<p>I am using golang lib <a href="https://github.com/kubernetes/client-go" rel="noreferrer">client-go</a> to connect to a running local kubrenets. To start with I took code from the example: <a href="https://github.com/kubernetes/client-go/tree/master/examples/out-of-cluster-client-configuration" rel="noreferrer">out-of-cluster-client-configuration</a>.</p>

<p>Running a code like this:
<code>$ KUBERNETES_SERVICE_HOST=localhost KUBERNETES_SERVICE_PORT=6443 go run ./main.go</code> results in following error:</p>

<pre><code>panic: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory

goroutine 1 [running]:

/var/run/secrets/kubernetes.io/serviceaccount/
</code></pre>

<p>I am not quite sure which part of configuration I am missing. I've researched following links :</p>

<ul>
<li><p><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/authentication/#client-go-credential-plugins</a></p></li>
<li><p><a href="https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/" rel="noreferrer">https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/</a></p></li>
</ul>

<p>But with no luck.
I guess I need to either let the client-go know which token/serviceAccount to use, or configure kubectl in a way that everyone can connect to its api.</p>

<p>Here's status of my kubectl though some commands results:</p>

<p><strong>$ kubectl config view</strong></p>

<pre><code>apiVersion: v1
clusters:
- cluster:
    insecure-skip-tls-verify: true
    server: https://localhost:6443
  name: docker-for-desktop-cluster
contexts:
- context:
    cluster: docker-for-desktop-cluster
    user: docker-for-desktop
  name: docker-for-desktop
current-context: docker-for-desktop
kind: Config
preferences: {}
users:
- name: docker-for-desktop
  user:
    client-certificate-data: REDACTED
    client-key-data: REDACTED
</code></pre>

<p><strong>$ kubectl get serviceAccounts</strong></p>

<pre><code>NAME        SECRETS   AGE
default     1         3d
test-user   1         1d
</code></pre>

<p><strong>$ kubectl describe serviceaccount test-user</strong></p>

<pre><code>Name:                test-user
Namespace:           default
Labels:              &lt;none&gt;
Annotations:         &lt;none&gt;
Image pull secrets:  &lt;none&gt;
Mountable secrets:   test-user-token-hxcsk
Tokens:              test-user-token-hxcsk
Events:              &lt;none&gt;
</code></pre>

<p><strong>$ kubectl get secret test-user-token-hxcsk -o yaml</strong></p>

<pre><code>apiVersion: v1
data:
  ca.crt: LS0tLS1CRUdJTiBDRVJUSUZJQ0......=
  namespace: ZGVmYXVsdA==
  token: ZXlKaGJHY2lPaUpTVXpJMU5pSX......=
kind: Secret
metadata:
  annotations:
    kubernetes.io/service-account.name: test-user
    kubernetes.io/service-account.uid: 984b359a-6bd3-11e8-8600-XXXXXXX
  creationTimestamp: 2018-06-09T10:55:17Z
  name: test-user-token-hxcsk
  namespace: default
  resourceVersion: "110618"
  selfLink: /api/v1/namespaces/default/secrets/test-user-token-hxcsk
  uid: 98550de5-6bd3-11e8-8600-XXXXXX
type: kubernetes.io/service-account-token
</code></pre>

