In Section 2 of "RED HAT ENTERPRISE LINUX ATOMIC HOST 7 GETTING STARTED WITH CONTAINERS" (https://access.redhat.com/documentation/en/red-hat-enterprise-linux-atomic-host/version-7/getting-started-with-containers/#get_started_orchestrating_containers_with_kubernetes), there is a step that is missing that will cause an error in the replication controller when creating the "Simple Apache Web Server" and "Simple Database Server" containers.


If following the directions from the docs, the output of kubectl describe replicationcontroller/webserver-controller and kubectl describe replicationcontroller/db-controller will show an error creating the web and db pods (see output below).  

[cloud-user@rhah-0 manifests]$ kubectl describe replicationcontroller/webserver-controller
Name:		webserver-controller
Namespace:	default
Image(s):	webwithdb
Selector:	name=webserver
Labels:		name=webserver,uses=db
Replicas:	0 current / 1 desired
Pods Status:	0 Running / 0 Waiting / 0 Succeeded / 0 Failed
No volumes.
Events:
  FirstSeen	LastSeen	Count	From				SubobjectPath	Reason		Message
  ─────────	────────	─────	────				─────────────	──────		───────
  35m		18m		33	{replication-controller }			FailedCreate	Error creating: Pod "webserver-controller-" is forbidden: no API token found for service account default/default, retry after the token is automatically created and added to the service account
  17m		18s		35	{replication-controller }			FailedCreate	Error creating: Pod "webserver-controller-" is forbidden: no API token found for service account default/default, retry after the token is automatically created and added to the service account



To fix this, "ServiceAccount" must be removed from the KUBE_ADMISSION_CONTROL property in /etc/kubernetes/apiserver.

KUBE_ADMISSION_CONTROL="--admission-control=NamespaceLifecycle,NamespaceExists,LimitRanger,SecurityContextDeny,ResourceQuota"


This step should be added in Section 2.3.2 before or after step 3.


System:
Red Hat Enterprise Linux Atomic Host release 7.2