Fix: serviceAccountToken volume error in sidecarset (openkruise#1238)

Signed-off-by: ricky <yricky509@gmail.com>
kevin1689-cloud · Apr 1, 2023 · 3b89002 · 3b89002
1 parent f7d5c0a
commit 3b89002
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 5 deletions.
diff --git a/pkg/webhook/sidecarset/validating/sidecarset_create_update_handler.go b/pkg/webhook/sidecarset/validating/sidecarset_create_update_handler.go
@@ -278,11 +278,12 @@ func validateContainersForSidecarSet(
 	fakePod = &core.Pod{
 		ObjectMeta: metav1.ObjectMeta{Name: "test", Namespace: "default"},
 		Spec: core.PodSpec{
-			DNSPolicy:      core.DNSClusterFirst,
-			RestartPolicy:  core.RestartPolicyAlways,
-			InitContainers: coreInitContainers,
-			Containers:     coreContainers,
-			Volumes:        coreVolumes,
+			DNSPolicy:          core.DNSClusterFirst,
+			RestartPolicy:      core.RestartPolicyAlways,
+			InitContainers:     coreInitContainers,
+			Containers:         coreContainers,
+			Volumes:            coreVolumes,
+			ServiceAccountName: "default",
 		},
 	}
 

diff --git a/pkg/webhook/sidecarset/validating/sidecarset_validating_test.go b/pkg/webhook/sidecarset/validating/sidecarset_validating_test.go
@@ -316,6 +316,23 @@ func TestValidateSidecarSet(t *testing.T) {
 					{
 						Name: "test-volume",
 					},
+					{
+						Name: "istio-token",
+						VolumeSource: corev1.VolumeSource{
+							Projected: &corev1.ProjectedVolumeSource{
+								DefaultMode: pointer.Int32Ptr(420),
+								Sources: []corev1.VolumeProjection{
+									{
+										ServiceAccountToken: &corev1.ServiceAccountTokenProjection{
+											Audience:          "istio-ca",
+											ExpirationSeconds: pointer.Int64Ptr(43200),
+											Path:              "istio-token",
+										},
+									},
+								},
+							},
+						},
+					},
 				},
 			},
 		},