From b6aebb0e4b1b22c43c7426ed6ffaf5a8c890bd93 Mon Sep 17 00:00:00 2001 From: "Dr. Stefan Schimanski" Date: Sun, 21 Jul 2024 22:04:38 +0200 Subject: [PATCH] options/authentication: fix serviceaccount TokenGetter with ServiceAccountTokenNodeBindingValidation Signed-off-by: Dr. Stefan Schimanski --- pkg/kubeapiserver/options/authentication.go | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/pkg/kubeapiserver/options/authentication.go b/pkg/kubeapiserver/options/authentication.go index 61335b58fc3..05666739265 100644 --- a/pkg/kubeapiserver/options/authentication.go +++ b/pkg/kubeapiserver/options/authentication.go @@ -676,15 +676,15 @@ func (o *BuiltInAuthenticationOptions) ApplyTo( authInfo.APIAudiences = authenticator.Audiences(o.ServiceAccounts.Issuers) } - var nodeLister v1listers.NodeLister - if utilfeature.DefaultFeatureGate.Enabled(features.ServiceAccountTokenNodeBindingValidation) { - nodeLister = versionedInformer.Core().V1().Nodes().Lister() - } - // If the optional token getter function is set, use it. Otherwise, use the default token getter. if o.ServiceAccounts != nil && o.ServiceAccounts.OptionalTokenGetter != nil { authenticatorConfig.ServiceAccountTokenGetter = o.ServiceAccounts.OptionalTokenGetter(versionedInformer) } else { + var nodeLister v1listers.NodeLister + if utilfeature.DefaultFeatureGate.Enabled(features.ServiceAccountTokenNodeBindingValidation) { + nodeLister = versionedInformer.Core().V1().Nodes().Lister() + } + authenticatorConfig.ServiceAccountTokenGetter = serviceaccountcontroller.NewGetterFromClient( extclient, versionedInformer.Core().V1().Secrets().Lister(),