tests: create openshift-monitoring token in e2e
As part of 1.24 kube rebase, API access tokens are no longer created
for SAs. Instead of trying to use the default one, our e2e test
should be instead requesting one on the fly.
Fixes e2e-gcp-op failures.
@@ -20,6 +20,7 @@ import (
"github.com/stretchr/testify/assert"
"github.com/stretchr/testify/require"
"github.com/vincent-petithory/dataurl"
+ authenticationv1 "k8s.io/api/authentication/v1"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/fields"
@@ -266,22 +267,20 @@ func WaitForPausedConfig(t *testing.T, cs *framework.ClientSet, pool string) err
// GetMonitoringToken retrieves the token from the openshift-monitoring secrets in the prometheus-k8s namespace.
// It is equivalent to "oc sa get-token prometheus-k8s -n openshift-monitoring"
func GetMonitoringToken(t *testing.T, cs *framework.ClientSet) (string, error) {
- sa, err := cs.ServiceAccounts("openshift-monitoring").Get(context.TODO(), "prometheus-k8s", metav1.GetOptions{})
- if err != nil {
- return "", fmt.Errorf("failed to retrieve service account: %w", err)
- }
- for _, secret := range sa.Secrets {
- if strings.HasPrefix(secret.Name, "prometheus-k8s-token") {
- sec, err := cs.Secrets("openshift-monitoring").Get(context.TODO(), secret.Name, metav1.GetOptions{})
+ token, err := cs.
+ ServiceAccounts("openshift-monitoring").
+ CreateToken(
+ context.TODO(),
+ "prometheus-k8s",
+ &authenticationv1.TokenRequest{
+ Spec: authenticationv1.TokenRequestSpec{},
+ },
+ metav1.CreateOptions{},
+ )
if err != nil {
- return "", fmt.Errorf("failed to retrieve monitoring secret: %w", err)
- }
- if token, ok := sec.Data["token"]; ok {
- return string(token), nil
- }
- }
+ return "", fmt.Errorf("Could not request openshift-monitoring token")
}
- return "", fmt.Errorf("No token found in openshift-monitoring secrets")
+ return token.Status.Token, nil
}
// ForceKubeApiserverCertificateRotation sets the kube-apiserver-to-kubelet-signer's not-after date to nil, which causes the
