No longer assume that K8s creates a token for all ServiceAccounts #3730
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
@tnqn let me know if you think we should keep the manual installation document |
antoninbas
added
the
action/release-note
Codecov Report
@@ Coverage Diff @@
## main #3730 +/- ##
===========================================
- Coverage 64.44% 46.24% -18.20%
===========================================
Files 278 245 -33
Lines 39513 35770 -3743
===========================================
- Hits 25463 16541 -8922
- Misses 12068 17596 +5528
+ Partials 1982 1633 -349
Flags with carried forward coverage won't be shown. Click here to find out more.
|
The assumption that a secret token is automatically created for each ServiceAccount is not valid anymore, starting with K8s v1.24. We make the following changes: - create a Secret in our reference Prometheus manifest for the `prometheus` ServiceAccount; this addresses the failure in Prometheus e2e tests. - create a Secret in the Antrea manifest for the antctl and antrea-agent ServiceAccount (but not for the antrea-controller ServiceAccount). Note that the token for the antrea-agent ServiceAccount is only really necessary when running the Antrea Agent as a process on Windows Nodes, so in the future we may want to conditionally generate the Secret only for that use case. - remove the manual installation instructions: the instructions require a token for the antrea-controller ServiceAccount, but we don't have one anymore. The instructions are also outdated (e.g., we no longer have ready-to-use RBAC manifests), and running the Agent manually is likely to work sub-optimally (no downward API so missing environment variables). Fixes antrea-io#3729 Signed-off-by: Antonin Bas <abas@vmware.com>
antoninbas
force-pushed
the
stop-relying-on-autogenerated-tokens-for-serviceaccounts
branch
from
ed39351
to
ffe26cf
Compare
antoninbas
commented
May 4, 2022
| @@ -176,13 +176,14 @@ using the authentication token of the `antctl` ServiceAccount: | |||
|
|
|||
| ```bash | |||
| # Get the token value of antctl account. | |||
| TOKEN=$(kubectl get secrets -n kube-system -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='antctl')].data.token}"|base64 --decode) | |||
| TOKEN=$(kubectl get secret/antctl-service-account-token -n kube-system -o jsonpath="{.data.token}"|base64 --decode) | |||
There was a problem hiding this comment.
this will not work for old versions of Antrea. The alternative is:
kubectl get secrets -o jsonpath="{.items[?(@.metadata.annotations['kubernetes\.io/service-account\.name']=='sa-test')].data.token}" | awk '{print $1}' | base64 --decode
but that requires awk
Unfortunately K8s jsonpath does not support selecting the first element after applying a filter expression. If we don't use awk, we may get 2 tokens for K8s versions before v1.24 (auto-generated secret, plus secret/antctl-service-account-token), which will not work.
I'm fine with removing it given that it has been outdated for a while and there was no complaint about it. |
|
/test-all |
antoninbas
deleted the
stop-relying-on-autogenerated-tokens-for-serviceaccounts
branch
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The assumption that a secret token is automatically created for each
ServiceAccount is not valid anymore, starting with K8s v1.24.
We make the following changes:
prometheusServiceAccount; this addresses the failure in Prometheus e2e tests.
ServiceAccount (but not for the antrea-controller ServiceAccount). Note that
the token for the antrea-agent ServiceAccount is only really necessary when
running the Antrea Agent as a process on Windows Nodes, so in the future we
may want to conditionally generate the Secret only for that use case.
for the antrea-controller ServiceAccount, but we don't have one anymore. The
instructions are also outdated (e.g., we no longer have ready-to-use RBAC
manifests), and running the Agent manually is likely to work sub-optimally (no
downward API so missing environment variables).
Fixes #3729
Signed-off-by: Antonin Bas abas@vmware.com