<p>I’ve a config map which I need to read from K8S via api </p>

<p>I Created a cluster role</p>

<pre><code>kind: ClusterRole
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: zrole
rules:
- apiGroups: [""]
  resources: ["configmaps"]
  verbs: ["get", "list"]
</code></pre>

<p>and cluster role binding</p>

<pre><code>kind: ClusterRoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: z-role-binding
subjects:
- kind: Group
  name: system:serviceaccounts
  apiGroup: rbac.authorization.k8s.io
roleRef:
  kind: ClusterRole
  name: zrole

</code></pre>

<p>Config Map</p>

<pre><code>apiVersion: v1
kind: ConfigMap
metadata:
  name: z-config
  namespace: fdrs
data:
  avr: client1
  fuss: xurbz

</code></pre>

<p>The <a href="https://github.com/kubernetes/client-go/blob/master/kubernetes/typed/core/v1/configmap.go" rel="nofollow noreferrer">code</a> is used like</p>

<p>clientSet.CoreV1().ConfigMaps(uNamespcae)</p>

<p>when I run the code locally (and provide to the the GO api the kubeconfig) I was able to get the config map data,
However when I run the code inside the cluster I got error: <code>invalid token</code> , any idea what am I missing here? </p>

<p>Check <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.11/#pod-v1-core" rel="nofollow noreferrer"><code>automountServiceAccountToken</code></a> in the pod spec. By default it's set to <code>true</code>, but maybe you have it disabled.</p>

<p>Use the official GO client. It reads the correct configuration and tokens by default. <a href="https://github.com/kubernetes/client-go/blob/master/examples/in-cluster-client-configuration/main.go" rel="nofollow noreferrer">https://github.com/kubernetes/client-go/blob/master/examples/in-cluster-client-configuration/main.go</a></p>

<p>If you don't use it, then use the correct configuration:
<a href="https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#directly-accessing-the-rest-api-1" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/administer-cluster/access-cluster-api/#directly-accessing-the-rest-api-1</a></p>

<p>Check the token in the pod: <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code> and use the <code>kubernetes</code> service.</p>
