How to fix Token expired in Kubernetes

# Create a token review to check validity
kubectl create -f - <<EOF
apiVersion: authentication.k8s.io/v1
kind: TokenReview
metadata:
  name: token-check
spec:
  token: <your-token-here>
EOF

# Check response - if authenticated is false, token is expired or invalid
kubectl get tokenreview token-check -o jsonpath='{.status.authenticated}'

# For Azure (AKS)
az aks get-credentials --resource-group <group> --name <cluster>

# For GKE
gcloud container clusters get-credentials <cluster-name> --zone <zone>

# For AWS (EKS)
aws eks update-kubeconfig --name <cluster> --region <region>

# Generate a token valid for 1 hour (3600 seconds)
kubectl create token <service-account-name> -n <namespace> --duration=3600s

# Or longer (max 168 hours / 7 days)
kubectl create token <service-account-name> -n <namespace> --duration=168h

# Script can call TokenRequest API directly for automatic rotation:
curl -X POST https://kubernetes.default/api/v1/namespaces/<ns>/serviceaccounts/<sa>/token \\
  -H "Authorization: Bearer $BEARER_TOKEN" \\
  -d '{"apiVersion":"authentication.k8s.io/v1","kind":"TokenRequest","spec":{"expirationSeconds":3600}}'

apiVersion: v1
kind: Pod
metadata:
  name: my-app
spec:
  serviceAccountName: my-service-account
  containers:
  - name: app
    image: myapp:latest
    volumeMounts:
    - mountPath: /var/run/secrets/tokens
      name: token
      readOnly: true
  volumes:
  - name: token
    projected:
      sources:
      - serviceAccountToken:
          path: token
          expirationSeconds: 3600  # Kubelet auto-rotates 80% through lifespan
          audience: https://kubernetes.default

# Kubernetes v1.24+ does NOT auto-create service account secrets
# Manually create one:
kubectl create secret generic <sa-token-secret> \\
  --from-literal=token=$(kubectl create token <sa-name>) \\
  -n <namespace>

# Or use a manual secret approach (not auto-rotated):
kubectl apply -f - <<EOF
apiVersion: v1
kind: Secret
metadata:
  name: my-sa-secret
  annotations:
    kubernetes.io/service-account.name: my-sa
type: kubernetes.io/service-account-token
EOF

# Backup your kubeconfig first
cp ~/.kube/config ~/.kube/config.backup

# Edit and remove expired token fields
kubectl config unset users.<user-name>.user.auth-provider.config.access-token
kubectl config unset users.<user-name>.user.auth-provider.config.refresh-token

# Or manually edit
vim ~/.kube/config
# Remove the access-token and refresh-token fields

# Next kubectl command will trigger re-auth
kubectl get nodes

# Allow kube-apiserver to extend token lifetime (recovery only)
# Add to kube-apiserver manifests:
sudo vim /etc/kubernetes/manifests/kube-apiserver.yaml

# Add flag:
# - --service-account-extend-token-expiration=true

# Restart apiserver
kubectl delete pod -n kube-system kube-apiserver-$(hostname)

# This grants 1-year tokens temporarily (use for migration only)