<p>I have a problem with my Kubernetes cluster where my kube-scheduler pod is stuck in the 'CrashLoopBackOff' state and I am unable to rectify it. the logs are complaining of a missing service token:</p>

<pre><code>kubectl logs kube-scheduler-master -n kube-system
I1011 09:01:04.309289       1 serving.go:319] Generated self-signed cert in-memory
W1011 09:01:20.579733       1 authentication.go:387] failed to read in-cluster kubeconfig for delegated authentication: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
W1011 09:01:20.579889       1 authentication.go:249] No authentication-kubeconfig provided in order to lookup client-ca-file in configmap/extension-apiserver-authentication in kube-system, so client certificate authentication won't work.
W1011 09:01:20.579917       1 authentication.go:252] No authentication-kubeconfig provided in order to lookup requestheader-client-ca-file in configmap/extension-apiserver-authentication in kube-system, so request-header client certificate authentication won't work.
W1011 09:01:20.579990       1 authorization.go:177] failed to read in-cluster kubeconfig for delegated authorization: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
W1011 09:01:20.580040       1 authorization.go:146] No authorization-kubeconfig provided, so SubjectAccessReview of authorization tokens won't work.
invalid configuration: no configuration has been provided
</code></pre>

<p>Can anyone please explain what <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code> is, where is it supposed to be stored (is the path on the host or within the container) and how do I go about regenerating it?</p>

<p>I'm running version 1.15.4 across all of my nodes which were set up using <code>kubeadm</code>. I have <em>stupidly</em> upgrade the cluster since this error first started (I read that it could possibly be a bug in the version I was using). I was previously using version 1.14.*.</p>

<p>Any help would be greatly appreciated; everything runs on this cluster and I feel like my arms have been cut off with out it.</p>

<p>Thanks in advance,</p>

<p>Harry</p>

<p>By default <code>/var/run/secrets/kubernetes.io/serviceaccount/token</code> is mounted in every pod and contains the authentication token to access your Kubernetes API server.</p>

<p>You can disable mounting it by specifying <code>automountServiceAccountToken: false</code> in your deployment configuration. Some tools like <code>terraform</code> with Kubernetes provisioner disable mounting the token by default as well. On <code>terraform</code> this can be reenabled by adding <code>automount_service_account_token = true</code> to the deployment spec.</p>
