<h3>TL;DR:</h3>

<p>Kubernetes pods created via terraform don't have a <code>/var/run/secrets</code> folder, but a pod created according to the <code>hello-minikube</code> tutorial does - <em>why is that, and how can I fix it</em>?</p>

<p>Motivation: I need traefik to be able to talk to the k8s cluster.</p>

<h3>Details</h3>

<p>I have set up a local Kubernetes cluster w/ minikube and set up terraform to work with that cluster.</p>

<p>To set up traefik, you need to create an <code>Ingress</code> and a <code>Deployment</code> which are <a href="https://github.com/terraform-providers/terraform-provider-kubernetes/issues/3" rel="noreferrer">not yet supported by terraform</a>. Based on the workaround posted in that issue, I use an even simpler module to execute yaml files via terraform:</p>

<pre><code># A tf-module that can create Kubernetes resources from YAML file descriptions.
variable "name" {}
variable "file_name" { }
resource "null_resource" "kubernetes_resource" {
  triggers {
    configuration = "${var.file_name}"
  }
  provisioner "local-exec" {
    command = "kubectl apply -f ${var.file_name}"
  }
}
</code></pre>

<p>The resources created in this way show up correctly in the k8s dashboard.</p>

<p>However, the ingress controller's pod logs:</p>

<pre><code>time="2017-12-30T13:49:10Z" 
level=error 
msg="Error starting provider *kubernetes.Provider: failed to create in-cluster
    configuration: open /var/run/secrets/kubernetes.io/serviceaccount/token:
    no such file or directory" 
</code></pre>

<p><em>(line breaks added for readability)</em></p>

<p><code>/bin/bash</code>ing into the pods, I realize <strong>none of them</strong> have a path <code>/var/run/secrets</code>, except for the <code>hello-minikube</code> pod from the <a href="https://github.com/kubernetes/minikube" rel="noreferrer">minikube tutorial</a>, which was created with just two <code>kubectl</code> commands:</p>

<pre><code>$ kubectl run hello-minikube --image=k8s.gcr.io/echoserver:1.4 --port=8080
$ kubectl expose deployment hello-minikube --type=NodePort
</code></pre>

<p>Compared to the script in the terraform issue, I removed <code>kubectl</code> params like <code>--certificate-authority=${var.cluster_ca_certificate}</code>, but then again, I didn't provide this when setting up <code>hello-minikube</code> either, and the original script doesn't work as-is, since I couldn't figure out how to access the provider details from <code>~/.kube/config</code> in terraform.</p>

<p>I tried to find out if <code>hello-minikube</code> is doing something fancy, but I couldn't find its source code.</p>

<p>Do I have to do something specific to make the token available? According to <a href="https://github.com/containous/traefik/issues/611" rel="noreferrer">traefic issue 611</a>, the InCluster-configuration should be automated, but as it currently stands I'm stuck.</p>

<h3>Versions</h3>

<p>Host system is a Windows 10 machine</p>

<pre><code>&gt; minikube version
minikube version: v0.24.1

&gt; kubectl version
Client Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.0", GitCommit:"925c127ec6b946659ad0fd596fa959be43f0cc05", GitTreeState:"clean", BuildDate:"2017-12-15T21:07:38Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"windows/amd64"}
Server Version: version.Info{Major:"1", Minor:"8", GitVersion:"v1.8.0", GitCommit:"0b9efaeb34a2fc51ff8e4d34ad9bc6375459c4a4", GitTreeState:"clean", BuildDate:"2017-11-29T22:43:34Z", GoVersion:"go1.9.1", Compiler:"gc", Platform:"linux/amd64"}
</code></pre>

<h3>Related</h3>

<p>There are some related questions and github issues, but they didn't help me fix the problem yet either.</p>

<ul>
<li><a href="https://stackoverflow.com/questions/30690186/how-do-i-access-the-kubernetes-api-from-within-a-pod-container">How do I access the Kubernetes api from within a pod container?</a></li>
<li><p><a href="https://stackoverflow.com/questions/47721646/why-would-var-run-secrets-kubernetes-io-serviceaccount-token-be-an-empty-file-i">Why would /var/run/secrets/kubernetes.io/serviceaccount/token be an empty file in a Pod?</a></p></li>
<li><p><a href="https://github.com/datawire/telepresence/issues/353" rel="noreferrer">https://github.com/datawire/telepresence/issues/353</a></p></li>
<li><a href="https://github.com/openshift/origin/issues/13865" rel="noreferrer">https://github.com/openshift/origin/issues/13865</a></li>
</ul>

<p>Foremost, thank you for an <strong>amazing</strong> question write up; I would use this question as a template for how others should ask!</p>

<p>Can you check the <code>automountServiceAccountToken</code> field in the <code>PodSpec</code> and see if it is <code>true</code>?</p>

<p>The only other constructive question I know is whether its <code>serviceAccountName</code> points to an existing S.A.; I would hope a bogus one would bomb the deploy, but don't know for sure what will happen in that case</p>
