<p>I'm trying to get Kubernetes running on some local machines running CoreOS. I'm loosely following <a href="http://kubernetes.io/v1.0/docs/getting-started-guides/coreos/coreos_multinode_cluster.html" rel="nofollow">this guide</a>. Everything seems to be up and running, and I'm able to connect to the api via kubectl. However, when I try to create a pod, I get this error: </p>

<pre><code>Pod "redis-master" is forbidden: Missing service account default/default: &lt;nil&gt; 
</code></pre>

<p>Doing <code>kubectl get serviceAccounts</code> confirms that I don't have any ServiceAccounts:</p>

<pre><code>NAME      SECRETS
</code></pre>

<p>According to the <a href="https://github.com/kubernetes/kubernetes/blob/master/docs/user-guide/service-accounts.md#using-multiple-service-accounts" rel="nofollow">documentation</a>, each namespace should have a default ServiceAccount. Running <code>kubectl get namespace</code> confirms that I have the default namespace:</p>

<pre><code>NAME      LABELS    STATUS
default   &lt;none&gt;    Active
</code></pre>

<p>I'm brand new to Kubernetes and CoreOS, so I'm sure there's something I'm overlooking, but I can't for the life of me figure out what's going on. I'd appreciate any pointers.</p>

<p>UPDATE</p>

<p>It appears the kube-controller-manager isn't running. When I try to run it, I get this message:</p>

<pre><code>I1104 21:09:49.262780   26292 plugins.go:69] No cloud provider specified.
I1104 21:09:49.262935   26292 nodecontroller.go:114] Sending events to api server.
E1104 21:09:49.263089   26292 controllermanager.go:217] Failed to start service controller: ServiceController should not be run without a cloudprovider.
W1104 21:09:49.629084   26292 request.go:302] field selector: v1 - secrets - type - kubernetes.io/service-account-token: need to check if this is versioned correctly.
W1104 21:09:49.629322   26292 request.go:302] field selector: v1 - serviceAccounts - metadata.name - default: need to check if this is versioned correctly.
W1104 21:09:49.636082   26292 request.go:302] field selector: v1 - serviceAccounts - metadata.name - default: need to check if this is versioned correctly.
W1104 21:09:49.638712   26292 request.go:302] field selector: v1 - secrets - type - kubernetes.io/service-account-token: need to check if this is versioned correctly.
</code></pre>

<p>Since I'm running this locally, I don't have a cloud provider. I tried to define <code>--cloud-provider=""</code> but it still complains with the same error.</p>

<p>The default service account for each namespace is created by the service account controller, which is a loop that is part of the kube-controller-manager binary.  So, verify that binary is running, and check its logs for anything that suggests it can't create a service account, make sure you set the "--service-account-private-key-file=somefile" to a file that has a valid PEM key.</p>

<p>Alternatively, if you want to make some progress without service accounts, and come back to that later, you can disable the admission controller that is blocking your pods by removing the "ServiceAccount" option from your api-server's <code>--admission-controllers</code> flag.  But you will probably want to come back and fix that later.</p>
