From e07a05dff1c9ae4d7f199f5ca477751a1cfee240 Mon Sep 17 00:00:00 2001 From: Harsha Narayana Date: Thu, 16 Jun 2022 12:12:02 +0530 Subject: [PATCH] GIT-2731: enable TokenRequest for ServiceAccount token generation --- test/e2e/v3/plugin_cluster_test.go | 93 ++++++------------------------ 1 file changed, 19 insertions(+), 74 deletions(-) diff --git a/test/e2e/v3/plugin_cluster_test.go b/test/e2e/v3/plugin_cluster_test.go index 9a1ac102f48..192c64a0686 100644 --- a/test/e2e/v3/plugin_cluster_test.go +++ b/test/e2e/v3/plugin_cluster_test.go @@ -17,7 +17,6 @@ limitations under the License. package v3 import ( - "encoding/base64" "fmt" "os" "path/filepath" @@ -42,7 +41,6 @@ var _ = Describe("kubebuilder", func() { Context("project version 3", func() { var ( kbc *utils.TestContext - sat bool ) BeforeEach(func() { @@ -53,8 +51,6 @@ var _ = Describe("kubebuilder", func() { By("installing the Prometheus operator") Expect(kbc.InstallPrometheusOperManager()).To(Succeed()) - - sat = false }) AfterEach(func() { @@ -94,7 +90,7 @@ var _ = Describe("kubebuilder", func() { kbc.Kubectl.ServiceAccount = "default" defer func() { kbc.Kubectl.ServiceAccount = tmp }() GenerateV2(kbc) - Run(kbc, sat) + Run(kbc) }) }) @@ -119,15 +115,7 @@ var _ = Describe("kubebuilder", func() { } GenerateV3(kbc, "v1") - - // only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret - // TODO: Remove this once a better implementation using something like the TokenRequest API - // is used in the e2e tests - if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 { - sat = true - } - - Run(kbc, sat) + Run(kbc) }) It("should generate a runnable project with the golang base plugin v3 and kustomize v4-alpha", func() { // Skip if cluster version < 1.16, when v1 CRDs and webhooks did not exist. @@ -139,15 +127,7 @@ var _ = Describe("kubebuilder", func() { } GenerateV3WithKustomizeV2(kbc, "v1") - - // only if running on Kubernetes >= 1.24 do we need to generate the ServiceAccount token Secret - // TODO: Remove this once a better implementation using something like the TokenRequest API - // is used in the e2e tests - if srvVer := kbc.K8sVersion.ServerVersion; srvVer.GetMajorInt() == 1 && srvVer.GetMinorInt() >= 24 { - sat = true - } - - Run(kbc, sat) + Run(kbc) }) It("should generate a runnable project with v1beta1 CRDs and Webhooks", func() { // Skip if cluster version < 1.15, when `.spec.preserveUnknownFields` was not a v1beta1 CRD field. @@ -161,14 +141,14 @@ var _ = Describe("kubebuilder", func() { } GenerateV3(kbc, "v1beta1") - Run(kbc, sat) + Run(kbc) }) }) }) }) // Run runs a set of e2e tests for a scaffolded project defined by a TestContext. -func Run(kbc *utils.TestContext, sat bool) { +func Run(kbc *utils.TestContext) { var controllerPodName string var err error @@ -233,10 +213,6 @@ func Run(kbc *utils.TestContext, sat bool) { fmt.Sprintf("--serviceaccount=%s:%s", kbc.Kubectl.Namespace, kbc.Kubectl.ServiceAccount)) ExpectWithOffset(1, err).NotTo(HaveOccurred()) - if sat { - ServiceAccountToken(kbc) - } - _ = curlMetrics(kbc) By("validating that cert-manager has provisioned the certificate Secret") @@ -347,15 +323,7 @@ func Run(kbc *utils.TestContext, sat bool) { func curlMetrics(kbc *utils.TestContext) string { By("reading the metrics token") // Filter token query by service account in case more than one exists in a namespace. - // TODO: Parsing a token this way is not ideal or best practice and should not be used. - // Instead, a TokenRequest should be created to get a token to use for this step. - query := fmt.Sprintf(`{.items[?(@.metadata.annotations.kubernetes\.io/service-account\.name=="%s")].data.token}`, - kbc.Kubectl.ServiceAccount, - ) - b64Token, err := kbc.Kubectl.Get(true, "secrets", "-o=jsonpath="+query) - ExpectWithOffset(2, err).NotTo(HaveOccurred()) - token, err := base64.StdEncoding.DecodeString(strings.TrimSpace(b64Token)) - ExpectWithOffset(2, err).NotTo(HaveOccurred()) + token := ServiceAccountToken(kbc) ExpectWithOffset(2, len(token)).To(BeNumerically(">", 0)) By("creating a curl pod") @@ -365,7 +333,7 @@ func curlMetrics(kbc *utils.TestContext) string { fmt.Sprintf("https://e2e-%s-controller-manager-metrics-service.%s.svc:8443/metrics", kbc.TestSuffix, kbc.Kubectl.Namespace), } - _, err = kbc.Kubectl.CommandInNamespace(cmdOpts...) + _, err := kbc.Kubectl.CommandInNamespace(cmdOpts...) ExpectWithOffset(2, err).NotTo(HaveOccurred()) By("validating that the curl pod is running as expected") @@ -398,43 +366,20 @@ func curlMetrics(kbc *utils.TestContext) string { return metricsOutput } -// TODO: Remove this when and other related functions when -// tests have been changed to use a better implementation. -// ServiceAccountToken creates the ServiceAccount token Secret. -// This is to be used when Kubernetes cluster version is >= 1.24. -// In k8s 1.24+ a ServiceAccount token Secret is no longer -// automatically generated -func ServiceAccountToken(kbc *utils.TestContext) { - // As of Kubernetes 1.24 a ServiceAccount no longer has a ServiceAccount token - // secret autogenerated. We have to create it manually here +// ServiceAccountToken performs a kubectl create token to request a new Token +// for the service account in question and use that token for performing the +// curl command calls as required. Please keep in mind that the output of +// kubectl create token is not base64 encoded. It is the JWT token itself +func ServiceAccountToken(kbc *utils.TestContext) string { By("Creating the ServiceAccount token") - secretFile, err := createServiceAccountToken(kbc.Kubectl.ServiceAccount, kbc.Dir) - Expect(err).NotTo(HaveOccurred()) + var out string + var err error Eventually(func() error { - _, err = kbc.Kubectl.Apply(true, "-f", secretFile) + out, err = kbc.Kubectl.Command( + "create", "token", kbc.Kubectl.ServiceAccount, + "--audience", + fmt.Sprintf("https://e2e-%s-controller-manager-metrics-service.%s.svc:8443", kbc.TestSuffix, kbc.Kubectl.Namespace)) return err }, time.Minute, time.Second).Should(Succeed()) -} - -var saSecretTemplate = `--- -apiVersion: v1 -kind: Secret -type: kubernetes.io/service-account-token -metadata: - name: %s - annotations: - kubernetes.io/service-account.name: "%s" -` - -// createServiceAccountToken writes a service account token secret to a file. -// It returns a string to the file or an error if it fails to write the file -func createServiceAccountToken(name string, dir string) (string, error) { - secretName := name + "-secret" - fileName := dir + "/" + secretName + ".yaml" - err := os.WriteFile(fileName, []byte(fmt.Sprintf(saSecretTemplate, secretName, name)), 0777) - if err != nil { - return "", err - } - - return fileName, nil + return out }