shershen
<p>This answer could be a little outdated but I will try to give more perspective/baseline for future readers that encounter the same/similar problem.</p>
<p><strong>TL;DR</strong></p>
<p>The following error:</p>
<pre class="lang-golang prettyprint-override"><code>panic: open /var/run/secrets/kubernetes.io/serviceaccount/token: no such file or directory
</code></pre>
<p>is most likely connected with the lack of <code>token</code> in the <code>/var/run/secrets/kubernetes.io/serviceaccount</code> location when using <strong><code>in-cluster-client-configuration</code></strong>. Also, it could be related to the fact of using <strong><code>in-cluster-client-configuration</code></strong> code outside of the cluster (for example running this code directly on a laptop or in pure Docker container).</p>
<p>You can check following commands to troubleshoot your issue further (assuming this code is running inside a <code>Pod</code>):</p>
<ul>
<li><code>$ kubectl get serviceaccount X -o yaml</code>:
<ul>
<li>look for: <code>automountServiceAccountToken: false</code></li>
</ul>
</li>
<li><code>$ kubectl describe pod XYZ</code>
<ul>
<li>look for: <code>containers.mounts</code> and <code>volumeMounts</code> where <code>Secret</code> is mounted</li>
</ul>
</li>
</ul>
<p>Citing the official documentation:</p>
<blockquote>
<h3>Authenticating inside the cluster</h3>
<p>This example shows you how to configure a client with client-go to authenticate to the Kubernetes API from an application running <strong>inside the Kubernetes cluster.</strong></p>
<p>client-go uses the <a href="https://kubernetes.io/docs/admin/authentication/#service-account-tokens" rel="nofollow noreferrer">Service Account token</a> <strong>mounted inside the Pod</strong> at the <code>/var/run/secrets/kubernetes.io/serviceaccount</code> path when the <code>rest.InClusterConfig()</code> is used.</p>
<p>-- <em><a href="https://github.com/kubernetes/client-go/tree/master/examples/in-cluster-client-configuration#authenticating-inside-the-cluster" rel="nofollow noreferrer">Github.com: Kubernetes: client-go: Examples: in cluster client configuration</a></em></p>
</blockquote>
<p>If you are authenticating to the Kubernetes API with <code>~/.kube/config</code> you should be using the <strong><code>out-of-cluster-client-configuration</code></strong>.</p>
<hr />
<h3>Additional information:</h3>
<p>I've added additional information for more reference on further troubleshooting when the code is run inside of a <code>Pod</code>.</p>
<ul>
<li><code>automountServiceAccountToken: false</code></li>
</ul>
<blockquote>
<p>In version 1.6+, you can opt out of automounting API credentials for a service account by setting automountServiceAccountToken: false on the service account:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: ServiceAccount
metadata:
  name: go-serviceaccount
automountServiceAccountToken: false
</code></pre>
<p>In version 1.6+, you can also opt out of automounting API credentials for a particular pod:</p>
<pre class="lang-yaml prettyprint-override"><code>apiVersion: v1
kind: Pod
metadata:
  name: sdk
spec:
 serviceAccountName: go-serviceaccount
 automountServiceAccountToken: false
</code></pre>
<p>-- <em><a href="https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/#use-the-default-service-account-to-access-the-api-server" rel="nofollow noreferrer">Kubernetes.io: Docs: Tasks: Configure pod container: Configure service account</a></em></p>
</blockquote>
<ul>
<li><code>$ kubectl describe pod XYZ</code>:</li>
</ul>
<p>When the <code>servicAccount</code> token is mounted, the <code>Pod</code> definition should look like this:</p>
<pre><code>&lt;-- OMITTED --&gt; 
    Mounts:
      /var/run/secrets/kubernetes.io/serviceaccount from go-serviceaccount-token-4rst8 (ro)
&lt;-- OMITTED --&gt; 
Volumes:
  go-serviceaccount-token-4rst8:
    Type:        Secret (a volume populated by a Secret)
    SecretName:  go-serviceaccount-token-4rst8
    Optional:    false
</code></pre>
<p>If it's not:</p>
<pre><code>&lt;-- OMITTED --&gt; 
    Mounts:         &lt;none&gt;
&lt;-- OMITTED --&gt; 
Volumes:            &lt;none&gt;
</code></pre>
<hr />
<p>Additional resources:</p>
<ul>
<li><em><a href="https://kubernetes.io/docs/reference/access-authn-authz/authentication/" rel="nofollow noreferrer">Kubernetes.io: Docs: Reference: Access authn authz: Authentication</a></em></li>
</ul>
