mirror of
https://github.com/k3s-io/kubernetes.git
synced 2025-07-24 04:06:03 +00:00
Merge pull request #89696 from flant/service-account-volume-name-with-dot
Fix service account names with a dot
This commit is contained in:
commit
561e86e241
@ -467,9 +467,10 @@ func (s *Plugin) mountServiceAccountToken(serviceAccount *corev1.ServiceAccount,
|
|||||||
tokenVolumeName = s.generateName(ServiceAccountVolumeName + "-")
|
tokenVolumeName = s.generateName(ServiceAccountVolumeName + "-")
|
||||||
} else {
|
} else {
|
||||||
// Try naming the volume the same as the serviceAccountToken, and uniquify if needed
|
// Try naming the volume the same as the serviceAccountToken, and uniquify if needed
|
||||||
tokenVolumeName = serviceAccountToken
|
// Replace dots because volumeMountName can't contain it
|
||||||
|
tokenVolumeName = strings.Replace(serviceAccountToken, ".", "-", -1)
|
||||||
if allVolumeNames.Has(tokenVolumeName) {
|
if allVolumeNames.Has(tokenVolumeName) {
|
||||||
tokenVolumeName = s.generateName(fmt.Sprintf("%s-", serviceAccountToken))
|
tokenVolumeName = s.generateName(fmt.Sprintf("%s-", tokenVolumeName))
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
@ -1121,6 +1121,85 @@ func TestAutomountIsBackwardsCompatible(t *testing.T) {
|
|||||||
t.Fatalf("Expected\n\t%#v\ngot\n\t%#v", expectedVolumeMount, pod.Spec.Containers[0].VolumeMounts[0])
|
t.Fatalf("Expected\n\t%#v\ngot\n\t%#v", expectedVolumeMount, pod.Spec.Containers[0].VolumeMounts[0])
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
func TestServiceAccountNameWithDotMount(t *testing.T) {
|
||||||
|
ns := "myns"
|
||||||
|
tokenName := "token.name-123"
|
||||||
|
serviceAccountName := "token.name"
|
||||||
|
serviceAccountUID := "12345"
|
||||||
|
|
||||||
|
expectedVolume := api.Volume{
|
||||||
|
Name: "token-name-123",
|
||||||
|
VolumeSource: api.VolumeSource{
|
||||||
|
Secret: &api.SecretVolumeSource{
|
||||||
|
SecretName: "token.name-123",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
expectedVolumeMount := api.VolumeMount{
|
||||||
|
Name: "token-name-123",
|
||||||
|
ReadOnly: true,
|
||||||
|
MountPath: DefaultAPITokenMountPath,
|
||||||
|
}
|
||||||
|
|
||||||
|
admit := NewServiceAccount()
|
||||||
|
informerFactory := informers.NewSharedInformerFactory(nil, controller.NoResyncPeriodFunc())
|
||||||
|
admit.SetExternalKubeInformerFactory(informerFactory)
|
||||||
|
admit.MountServiceAccountToken = true
|
||||||
|
admit.RequireAPIToken = true
|
||||||
|
|
||||||
|
informerFactory.Core().V1().ServiceAccounts().Informer().GetStore().Add(&corev1.ServiceAccount{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: serviceAccountName,
|
||||||
|
Namespace: ns,
|
||||||
|
UID: types.UID(serviceAccountUID),
|
||||||
|
},
|
||||||
|
Secrets: []corev1.ObjectReference{
|
||||||
|
{Name: tokenName},
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
informerFactory.Core().V1().Secrets().Informer().GetStore().Add(&corev1.Secret{
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: tokenName,
|
||||||
|
Namespace: ns,
|
||||||
|
Annotations: map[string]string{
|
||||||
|
corev1.ServiceAccountNameKey: serviceAccountName,
|
||||||
|
corev1.ServiceAccountUIDKey: serviceAccountUID,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
Type: corev1.SecretTypeServiceAccountToken,
|
||||||
|
Data: map[string][]byte{
|
||||||
|
api.ServiceAccountTokenKey: []byte("token-data"),
|
||||||
|
},
|
||||||
|
})
|
||||||
|
|
||||||
|
pod := &api.Pod{
|
||||||
|
Spec: api.PodSpec{
|
||||||
|
ServiceAccountName: serviceAccountName,
|
||||||
|
Containers: []api.Container{
|
||||||
|
{Name: "container-1"},
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
attrs := admission.NewAttributesRecord(pod, nil, api.Kind("Pod").WithVersion("version"), ns, "myname", api.Resource("pods").WithVersion("version"), "", admission.Create, &metav1.CreateOptions{}, false, nil)
|
||||||
|
if err := admissiontesting.WithReinvocationTesting(t, admit).Admit(context.TODO(), attrs, nil); err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(pod.Spec.Volumes) != 1 {
|
||||||
|
t.Fatalf("Expected 1 volume, got %d", len(pod.Spec.Volumes))
|
||||||
|
}
|
||||||
|
if !reflect.DeepEqual(expectedVolume, pod.Spec.Volumes[0]) {
|
||||||
|
t.Fatalf("Expected\n\t%#v\ngot\n\t%#v", expectedVolume, pod.Spec.Volumes[0])
|
||||||
|
}
|
||||||
|
if len(pod.Spec.Containers[0].VolumeMounts) != 1 {
|
||||||
|
t.Fatalf("Expected 1 volume mount, got %d", len(pod.Spec.Containers[0].VolumeMounts))
|
||||||
|
}
|
||||||
|
if !reflect.DeepEqual(expectedVolumeMount, pod.Spec.Containers[0].VolumeMounts[0]) {
|
||||||
|
t.Fatalf("Expected\n\t%#v\ngot\n\t%#v", expectedVolumeMount, pod.Spec.Containers[0].VolumeMounts[0])
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
func testGenerateName(n string) string {
|
func testGenerateName(n string) string {
|
||||||
return n + "abc123"
|
return n + "abc123"
|
||||||
|
Loading…
Reference in New Issue
Block a user