GIT-2731: enable TokenRequest for ServiceAccount token generation

GIT-2731: enable namespace based token generation

test/e2e/v3/plugin_cluster_test.go

@@ -38,11 +38,22 @@ import (
 	"sigs.k8s.io/kubebuilder/v3/test/e2e/utils"
 )
 
+const (
+	serviceAccountTokenSecretTemplate = `---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+	name: %s
+	annotations:
+	kubernetes.io/service-account.name: "%s"
+`
+)
+
 var _ = Describe("kubebuilder", func() {
 	Context("project version 3", func() {
 		var (
 			kbc *utils.TestContext
-			sat bool
 		)
 
 		BeforeEach(func() {
@@ -53,8 +64,6 @@ var _ = Describe("kubebuilder", func() {
 
 			By("installing the Prometheus operator")
 			Expect(kbc.InstallPrometheusOperManager()).To(Succeed())
-
-			sat = false
 		})
 
 		AfterEach(func() {
@@ -94,7 +103,7 @@ var _ = Describe("kubebuilder", func() {
 				kbc.Kubectl.ServiceAccount = "default"
 				defer func() { kbc.Kubectl.ServiceAccount = tmp }()
 				GenerateV2(kbc)
-				Run(kbc, sat)
+				Run(kbc)
 			})
 		})
 
@@ -119,15 +128,7 @@ var _ = Describe("kubebuilder", func() {
 				}
 
 				GenerateV3(kbc, "v1")
-
-				// only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret
-				// TODO: Remove this once a better implementation using something like the TokenRequest API
-				// is used in the e2e tests
-				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 {
-					sat = true
-				}
-
-				Run(kbc, sat)
+				Run(kbc)
 			})
 			It("should generate a runnable project with the golang base plugin v3 and kustomize v4-alpha", func() {
 				// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
@@ -139,15 +140,7 @@ var _ = Describe("kubebuilder", func() {
 				}
 
 				GenerateV3WithKustomizeV2(kbc, "v1")
-
-				// only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret
-				// TODO: Remove this once a better implementation using something like the TokenRequest API
-				// is used in the e2e tests
-				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 {
-					sat = true
-				}
-
-				Run(kbc, sat)
+				Run(kbc)
 			})
 			It("should generate a runnable project with v1beta1 CRDs and Webhooks", func() {
 				// Skip if cluster version < 1.15, when `.spec.preserveUnknownFields` was not a v1beta1 CRD field.
@@ -161,14 +154,14 @@ var _ = Describe("kubebuilder", func() {
 				}
 
 				GenerateV3(kbc, "v1beta1")
-				Run(kbc, sat)
+				Run(kbc)
 			})
 		})
 	})
 })
 
 // Run runs a set of e2e tests for a scaffolded project defined by a TestContext.
-func Run(kbc *utils.TestContext, sat bool) {
+func Run(kbc *utils.TestContext) {
 	var controllerPodName string
 	var err error
 
@@ -233,10 +226,6 @@ func Run(kbc *utils.TestContext, sat bool) {
 		fmt.Sprintf("--serviceaccount=%s:%s", kbc.Kubectl.Namespace, kbc.Kubectl.ServiceAccount))
 	ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
-	if sat {
-		ServiceAccountToken(kbc)
-	}
-
 	_ = curlMetrics(kbc)
 
 	By("validating that cert-manager has provisioned the certificate Secret")
@@ -347,14 +336,7 @@ func Run(kbc *utils.TestContext, sat bool) {
 func curlMetrics(kbc *utils.TestContext) string {
 	By("reading the metrics token")
 	// Filter token query by service account in case more than one exists in a namespace.
-	// TODO: Parsing a token this way is not ideal or best practice and should not be used.
-	// Instead, a TokenRequest should be created to get a token to use for this step.
-	query := fmt.Sprintf(`{.items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="%s")].data.token}`,
-		kbc.Kubectl.ServiceAccount,
-	)
-	b64Token, err := kbc.Kubectl.Get(true, "secrets", "-o=jsonpath="+query)
-	ExpectWithOffset(2, err).NotTo(HaveOccurred())
-	token, err := base64.StdEncoding.DecodeString(strings.TrimSpace(b64Token))
+	token, err := ServiceAccountToken(kbc)
 	ExpectWithOffset(2, err).NotTo(HaveOccurred())
 	ExpectWithOffset(2, len(token)).To(BeNumerically(">", 0))
 
