🐛 Refresh external managed token secret if service account is deleted

.github/workflows/e2e.yml

@@ -23,6 +23,9 @@ jobs:
   e2e:
     runs-on: ubuntu-latest
     steps:
+      - name: add permisson to docker.sock
+        run: sudo chown runner:docker /var/run/docker.sock
+        if: ${{ env.ACT }} # this step only runs locally when using the https://github.com/nektos/act to debug the e2e
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Go
@@ -52,6 +55,9 @@ jobs:
   e2e-hosted:
     runs-on: ubuntu-latest
     steps:
+      - name: add permisson to docker.sock
+        run: sudo chown runner:docker /var/run/docker.sock
+        if: ${{ env.ACT }} # this step only runs locally when using the https://github.com/nektos/act to debug the e2e
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Go
@@ -81,6 +87,9 @@ jobs:
   e2e-singleton:
     runs-on: ubuntu-latest
     steps:
+      - name: add permisson to docker.sock
+        run: sudo chown runner:docker /var/run/docker.sock
+        if: ${{ env.ACT }} # this step only runs locally when using the https://github.com/nektos/act to debug the e2e
       - name: Checkout
         uses: actions/checkout@v4
       - name: Setup Go

pkg/operator/helpers/sa_syncer.go

@@ -36,6 +36,7 @@ func SATokenGetter(ctx context.Context, saName, saNamespace string, saClient kub
 		additionalData := map[string][]byte{
 			"serviceaccount_namespace": []byte(saNamespace),
 			"serviceaccount_name":      []byte(saName),
+			"serviceaccount_uid":       []byte(sa.UID),
 		}
 
 		for _, secret := range sa.Secrets {
@@ -78,30 +79,6 @@ func SATokenGetter(ctx context.Context, saName, saNamespace string, saClient kub
 	}
 }
 
-// SATokenCreater create the saToken of target sa.
-func SATokenCreater(ctx context.Context, saName, saNamespace string, saClient kubernetes.Interface) TokenGetterFunc {
-	return func() ([]byte, []byte, map[string][]byte, error) {
-		// 8640 hour
-		tr, err := saClient.CoreV1().ServiceAccounts(saNamespace).
-			CreateToken(ctx, saName, &authv1.TokenRequest{
-				Spec: authv1.TokenRequestSpec{
-					ExpirationSeconds: pointer.Int64(8640 * 3600),
-				},
-			}, metav1.CreateOptions{})
-		if err != nil {
-			return nil, nil, nil, err
-		}
-		expiration, err := tr.Status.ExpirationTimestamp.MarshalText()
-		if err != nil {
-			return nil, nil, nil, nil
-		}
-		return []byte(tr.Status.Token), expiration, map[string][]byte{
-			"serviceaccount_namespace": []byte(saNamespace),
-			"serviceaccount_name":      []byte(saName),
-		}, nil
-	}
-}
-
 func SyncKubeConfigSecret(ctx context.Context, secretName, secretNamespace, kubeconfigPath string,
 	templateKubeconfig *rest.Config, secretClient coreclientv1.SecretsGetter,
 	tokenGetter TokenGetterFunc, recorder events.Recorder, labels map[string]string) error {

pkg/operator/helpers/sa_syncer_test.go

@@ -11,6 +11,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/types"
 	testclient "k8s.io/client-go/kubernetes/fake"
 	"k8s.io/client-go/rest"
 	clienttesting "k8s.io/client-go/testing"
@@ -19,6 +20,7 @@ import (
 func TestTokenGetter(t *testing.T) {
 	saName := "test-sa"
 	saNamespace := "test-ns"
+	saUID := "test-uid"
 
 	tests := []struct {
 		name           string
@@ -56,6 +58,7 @@ func TestTokenGetter(t *testing.T) {
 					ObjectMeta: metav1.ObjectMeta{
 						Name:      saName,
 						Namespace: saNamespace,
+						UID:       types.UID(saUID),
 					},
 					Secrets: []corev1.ObjectReference{},
 				},
@@ -92,6 +95,9 @@ func TestTokenGetter(t *testing.T) {
 				if !reflect.DeepEqual(additionalData["serviceaccount_name"], []byte(saName)) {
 					t.Errorf("serviceaccount_name is not correct, got %s", string(additionalData["serviceaccount_name"]))
 				}
+				if !reflect.DeepEqual(additionalData["serviceaccount_uid"], []byte(saUID)) {
+					t.Errorf("serviceaccount_uid is not correct, got %s", string(additionalData["serviceaccount_uid"]))
+				}
 			}
 
 		})

pkg/operator/operators/clustermanager/controllers/clustermanagercontroller/clustermanager_controller.go

@@ -341,13 +341,14 @@ func ensureSAKubeconfigs(ctx context.Context, clusterManagerName, clusterManager
 	hubKubeConfig *rest.Config, hubClient, managementClient kubernetes.Interface, recorder events.Recorder,
 	mwctrEnabled, addonManagerEnabled bool) error {
 	for _, sa := range getSAs(mwctrEnabled, addonManagerEnabled) {
-		tokenGetter := helpers.SATokenCreater(ctx, sa, clusterManagerNamespace, hubClient)
-		err := helpers.SyncKubeConfigSecret(ctx, sa+"-kubeconfig", clusterManagerNamespace, "/var/run/secrets/hub/kubeconfig", &rest.Config{
-			Host: hubKubeConfig.Host,
-			TLSClientConfig: rest.TLSClientConfig{
-				CAData: hubKubeConfig.CAData,
-			},
-		}, managementClient.CoreV1(), tokenGetter, recorder, nil)
+		tokenGetter := helpers.SATokenGetter(ctx, sa, clusterManagerNamespace, hubClient)
+		err := helpers.SyncKubeConfigSecret(ctx, sa+"-kubeconfig", clusterManagerNamespace,
+			"/var/run/secrets/hub/kubeconfig", &rest.Config{
+				Host: hubKubeConfig.Host,
+				TLSClientConfig: rest.TLSClientConfig{
+					CAData: hubKubeConfig.CAData,
+				},
+			}, managementClient.CoreV1(), tokenGetter, recorder, nil)
 		if err != nil {
 			return err
 		}

test/e2e/common.go

@@ -898,7 +898,8 @@ func (t *Tester) CheckManagedClusterAddOnStatus(managedClusterNamespace, addOnNa
 	}
 
 	if !meta.IsStatusConditionTrue(addOn.Status.Conditions, "Available") {
-		return fmt.Errorf("the addon %v/%v available condition is not true", managedClusterNamespace, addOnName)
+		return fmt.Errorf("the addon %v/%v available condition is not true, %v",
+			managedClusterNamespace, addOnName, addOn.Status.Conditions)
 	}
 
 	return nil