need to get,</p>
<pre><code>secrets:
- name: &lt;secret&gt;
</code></pre>
<p>part. but it doesn't return secrets. How to fix it?</p>

<p>In Kubernetes 1.24, ServiceAccount token secrets are no longer automatically generated.  See <a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#urgent-upgrade-notes" rel="noreferrer">&quot;Urgent Upgrade Notes&quot; in the 1.24 changelog file</a>:</p>
<blockquote>
<p>The <code>LegacyServiceAccountTokenNoAutoGeneration</code> feature gate is beta, and enabled by default. When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount. Use the <a href="https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/" rel="noreferrer">TokenRequest</a> API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this <a href="https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets" rel="noreferrer">guide</a>. (<a href="https://github.com/kubernetes/kubernetes/pull/108309" rel="noreferrer">#108309</a>, <a href="https://github.com/zshihang" rel="noreferrer">@zshihang</a>)</p>
</blockquote>
<p>This means, in Kubernetes 1.24, you need to <a href="https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets" rel="noreferrer">manually create the Secret</a>; the <code>token</code> key in the <code>data</code> field will be automatically set for you.</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Secret
metadata:
  name: sa1-token
  annotations:
    kubernetes.io/service-account.name: sa1
type: kubernetes.io/service-account-token
</code></pre>
<p>Since you're manually creating the Secret, you know its <code>name:</code> and don't need to look it up in the ServiceAccount object.</p>
<p>This approach should work fine in earlier versions of Kubernetes too.</p>
