Anyone else seeing Calico's ServiceAccoun token expire and breaking spawning containers with

"plugin type="calico" failed (add): error getting ClusterInformation: connection is unauthorized: Unauthorized"

since upgrading to

v1.24.6+rke2r1

from a 1.23 release? I assume it's something to do with the change to service account configs in 1.24 with

LegacyServiceAccountTokenNoAutoGeneration

going to enabled by default?

no… did calico itself get upgraded properly? Are you using the packaged Calico or have you deployed it on your own?

We're using packaged calico. From what I can tell it upgraded right, it's young enough and the image version matches what the release notes for 1.24.6 say. The token in /etc/cni/net.d/calico-kubeconfig is expired, I do not know if a) that expect, or B) actually causing the issue

Do you have a link to it? That will help us 😉

Hey @little-actor-95014 I see that one of our engineers is working the case with you. I will get @bland-account-99790 and @creamy-pencil-82913 the information behind the scenes and ensure the context is consistent

We have a fix to the problem: https://github.com/rancher/rke2-charts/pull/291