kubernetes.io/pod/name claim is missing from Kubernetes toke

Error message

kubernetes.io/pod/name claim is missing from Kubernetes token

What it means

Error "kubernetes.io/pod/name claim is missing from Kubernetes token" thrown in dapr/dapr.

Source

Thrown at pkg/sentry/server/validator/kubernetes/kubernetes.go:51

	"sigs.k8s.io/controller-runtime/pkg/cache"
	"sigs.k8s.io/controller-runtime/pkg/client"

	configv1alpha1 "github.com/dapr/dapr/pkg/apis/configuration/v1alpha1"
	"github.com/dapr/dapr/pkg/healthz"
	"github.com/dapr/dapr/pkg/injector/annotations"
	injectorConsts "github.com/dapr/dapr/pkg/injector/consts"
	sentryv1pb "github.com/dapr/dapr/pkg/proto/sentry/v1"
	"github.com/dapr/dapr/pkg/security/consts"
	"github.com/dapr/dapr/pkg/sentry/server/images"
	"github.com/dapr/dapr/pkg/sentry/server/validator"
	"github.com/dapr/dapr/pkg/sentry/server/validator/internal"
	"github.com/dapr/kit/logger"
)

var (
	log = logger.NewLogger("dapr.sentry.identity.kubernetes")

	errMissingPodClaim = errors.New("kubernetes.io/pod/name claim is missing from Kubernetes token")
)

const (
	// TODO: @joshvanl: Before 1.12, dapr would use this generic audience. After
	// 1.13, clients use the sentry SPIFFE ID as the audience. Remove this
	// constant in 1.14.
	LegacyServiceAccountAudience = "dapr.io/sentry"
)

type Options struct {
	RestConfig     *rest.Config
	SentryID       spiffeid.ID
	ControlPlaneNS string
	Healthz        healthz.Healthz
}

// kubernetes implements the validator.Interface. It validates the request by
// doing a Kubernetes token review.

View on GitHub (pinned to 74ad417027)

When it happens

Trigger: Thrown at pkg/sentry/server/validator/kubernetes/kubernetes.go:51 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of dapr/dapr@74ad417027 (2026-08-16). Data as JSON: /api/errors/29ef1f05766ea358. Report an issue: GitHub.