fix: set default token expiration to 1h #247
Conversation
The kubernetes default for projected service account token is 1h. Using the same expiry value to be conformant. The minimum is 1h and max is 24h. Signed-off-by: Anish Ramasekar <anish.ramasekar@gmail.com>
| @@ -112,7 +112,8 @@ test_helm_chart() { | |||
| --create-namespace \ | |||
| --wait | |||
| poll_webhook_readiness | |||
| make test-e2e-run | |||
| # TODO(aramase) remove the service account token expiration after v0.7.0 release | |||
| E2E_EXTRA_ARGS=-e2e.service-account-token-expiration=24h make test-e2e-run | |||
There was a problem hiding this comment.
The reason why we added this is that we want to test the upgrade path where the default token expiration is changed from 24h to 1h right?
There was a problem hiding this comment.
On the contrary, we're adding that because the default expiry is 24h in case of webhook v0.6.0 and is 1h with this change. We're using that flag to determine what value to check based on the webhook version we're deploying.
We don't have in-place upgrade tests in our test suite, i.e we don't have a pod that's retained while we upgrade webhook version n to n+1.
so with webhook v0.6.0 we'll use 24h in test when we check the projected service account token volume and for upgrade to the code in main branch we'll check if it's equal to 1h.
The kubernetes default for projected service account token is 1h. Using
the same expiry value to be conformant. The minimum is 1h and max is
24h.
Signed-off-by: Anish Ramasekar anish.ramasekar@gmail.com
Reason for Change:
Requirements
Issue Fixed:
fixes #245
Please answer the following questions with yes/no:
Does this change contain code from or inspired by another project? If so, did you notify the maintainers and provide attribution?
Notes for Reviewers: