Spring Boot Admin 401 Error: Kubernetes Discovery Call Missing Service Token

Below is an explanation and a recommended solution to force Kubernetes discovery to use your mounted token.

Explanation

When running in a Kubernetes cluster, the client libraries normally read the service account token from the well-known file location (/var/run/secrets/kubernetes.io/serviceaccount/token). In your case, running the curl command inside the pod explicitly reads the token and passes it in the header, which works as expected. However, when using the Spring Cloud Kubernetes discovery client with your custom discovery-server-url, the client isn’t automatically merging in the token for authentication.

This behavior can occur because by specifying the discovery-server-url, the in-cluster auto-configuration that would otherwise pick up the token might be bypassed. The discovery client then makes REST calls without setting the Authorization header, leading to a 401 UNAUTHORIZED response.

Recommended Solution

To resolve the issue, you can explicitly configure the discovery client to use the service account token by pointing it to the token file. In Spring Cloud Kubernetes, this is commonly done by setting a property (often under the client configuration) to the path of the token file.

For example, add the following to your configuration:

YAMLCopied
spring:
  cloud:
    kubernetes:
      client:
        service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token

With this property set, the discovery client should read the token from the designated file and include it in the Authorization header (as a Bearer token) for your API calls.

Additional Considerations

• RBAC Permissions: Ensure that the service account your pod uses has the necessary Role and RoleBinding configurations to access the Kubernetes API.
• Environment Verification: If your application runs inside the cluster, confirm that the token is indeed mounted at /var/run/secrets/kubernetes.io/serviceaccount/token.
• Property Precedence: Verify that this configuration isn’t being overridden by other settings in your Spring configuration files.

This explicit configuration forces the discovery client to use the token for authentication, which should resolve your 401 error when accessing the Kubernetes API.

If you continue to experience issues, check the logs for any configuration warnings or errors related to the Kubernetes client setup and validate that the file exists and is accessible by your application.

Feel free to ask for any further clarification on Kubernetes API authentication or related topics.