Kubernetes Projected ServiceAccount Token Mount Failed in CI

A projected volume with a serviceAccountToken source asks the kubelet to request a bound token for the pod’s ServiceAccount. If that ServiceAccount is missing, or the requested audience/expirationSeconds is invalid, the mount fails and the pod stays in ContainerCreating.

What this error means

A pod is stuck in ContainerCreating with a FailedMount event referencing the projected token volume and a token-fetch error. It is deterministic given the same SA/audience configuration.

kubectl describe pod

Warning  FailedMount  kubelet  MountVolume.SetUp failed for volume "token":
failed to fetch token: serviceaccounts "api" not found

Common causes

The referenced ServiceAccount does not exist

The pod runs as a ServiceAccount that was never created in its namespace, so the kubelet cannot mint a token for the projected volume.

Invalid audience or expirationSeconds

A requested audience the API server is not configured to issue, or an expirationSeconds below the cluster minimum, makes the token request fail.

How to fix it

Create the ServiceAccount and reference it

Terminal / pod.yaml

kubectl -n <ns> create serviceaccount api
# pod spec
spec:
  serviceAccountName: api

Use a valid projected token source

Set an audience the cluster issues and an expiration at/above the cluster minimum (commonly 600s).

pod.yaml

volumes:
  - name: token
    projected:
      sources:
        - serviceAccountToken:
            path: token
            audience: vault     # must be an accepted audience
            expirationSeconds: 3600

How to prevent it

Create the ServiceAccount before any pod that projects its token.
Use audiences the API server is configured to issue.
Keep expirationSeconds at or above the cluster minimum.