<p>I am trying to project the serviceAccount token into my pod as described in this k8s doc - <a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#service-account-token-volume-projection</a>.</p>

<p>I create a service account using below command</p>

<pre><code>kubectl create sa acct
</code></pre>

<p>Then I create the pod</p>

<pre><code>kind: Pod
apiVersion: v1
metadata:
  name: nginx
spec:
  containers:
  - image: nginx
    name: nginx
    volumeMounts:
    - mountPath: /var/run/secrets/tokens
      name: vault-token
  serviceAccountName: acct
  volumes:
  - name: vault-token
    projected:
      sources:
      - serviceAccountToken:
          path: vault-token
          expirationSeconds: 7200
</code></pre>

<p>It fails due to - <code>MountVolume.SetUp failed for volume "vault-token" : failed to fetch token: the server could not find the requested resource</code></p>

<pre><code>Events:
  Type     Reason       Age                   From               Message
  ----     ------       ----                  ----               -------
  Normal   Scheduled    5m15s                 default-scheduler  Successfully assigned default/nginx to minikube
  Warning  FailedMount  65s (x10 over 5m15s)  kubelet, minikube  MountVolume.SetUp failed for volume "vault-token" : failed to fetch token: the server could not find the requested resource
</code></pre>

<p>My minikube version: v0.33.1</p>

<p>kubectl version : 1.13</p>

<p><strong>Question:</strong></p>

<ul>
<li>What am i doing wrong here?</li>
</ul>

<p>I tried this on kubeadm, and was able to suceed. 
@Aman Juneja was right, you have to add the API flags as described in the documentation. </p>

<p>You can do that by creating the serviceaccount and then adding this flags to the kubeapi:</p>

<p><code>sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml</code></p>

<pre><code>- --service-account-issuer=api
- --service-account-signing-key-file=/etc/kubernetes/pki/apiserver.key
- --service-account-api-audiences=api
</code></pre>

<p>After that apply your pod.yaml and it will work. As you will see in describe pod:</p>

<pre><code>Volumes:
  vault-token:
    Type:                    Projected (a volume that contains injected data from multiple sources)
</code></pre>

<p>[removed as not working solution]</p>

<p>unfortunately in my case my minikube did not want to start with this flags, it gets stuck on: <code>waiting for pods: apiserver</code> soon I will try to debug again.</p>

<p><strong>UPDATE</strong></p>

<p>Turns out you have to just pass the arguments into the minikube with directories from the inside of minikubeVM and not the outside as I did with previous example (so the .minikube directory), so it will look like this:</p>

<pre><code>minikube start \
 --extra-config=apiserver.service-account-signing-key-file=/var/lib/minikube/certs/apiserver.key \
  --extra-config=apiserver.service-account-issuer=api \
  --extra-config=apiserver.service-account-api-audiences=api 
</code></pre>

<p>After that creating ServiceAccount and applying pod.yaml works. </p>