@@ -398,43 +380,49 @@ func curlMetrics(kbc *utils.TestContext) string {
 	return metricsOutput
 }
 
-// TODO: Remove this when and other related functions when
-// tests have been changed to use a better implementation.
-// ServiceAccountToken creates the ServiceAccount token Secret.
-// This is to be used when Kubernetes cluster version is >= 1.24.
-// In k8s 1.24+ a ServiceAccount token Secret is no longer
-// automatically generated
-func ServiceAccountToken(kbc *utils.TestContext) {
-	// As of Kubernetes 1.24 a ServiceAccount no longer has a ServiceAccount token
-	// secret autogenerated. We have to create it manually here
+// ServiceAccountToken performs a kubectl create token to request a new Token
+// for the service account in question and use that token for performing the
+// curl command calls as required. Please keep in mind that the output of
+// kubectl create token is not base64 encoded. It is the JWT token itself
+func ServiceAccountToken(kbc *utils.TestContext) (out string, err error) {
 	By("Creating the ServiceAccount token")
-	secretFile, err := createServiceAccountToken(kbc.Kubectl.ServiceAccount, kbc.Dir)
-	Expect(err).NotTo(HaveOccurred())
-	Eventually(func() error {
+	if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 {
+		Eventually(func() error {
+			out, err = kbc.Kubectl.Command("create", "token", "-n", kbc.Kubectl.Namespace, kbc.Kubectl.ServiceAccount)
+			return err
+		}, time.Minute, time.Second).Should(Succeed())
+	} else {
+		secretName := fmt.Sprintf("%s-token-request", kbc.Kubectl.ServiceAccount)
+		secretFile := filepath.Join(kbc.Dir, secretName)
+		err = os.WriteFile(
+			secretFile,
+			[]byte(fmt.Sprintf(serviceAccountTokenSecretTemplate, secretName, kbc.Kubectl.ServiceAccount)),
+			os.FileMode(0777),
+		)
+		if err != nil {
+			return out, err
+		}
+		defer os.Remove(secretFile)
 		_, err = kbc.Kubectl.Apply(true, "-f", secretFile)
-		return err
-	}, time.Minute, time.Second).Should(Succeed())
-}
-
-var saSecretTemplate = `---
-apiVersion: v1
-kind: Secret
-type: kubernetes.io/service-account-token
-metadata:
-  name: %s
-  annotations:
-    kubernetes.io/service-account.name: "%s"
-`
-
-// createServiceAccountToken writes a service account token secret to a file.
-// It returns a string to the file or an error if it fails to write the file
-func createServiceAccountToken(name string, dir string) (string, error) {
-	secretName := name + "-secret"
-	fileName := dir + "/" + secretName + ".yaml"
-	err := os.WriteFile(fileName, []byte(fmt.Sprintf(saSecretTemplate, secretName, name)), 0777)
-	if err != nil {
-		return "", err
+		if err != nil {
+			return out, err
+		}
+		defer func() {
+			_, _ = kbc.Kubectl.Delete(true, "secret", secretName)
+		}()
+		Eventually(func() error {
+			token, err := kbc.Kubectl.Get(true, "secret", secretName, "-o=jsonpath={.data.token}")
+			if err != nil {
+				return err
+			}
+			outBytes, err := base64.StdEncoding.DecodeString(strings.TrimSpace(token))
+			if err != nil {
+				return err
+			}
+			out = string(outBytes)
+			return nil
+		}, time.Minute, time.Second).Should(Succeed())
 	}
 
-	return fileName, nil
+	return out, err
 }