github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-18 16:21:13 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #119579 from yt2985/cleanSA

Browse Source 
Fix the flaky legacy_service_account_token_clean_up_test.
This commit is contained in:
Kubernetes Prow Robot 2023-08-15 19:43:12 -07:00 committed by GitHub
commit 59f81980a1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 31 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

56
test/integration/serviceaccount/legacy_service_account_token_clean_up_test.go
View File

@ -51,18 +51,12 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
defer featuregatetesting.SetFeatureGateDuringTest(t, utilfeature.DefaultFeatureGate, kubefeatures.LegacyServiceAccountTokenCleanUp, true)()
ctx, cancel := context.WithCancel(context.Background())
defer cancel()
fakeClock := testingclock.NewFakeClock(time.Now().UTC())
c, config, stopFunc, informers, err := startServiceAccountTestServerAndWaitForCaches(ctx, t)
defer stopFunc()
if err != nil {
t.Fatalf("failed to setup ServiceAccounts server: %v", err)
}
// start legacy service account token cleaner
startLegacyServiceAccountTokenCleaner(ctx, c, fakeClock, informers)
// wait configmap to label with tracking date
if err := wait.PollImmediate(time.Second, 10*time.Second, func() (bool, error) {
configMap, err := c.CoreV1().ConfigMaps(metav1.NamespaceSystem).Get(ctx, legacytokentracking.ConfigMapName, metav1.GetOptions{})
@ -78,21 +72,11 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
t.Fatalf("failed to wait configmap starts to track: %v", err)
}
// create service account
myns := "clean-ns"
_, err = c.CoreV1().Namespaces().Create(context.TODO(), &v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: myns}}, metav1.CreateOptions{})
if err != nil && !apierrors.IsAlreadyExists(err) {
t.Fatalf("could not create namespace: %v", err)
}
mysa, err := c.CoreV1().ServiceAccounts(myns).Create(context.TODO(), &v1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: readOnlyServiceAccountName}}, metav1.CreateOptions{})
if err != nil {
t.Fatalf("Service Account not created: %v", err)
}
tests := []struct {
name string
secretName string
secretTokenData string
namespace string
expectCleanedUp bool
lastUsedLabel bool
isPodMounted bool
@ -101,6 +85,7 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
{
name: "auto created legacy token without pod binding",
secretName: "auto-token-without-pod-mounting-a",
namespace: "clean-ns-1",
lastUsedLabel: true,
isManual: false,
isPodMounted: false,
@ -109,6 +94,7 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
{
name: "manually created legacy token",
secretName: "manual-token",
namespace: "clean-ns-2",
lastUsedLabel: true,
isManual: true,
isPodMounted: false,
@ -117,6 +103,7 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
{
name: "auto created legacy token with pod binding",
secretName: "auto-token-with-pod-mounting",
namespace: "clean-ns-3",
lastUsedLabel: true,
isManual: false,
isPodMounted: true,
@ -125,6 +112,7 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
{
name: "auto created legacy token without pod binding, secret has not been used after tracking",
secretName: "auto-token-without-pod-mounting-b",
namespace: "clean-ns-4",
lastUsedLabel: false,
isManual: false,
isPodMounted: false,
@ -133,19 +121,38 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
}
for _, test := range tests {
t.Run(test.name, func(t *testing.T) {
fakeClock := testingclock.NewFakeClock(time.Now().UTC())
// start legacy service account token cleaner
ctxForCleaner, cancelFunc := context.WithCancel(context.Background())
startLegacyServiceAccountTokenCleaner(ctxForCleaner, c, fakeClock, informers)
informers.Start(ctx.Done())
defer cancelFunc()
// create service account
_, err = c.CoreV1().Namespaces().Create(context.TODO(), &v1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: test.namespace}}, metav1.CreateOptions{})
if err != nil && !apierrors.IsAlreadyExists(err) {
t.Fatalf("could not create namespace: %v", err)
}
mysa, err := c.CoreV1().ServiceAccounts(test.namespace).Create(context.TODO(), &v1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: readOnlyServiceAccountName}}, metav1.CreateOptions{})
if err != nil {
t.Fatalf("Service Account not created: %v", err)
}
// create secret
secret, err := createServiceAccountToken(c, mysa, myns, test.secretName)
secret, err := createServiceAccountToken(c, mysa, test.namespace, test.secretName)
if err != nil {
t.Fatalf("Secret not created: %v", err)
}
if !test.isManual {
if err := addReferencedServiceAccountToken(c, myns, readOnlyServiceAccountName, secret); err != nil {
if err := addReferencedServiceAccountToken(c, test.namespace, readOnlyServiceAccountName, secret); err != nil {
t.Fatal(err)
}
}
podLister := informers.Core().V1().Pods().Lister()
if test.isPodMounted {
_, err = createAutotokenMountedPod(c, myns, test.secretName, podLister)
_, err = createAutotokenMountedPod(c, test.namespace, test.secretName, podLister)
if err != nil {
t.Fatalf("Pod not created: %v", err)
}
@ -158,7 +165,7 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
roClient := clientset.NewForConfigOrDie(&myConfig)
// the secret should not be labeled with LastUsedLabelKey.
liveSecret, err := c.CoreV1().Secrets(myns).Get(context.TODO(), test.secretName, metav1.GetOptions{})
liveSecret, err := c.CoreV1().Secrets(test.namespace).Get(context.TODO(), test.secretName, metav1.GetOptions{})
if err != nil {
t.Fatalf("Could not get secret: %v", err)
}
@ -169,9 +176,9 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
// authenticate legacy tokens
if test.lastUsedLabel {
doServiceAccountAPIRequests(t, roClient, myns, true, true, false)
doServiceAccountAPIRequests(t, roClient, test.namespace, true, true, false)
// all service account tokens should be labeled with LastUsedLabelKey.
liveSecret, err = c.CoreV1().Secrets(myns).Get(context.TODO(), test.secretName, metav1.GetOptions{})
liveSecret, err = c.CoreV1().Secrets(test.namespace).Get(context.TODO(), test.secretName, metav1.GetOptions{})
if err != nil {
t.Fatalf("Could not get secret: %v", err)
}
@ -185,7 +192,7 @@ func TestLegacyServiceAccountTokenCleanUp(t *testing.T) {
fakeClock.Step(cleanUpPeriod + 24*time.Hour)
time.Sleep(2 * syncInterval)
liveSecret, err = c.CoreV1().Secrets(myns).Get(context.TODO(), test.secretName, metav1.GetOptions{})
liveSecret, err = c.CoreV1().Secrets(test.namespace).Get(context.TODO(), test.secretName, metav1.GetOptions{})
if test.expectCleanedUp {
if err == nil {
t.Fatalf("The secret %s should be cleaned up. time: %v; creationTime: %v", test.secretName, fakeClock.Now().UTC(), liveSecret.CreationTimestamp)
@ -215,7 +222,6 @@ func startLegacyServiceAccountTokenCleaner(ctx context.Context, client clientset
CleanUpPeriod: cleanUpPeriod,
})
go legacySATokenCleaner.Run(ctx)
informers.Start(ctx.Done())
}
func createAutotokenMountedPod(c clientset.Interface, ns, secretName string, podLister listersv1.PodLister) (*v1.Pod, error) {