due to https://issues.redhat.com/browse/API-1644, no token was generate for sa automatically, it is needed to add one step to create the token manually. 

After creating a new service account, one step should be added to create a long-lived API token

    always

secret yaml file exmaple:

xzha@xzha1-mac OCP-24771 % cat secret.yaml 
apiVersion: v1
kind: Secret
metadata:
  name: scoped
  annotations:
    kubernetes.io/service-account.name: scoped
type: kubernetes.io/service-account-token