GIT-2731: enable TokenRequest for ServiceAccount token generation

test/e2e/v3/plugin_cluster_test.go

@@ -17,7 +17,6 @@ limitations under the License.
 package v3
 
 import (
-	"encoding/base64"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -42,7 +41,6 @@ var _ = Describe("kubebuilder", func() {
 	Context("project version 3", func() {
 		var (
 			kbc *utils.TestContext
-			sat bool
 		)
 
 		BeforeEach(func() {
@@ -53,8 +51,6 @@ var _ = Describe("kubebuilder", func() {
 
 			By("installing the Prometheus operator")
 			Expect(kbc.InstallPrometheusOperManager()).To(Succeed())
-
-			sat = false
 		})
 
 		AfterEach(func() {
@@ -94,7 +90,7 @@ var _ = Describe("kubebuilder", func() {
 				kbc.Kubectl.ServiceAccount = "default"
 				defer func() { kbc.Kubectl.ServiceAccount = tmp }()
 				GenerateV2(kbc)
-				Run(kbc, sat)
+				Run(kbc)
 			})
 		})
 
@@ -119,15 +115,7 @@ var _ = Describe("kubebuilder", func() {
 				}
 
 				GenerateV3(kbc, "v1")
-
-				// only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret
-				// TODO: Remove this once a better implementation using something like the TokenRequest API
-				// is used in the e2e tests
-				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 {
-					sat = true
-				}
-
-				Run(kbc, sat)
+				Run(kbc)
 			})
 			It("should generate a runnable project with the golang base plugin v3 and kustomize v4-alpha", func() {
 				// Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist.
@@ -139,15 +127,7 @@ var _ = Describe("kubebuilder", func() {
 				}
 
 				GenerateV3WithKustomizeV2(kbc, "v1")
-
-				// only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret
-				// TODO: Remove this once a better implementation using something like the TokenRequest API
-				// is used in the e2e tests
-				if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 {
-					sat = true
-				}
-
-				Run(kbc, sat)
+				Run(kbc)
 			})
 			It("should generate a runnable project with v1beta1 CRDs and Webhooks", func() {
 				// Skip if cluster version < 1.15, when `.spec.preserveUnknownFields` was not a v1beta1 CRD field.
@@ -161,14 +141,14 @@ var _ = Describe("kubebuilder", func() {
 				}
 
 				GenerateV3(kbc, "v1beta1")
-				Run(kbc, sat)
+				Run(kbc)
 			})
 		})
 	})
 })
 
 // Run runs a set of e2e tests for a scaffolded project defined by a TestContext.
-func Run(kbc *utils.TestContext, sat bool) {
+func Run(kbc *utils.TestContext) {
 	var controllerPodName string
 	var err error
 
@@ -233,10 +213,6 @@ func Run(kbc *utils.TestContext, sat bool) {
 		fmt.Sprintf("--serviceaccount=%s:%s", kbc.Kubectl.Namespace, kbc.Kubectl.ServiceAccount))
 	ExpectWithOffset(1, err).NotTo(HaveOccurred())
 
-	if sat {
-		ServiceAccountToken(kbc)
-	}
-
 	_ = curlMetrics(kbc)
 
 	By("validating that cert-manager has provisioned the certificate Secret")
@@ -347,15 +323,7 @@ func Run(kbc *utils.TestContext, sat bool) {
 func curlMetrics(kbc *utils.TestContext) string {
 	By("reading the metrics token")
 	// Filter token query by service account in case more than one exists in a namespace.
-	// TODO: Parsing a token this way is not ideal or best practice and should not be used.
-	// Instead, a TokenRequest should be created to get a token to use for this step.
-	query := fmt.Sprintf(`{.items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="%s")].data.token}`,
-		kbc.Kubectl.ServiceAccount,
-	)
-	b64Token, err := kbc.Kubectl.Get(true, "secrets", "-o=jsonpath="+query)
-	ExpectWithOffset(2, err).NotTo(HaveOccurred())
-	token, err := base64.StdEncoding.DecodeString(strings.TrimSpace(b64Token))
-	ExpectWithOffset(2, err).NotTo(HaveOccurred())
+	token := ServiceAccountToken(kbc)
 	ExpectWithOffset(2, len(token)).To(BeNumerically(">", 0))
 
 	By("creating a curl pod")
@@ -365,7 +333,7 @@ func curlMetrics(kbc *utils.TestContext) string {
 		fmt.Sprintf("https://e2e-%s-controller-manager-metrics-service.%s.svc:8443/metrics",
 			kbc.TestSuffix, kbc.Kubectl.Namespace),
 	}
-	_, err = kbc.Kubectl.CommandInNamespace(cmdOpts...)
+	_, err := kbc.Kubectl.CommandInNamespace(cmdOpts...)
 	ExpectWithOffset(2, err).NotTo(HaveOccurred())
 
 	By("validating that the curl pod is running as expected")
@@ -398,43 +366,20 @@ func curlMetrics(kbc *utils.TestContext) string {
 	return metricsOutput
 }
 
-// TODO: Remove this when and other related functions when
-// tests have been changed to use a better implementation.
-// ServiceAccountToken creates the ServiceAccount token Secret.
-// This is to be used when Kubernetes cluster version is >= 1.24.
-// In k8s 1.24+ a ServiceAccount token Secret is no longer
-// automatically generated
-func ServiceAccountToken(kbc *utils.TestContext) {
-	// As of Kubernetes 1.24 a ServiceAccount no longer has a ServiceAccount token
-	// secret autogenerated. We have to create it manually here
+// ServiceAccountToken performs a kubectl create token to request a new Token
+// for the service account in question and use that token for performing the
+// curl command calls as required. Please keep in mind that the output of
+// kubectl create token is not base64 encoded. It is the JWT token itself
+func ServiceAccountToken(kbc *utils.TestContext) string {
 	By("Creating the ServiceAccount token")
-	secretFile, err := createServiceAccountToken(kbc.Kubectl.ServiceAccount, kbc.Dir)
-	Expect(err).NotTo(HaveOccurred())
+	var out string
+	var err error
 	Eventually(func() error {
-		_, err = kbc.Kubectl.Apply(true, "-f", secretFile)
+		out, err = kbc.Kubectl.Command(
+			"create", "token", kbc.Kubectl.ServiceAccount,
+			"--audience",
+			fmt.Sprintf("https://e2e-%s-controller-manager-metrics-service.%s.svc:8443", kbc.TestSuffix, kbc.Kubectl.Namespace))
 		return err
 	}, time.Minute, time.Second).Should(Succeed())
-}
-
-var saSecretTemplate = `---
-apiVersion: v1
-kind: Secret
-type: kubernetes.io/service-account-token
-metadata:
-  name: %s
-  annotations:
-    kubernetes.io/service-account.name: "%s"
-`
-
-// createServiceAccountToken writes a service account token secret to a file.
-// It returns a string to the file or an error if it fails to write the file
-func createServiceAccountToken(name string, dir string) (string, error) {
-	secretName := name + "-secret"
-	fileName := dir + "/" + secretName + ".yaml"
-	err := os.WriteFile(fileName, []byte(fmt.Sprintf(saSecretTemplate, secretName, name)), 0777)
-	if err != nil {
-		return "", err
-	}
-
-	return fileName, nil
+	return out
 }