Merge pull request openshift#24178 from deads2k/simplify-more

Simplify kube-apiserver patches

test/extended/oauth/oauthcertfallback.go

@@ -94,7 +94,7 @@ var _ = g.Describe("[Feature:OAuthServer] OAuth server", func() {
 			"valid token, valid cert": {
 				token:        validToken,
 				cert:         validCert,
-				expectedUser: tokenUser,
+				expectedUser: certUser,
 			},
 			"valid token, invalid cert": {
 				token:        validToken,
@@ -107,10 +107,9 @@ var _ = g.Describe("[Feature:OAuthServer] OAuth server", func() {
 				expectedUser: tokenUser,
 			},
 			"invalid token, valid cert": {
-				token:         invalidToken,
-				cert:          validCert,
-				errorExpected: true,
-				errorString:   unauthorizedError,
+				token:        invalidToken,
+				cert:         validCert,
+				expectedUser: certUser,
 			},
 			"invalid token, invalid cert": {
 				token:         invalidToken,

test/extended/testdata/cmd/test/cmd/admin.sh

@@ -324,10 +324,12 @@ os::cmd::expect_success 'oc get sa my-sa-name'
 
 # extract token and ensure it links us back to the service account
 os::cmd::try_until_success 'oc sa get-token my-sa-name'
-os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa get-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
+# TODO re-enable once we can use tokens instead of certs
+#os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa get-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
 
 # add a new token and ensure it links us back to the service account
-os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa new-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
+# TODO re-enable once we can use tokens instead of certs
+#os::cmd::expect_success_and_text 'oc get user/~ --token="$( oc sa new-token my-sa-name )"' 'system:serviceaccount:.+:my-sa-name'
 
 # add a new labeled token and ensure the label stuck
 os::cmd::expect_success 'oc sa new-token my-sa-name --labels="mykey=myvalue,myotherkey=myothervalue"'

test/extended/testdata/cmd/test/cmd/basicresources.sh

@@ -310,7 +310,8 @@ echo "delete all: ok"
 os::test::junit::declare_suite_end
 
 # service accounts should not be allowed to request new projects
-os::cmd::expect_failure_and_text "oc new-project --token='$( oc sa get-token builder )' will-fail" 'Error from server \(Forbidden\): You may not request a new project via this API.'
+# TODO re-enable once we can use tokens instead of certs
+#os::cmd::expect_failure_and_text "oc new-project --token='$( oc sa get-token builder )' will-fail" 'Error from server \(Forbidden\): You may not request a new project via this API.'
 
 os::test::junit::declare_suite_start "cmd/basicresources/patch"
 # Validate patching works correctly