BoundServiceAccountTokenVolume: fix InClusterConfig

[mikedanese]

Missed this in dba85e58deba and rest.Config is dropping BearerTokenFile path before the token source is created. This is causing InClusterConfig to not refresh tokens from disk.

😢 😭

I'm thinking about how to get some test coverage here.

/kind bug
/sig auth

NONE

Fixes #77651

[liggitt]

/lgtm
/approve

/hold
this desperately needs a test

[liggitt]

I0508 20:16:54.000] should handle in-cluster config [It]
I0508 20:16:54.000] test/e2e/kubectl/kubectl.go:616
I0508 20:16:54.000]
I0508 20:16:54.000] Expected an error to have occurred. Got:
I0508 20:16:54.000] <nil>: nil

I think we also need these to ensure the overridden command line --token trumps:

diff --git a/staging/src/k8s.io/apiserver/pkg/util/webhook/authentication.go b/staging/src/k8s.io/apiserver/pkg/util/webhook/authentication.go
index fb6a7fa3ba..dda51b60d2 100644
--- a/staging/src/k8s.io/apiserver/pkg/util/webhook/authentication.go
+++ b/staging/src/k8s.io/apiserver/pkg/util/webhook/authentication.go
@@ -171,6 +171,7 @@ func restConfigFromKubeconfig(configAuthInfo *clientcmdapi.AuthInfo) (*rest.Conf
        // blindly overwrite existing values based on precedence
        if len(configAuthInfo.Token) > 0 {
                config.BearerToken = configAuthInfo.Token
+               config.BearerTokenFile = configAuthInfo.TokenFile
        } else if len(configAuthInfo.TokenFile) > 0 {
                tokenBytes, err := ioutil.ReadFile(configAuthInfo.TokenFile)
                if err != nil {
diff --git a/staging/src/k8s.io/client-go/tools/clientcmd/client_config.go b/staging/src/k8s.io/client-go/tools/clientcmd/client_config.go
index 878e0df79f..c62ee03c77 100644
--- a/staging/src/k8s.io/client-go/tools/clientcmd/client_config.go
+++ b/staging/src/k8s.io/client-go/tools/clientcmd/client_config.go
@@ -228,6 +228,7 @@ func (config *DirectClientConfig) getUserIdentificationPartialConfig(configAuthI
        // blindly overwrite existing values based on precedence
        if len(configAuthInfo.Token) > 0 {
                mergedConfig.BearerToken = configAuthInfo.Token
+               mergedConfig.BearerTokenFile = configAuthInfo.TokenFile
        } else if len(configAuthInfo.TokenFile) > 0 {
                tokenBytes, err := ioutil.ReadFile(configAuthInfo.TokenFile)
                if err != nil {
@@ -491,6 +492,7 @@ func (config *inClusterClientConfig) ClientConfig() (*restclient.Config, error)
                }
                if token := config.overrides.AuthInfo.Token; len(token) > 0 {
                        icc.BearerToken = token
+                       icc.BearerTokenFile = ""
                }
                if certificateAuthorityFile := config.overrides.ClusterInfo.CertificateAuthority; len(certificateAuthorityFile) > 0 {
                        icc.TLSClientConfig.CAFile = certificateAuthorityFile

[mikedanese]

I'm headed down the path of creating a new test image and e2e for in cluster config. Feel free to stop me if you have any bright ideas.

[mikedanese]

This test works now but its slow (~10 minutes). It's pretty gross because I want it to run on non-alpha clusters. I could drop a bunch of stuff if we are ok with this only running in the alpha test suite.

[mikedanese]

Also it will still be slow even if we only run it in the alpha suite, just way smaller.

[liggitt]

I don't think we check feature gates in the e2e process (it's not even the same process as the apiserver)... typically we indicate non-default features with feature tags in the test description

[mikedanese]

Ya, fixed.

[liggitt]

would it make sense to split the e2e test into its own commit? were you planning to pick the test back to 1.12/1.13/1.14 as well?

[liggitt]

the test is ugly, but I want coverage more than beauty at the moment. with the [Slow] and [Feature] tags, do we know what suite this will run in so we can monitor it?

/lgtm
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: liggitt, mikedanese

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• staging/src/k8s.io/apiserver/OWNERS [liggitt]
• staging/src/k8s.io/client-go/OWNERS [liggitt]
• test/e2e/auth/OWNERS [liggitt,mikedanese]
• test/images/OWNERS [liggitt,mikedanese]
• test/utils/image/OWNERS [liggitt,mikedanese]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[liggitt]

/hold cancel

[mikedanese]

/retest

[mikedanese]

/retest

[mikedanese]

/retest