<p>I'm just trying to run a simple batch job and getting this error &quot;MountVolume.SetUp failed for volume &quot;kube-api-access-cvwdt&quot; : object &quot;default&quot;/&quot;kube-root-ca.crt&quot; not registered&quot;</p>
<p>Here's my logs when running describe pod on that pod</p>
<pre><code>  Normal   Scheduled    59s                default-scheduler  Successfully assigned default/stock-api to ip-192-168-63-5.us-west-2.compute.internal
  Normal   Pulling      58s                kubelet            Pulling image &quot;mpriv32/stockapi:latest&quot;
  Normal   Pulled       38s                kubelet            Successfully pulled image &quot;mpriv32/stockapi:latest&quot; in 19.862095063s
  Normal   Created      35s                kubelet            Created container stock-api
  Normal   Started      35s                kubelet            Started container stock-api
  Warning  FailedMount  33s (x3 over 34s)  kubelet            MountVolume.SetUp failed for volume &quot;kube-api-access-cvwdt&quot; : object &quot;default&quot;/&quot;kube-root-ca.crt&quot; not registered
</code></pre>
<p>My job.yaml file to create the pod</p>
<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: stock-api
  labels:
    app: stock-api

spec:
  containers:
  - name: stock-api
    image: mpriv32/stock-api:latest
    envFrom:
    - secretRef:
        name: api-credentials
  restartPolicy: Never
</code></pre>
<p>Just in case it makes a difference, I'm trying to run this on EKS</p>

<p>You might be facing a bug on the kubelet that is discussed <a href="https://github.com/kubernetes/kubernetes/issues/105204" rel="noreferrer">here</a> and was fixed in K8s 1.23.6.</p>
<p>Failure should be sporadic, so a simple recreation of your Pod might already fix it. More reliably, you could upgrade K8s or disable <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server" rel="noreferrer">automountServiceAccountToken</a>. This stops the CA in question from being mounted into your Pod. Since the CA is only required, if your Pod needs to talk to the Kube API server, this is a sensible security measure anyway.</p>
