can't create kind: TokenRequest declaratively v1.31.1+rke2r1

[ktzsolt]

Environmental Info:
RKE2 Version:

rke2 version v1.31.1+rke2r1 (909d20d)
go version go1.22.6 X:boringcrypto

Node(s) CPU architecture, OS, and Version:

x86_64, Ubuntu 20.04

Cluster Configuration:

3 master, 7 worker
installed with lablabs ansible role https://github.com/lablabs/ansible-role-rke2
I also have these api server args for kubectl oidc-login plugin (it works fine, I just mention this maybe this is related)

--oidc-client-id=
--oidc-groups-claim=
--oidc-groups-prefix=
--oidc-issuer-url=
--oidc-username-claim=
--oidc-username-prefix=

Describe the bug:

I try to create the following with kubectl apply

apiVersion: authentication.k8s.io/v1
kind: TokenRequest
metadata:
  name: my-token
spec:
  audiences:
  - https://kubernetes.default.svc.cluster.local
  expirationSeconds: 60 

I get the following error:

error: resource mapping not found for name: "my-token" namespace: "" from "my-token.yaml": no matches for kind "TokenRequest" in version "authentication.k8s.io/v1"
ensure CRDs are installed first

Steps To Reproduce:

• Installed RKE2: v1.31.1+rke2r1

Expected behavior:

Documentation says that TokenRequest is in v1.22 and later version of k8s: https://kubernetes.io/docs/concepts/security/service-accounts/#assign-to-pod

In v1.22 and later, Kubernetes gets a short-lived, automatically rotating token using the TokenRequest API and mounts the token as a [projected volume](https://kubernetes.io/docs/concepts/storage/projected-volumes/#serviceaccounttoken).

Actual behavior:

error message: no matches for kind "TokenRequest" in version "authentication.k8s.io/v1"

Additional context / logs:

$ kubectl api-resources | grep authentication
selfsubjectreviews                                      authentication.k8s.io/v1                    false        SelfSubjectReview
tokenreviews                                            authentication.k8s.io/v1                    false        TokenReview

[brandond]

This is not an RKE2 issue. The TokenRequest API does not have a separate api resource that you can create via kubectl or view in the api resource list. As you can see from the api docs, it is exposed as a subresource of the ServiceAccount API:
https://kubernetes.io/docs/reference/kubernetes-api/authentication-resources/token-request-v1/#Operations

POST /api/v1/namespaces/{namespace}/serviceaccounts/{name}/token

You need to post your request to that endpoint targeting a specific ServiceAccount, you can't just kubectl create it.

In the future, questions about use of core Kubernetes APIs are probably better directed to the upstream project.

[ktzsolt]

Thanks for the reply, it all makes sense for me now. I was a bit confused about this topic and thought that my rke2 installation somehow missed some apis/crds.