From 3c8925cc12a54869aa475f226b752a13657b55fe Mon Sep 17 00:00:00 2001
From: Kinara Shah <kinara@rancher.com>
Date: Tue, 28 Jun 2022 16:14:35 -0700
Subject: [PATCH] wait for svc account secret to be populated with token

---
 pkg/podimpersonation/podimpersonation.go | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/pkg/podimpersonation/podimpersonation.go b/pkg/podimpersonation/podimpersonation.go
index c346a3b..30e3ced 100644
--- a/pkg/podimpersonation/podimpersonation.go
+++ b/pkg/podimpersonation/podimpersonation.go
@@ -348,7 +348,19 @@ func (s *PodImpersonation) createPod(ctx context.Context, user user.Info, role *
 	if err != nil {
 		return nil, err
 	}
-
+	if _, ok := tokenSecret.Data[v1.ServiceAccountTokenKey]; !ok {
+		for {
+			logrus.Debugf("wait for svc account secret to be populated with token %s", tokenSecret.Name)
+			time.Sleep(2 * time.Second)
+			tokenSecret, err = client.CoreV1().Secrets(sa.Namespace).Get(ctx, sc.Name, metav1.GetOptions{})
+			if err != nil {
+				return nil, err
+			}
+			if _, ok := tokenSecret.Data[v1.ServiceAccountTokenKey]; ok {
+				break
+			}
+		}
+	}
 	pod = s.augmentPod(pod, sa, tokenSecret, podOptions.ImageOverride)
 
 	if err := s.createConfigMaps(ctx, user, role, pod, podOptions, client); err != nil {
@@ -358,7 +370,6 @@ func (s *PodImpersonation) createPod(ctx context.Context, user user.Info, role *
 	if err := s.createSecrets(ctx, role, pod, podOptions, client); err != nil {
 		return nil, err
 	}
-
 	pod.OwnerReferences = ref(role)
 	if pod.Annotations == nil {
 		pod.Annotations = map[string]string{}