<p>I have Kubernetes version 1.24.3, and I created a new service account named &quot;deployer&quot;, but when I checked it, it shows it doesn't have any secrets.</p>
<p>This is how I created the service account:</p>
<pre><code>kubectl apply -f - &lt;&lt; EOF
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: deployer
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: deployer-role
rules:
- apiGroups: [&quot;&quot;, &quot;extensions&quot;, &quot;apps&quot;]
  resources:
  - deployments
  verbs: [&quot;list&quot;, &quot;get&quot;, &quot;describe&quot;, &quot;apply&quot;, &quot;delete&quot;, &quot;patch&quot;]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: deployer-crb
  namespace: default
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: deployer-role
subjects:
- kind: ServiceAccount
  name: deployer
  namespace: default
---
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token
metadata:
  name: token-secret
  annotations:
    kubernetes.io/service-account.name: deployer
EOF

</code></pre>
<p>When I checked it, it shows that it doesn't have secrets:</p>
<pre><code>cyber@manager1:~$ kubectl get sa deployer
NAME       SECRETS   AGE
deployer   0         4m32s

cyber@manager1:~$ kubectl get sa deployer -o yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;v1&quot;,&quot;kind&quot;:&quot;ServiceAccount&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{},&quot;name&quot;:&quot;deployer&quot;,&quot;namespace&quot;:&quot;default&quot;}}
  creationTimestamp: &quot;2022-10-13T08:36:54Z&quot;
  name: deployer
  namespace: default
  resourceVersion: &quot;2129964&quot;
  uid: cd2bf19f-92b2-4830-8b5a-879914a18af5

</code></pre>
<p>And this is the secret that should be associated to the above service account:</p>
<pre><code>cyber@manager1:~$ kubectl get secrets token-secret -o yaml
apiVersion: v1
data:
  ca.crt: &lt;REDACTED&gt;
  namespace: ZGVmYXVsdA==
  token: &lt;REDACTED&gt;
kind: Secret
metadata:
  annotations:
    kubectl.kubernetes.io/last-applied-configuration: |
      {&quot;apiVersion&quot;:&quot;v1&quot;,&quot;kind&quot;:&quot;Secret&quot;,&quot;metadata&quot;:{&quot;annotations&quot;:{&quot;kubernetes.io/service-account.name&quot;:&quot;deployer&quot;},&quot;name&quot;:&quot;token-secret&quot;,&quot;namespace&quot;:&quot;default&quot;},&quot;type&quot;:&quot;kubernetes.io/service-account-token&quot;}
    kubernetes.io/service-account.name: deployer
    kubernetes.io/service-account.uid: cd2bf19f-92b2-4830-8b5a-879914a18af5
  creationTimestamp: &quot;2022-10-13T08:36:54Z&quot;
  name: token-secret
  namespace: default
  resourceVersion: &quot;2129968&quot;
  uid: d960c933-5e7b-4750-865d-e843f52f1b48
type: kubernetes.io/service-account-token

</code></pre>
<p>What can be the reason?</p>
<p><strong>Update:</strong>
The answer help, but for the protocol, it doesn't matter, the token works even it shows 0 secrets:</p>
<pre><code>kubectl get pods --token `cat ./token` -s https://192.168.49.2:8443 --certificate-authority /home/cyber/.minikube/ca.crt --all-namespaces
</code></pre>
<p><strong>Other Details:</strong><br />
I am working on Kubernetes version 1.24:</p>
<pre><code>cyber@manager1:~$ kubectl version
WARNING: This version information is deprecated and will be replaced with the output from kubectl version --short.  Use --output=yaml|json to get the full version.
Client Version: version.Info{Major:&quot;1&quot;, Minor:&quot;25&quot;, GitVersion:&quot;v1.25.0&quot;, GitCommit:&quot;a866cbe2e5bbaa01cfd5e969aa3e033f3282a8a2&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2022-08-23T17:44:59Z&quot;, GoVersion:&quot;go1.19&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
Kustomize Version: v4.5.7
Server Version: version.Info{Major:&quot;1&quot;, Minor:&quot;24&quot;, GitVersion:&quot;v1.24.3&quot;, GitCommit:&quot;aef86a93758dc3cb2c658dd9657ab4ad4afc21cb&quot;, GitTreeState:&quot;clean&quot;, BuildDate:&quot;2022-07-13T14:23:26Z&quot;, GoVersion:&quot;go1.18.3&quot;, Compiler:&quot;gc&quot;, Platform:&quot;linux/amd64&quot;}
</code></pre>
<p>You can delete it by running:</p>
<pre><code>kubectl delete clusterroles deployer-role
kubectl delete clusterrolebindings deployer-crb 
kubectl delete sa deployer  
kubectl delete secrets token-secret
</code></pre>
<p>Reference to Kubernetes 1.24 changes:</p>
<ul>
<li><a href="https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.24.md#no-really-you-must-read-this-before-you-upgrade" rel="nofollow noreferrer">Change log 1.24</a></li>
<li><a href="https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod" rel="nofollow noreferrer">Creating secret through the documentation</a></li>
</ul>

<p>Base on the change log, the auto-generation of tokens is no longer available for every service account.</p>
<blockquote>
<p>The LegacyServiceAccountTokenNoAutoGeneration feature gate is beta, and enabled by default. <strong>When enabled, Secret API objects containing service account tokens are no longer auto-generated for every ServiceAccount</strong>. Use the TokenRequest API to acquire service account tokens, or if a non-expiring token is required, create a Secret API object for the token controller to populate with a service account token by following this guide.</p>
</blockquote>
<p><a href="https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/" rel="nofollow noreferrer">token-request-v1</a></p>
<p><a href="https://github.com/kubernetes/kubernetes/pull/108309" rel="nofollow noreferrer">stops auto-generation of legacy tokens because they are less secure</a></p>
<p><a href="https://github.com/argoproj/argo-workflows/issues/8320#issuecomment-1271354662" rel="nofollow noreferrer">work-around</a></p>
<p>or you can use</p>
<pre><code>kubectl create token SERVICE_ACCOUNT_NAME
kubectl create token deployer
</code></pre>
<p><a href="https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#-em-token-em-" rel="nofollow noreferrer">Request a service account token.</a></p>
