Kubernetes / Storage, Configuration & Data Protection
Investigate an application that stops working after service-account token rotation
Projected service-account tokens are time-bound and can rotate. A client that reads a token only once may later fail authentication.
Environment and inputs: Kubernetes · kubectl with supported client/server versions and delegated RBAC. Examples use namespace app unless noted. Check context, namespace, APIs and provider support first.
Start with this check
Confirm the environment and replace sample objects, namespaces, images, paths and hosts with approved targets. Share only relevant, sanitized output. Follow the workload owner’s process for changes.
kubectl -n app get pod web-0 -o jsonpath='{.spec.serviceAccountName}{" "}{.spec.volumes}'Read the result
The specification identifies the account and projected token configuration without reading token contents. Audience and expiry behavior must match the client contract.
Resolve and verify
Use a supported client that handles token reload and the intended audience. Compare authentication errors with rotation timing and verify access through the approved API path.
Before changing production
Do not replace rotating tokens with permanent broadly privileged credentials or log bearer tokens.