Support auto generation of Subscriptions identity service account and…

[xiangpingjiang]

Fixes #7223

Proposed Changes

• 🎁 Expose the name of the OIDC service account in the Subscriptions .status.auth.serviceAccountName
• 🎁 Create the OIDC service account of the Subscriptions

Pre-review Checklist

• At least 80% unit test coverage
• E2E tests for any new behavior
• Docs PR for any user-facing impact
• Spec PR for any new API feature
• Conformance test for any change to the spec

Release Note

Expose the SubscriptionsOIDC service account name in the Subscriptions.status.auth.serviceAccountName

Docs

[knative-prow]

Hi @xiangpingjiang. Thanks for your PR.

I'm waiting for a knative member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[xiangpingjiang]

hello @creydr
This unit test failed link, I think we need also disable OIDC for Subscription in WantStatusUpdates ,
But func WithSubscriptionOptionOIDCIdentityCreatedSucceededBecauseOIDCFeatureDisabled return SubscriptionOption, can't put in NewTrigger , do you have any ideas to solve this problem? Thanks

[creydr]

hello @creydr This unit test failed link, I think we need also disable OIDC for Subscription in WantStatusUpdates , But func WithSubscriptionOptionOIDCIdentityCreatedSucceededBecauseOIDCFeatureDisabled return SubscriptionOption, can't put in NewTrigger , do you have any ideas to solve this problem? Thanks

Hi @xiangpingjiang,
thanks for your PR. The problem is probably, because the tests uses the makeReadySubscription() function, which uses the eventingv1.TestHelper.ReadySubscriptionStatus(). And this function does not set the OIDCIdentityCreated status yet. So I guess, when you update the TestHelper.ReadySubscriptionStatus() function to mark the OIDCIdentityCreated status as succeeded too, it should work.

/ok-to-test

[codecov]

Codecov Report

Attention: 11 lines in your changes are missing coverage. Please review.

Comparison is base (a0e4c18) 76.86% compared to head (cb12b81) 76.83%.
Report is 9 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7338      +/-   ##
==========================================
- Coverage   76.86%   76.83%   -0.04%     
==========================================
  Files         252      252              
  Lines       13727    13768      +41     
==========================================
+ Hits        10551    10578      +27     
- Misses       2650     2661      +11     
- Partials      526      529       +3     

Files	Coverage Δ
pkg/reconciler/subscription/subscription.go	84.10% <100.00%> (+0.64%)	⬆️
pkg/apis/eventing/v1/test_helper.go	91.56% <0.00%> (-1.12%)	⬇️
pkg/apis/messaging/v1/subscription_lifecycle.go	57.89% <50.00%> (-2.11%)	⬇️
pkg/reconciler/subscription/controller.go	89.09% <71.42%> (-10.91%)	⬇️

... and 1 file with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[creydr]

@xiangpingjiang Thanks for this PR. Is is ready for review?

[xiangpingjiang]

@xiangpingjiang Thanks for this PR. Is is ready for review?

@creydr .
Yes, It's ready. Thanks

[creydr]

Thanks a lot @xiangpingjiang for your PR 🎉 Looking good so far 👍
I just left a few comments.

[creydr]

/retest

@xiangpingjiang I saw you converted this into a draft again. Let me know when this is ready for review again

[creydr]

Thanks a lot for your contribution @xiangpingjiang 👍

/lgtm

[creydr]

/lgtm

[knative-prow]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: creydr, xiangpingjiang

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [creydr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment