Merge pull request #28655 from sanchezl/no-token-secrets-01

NO-JIRA: Use bound prometheus-k8s API tokens

test/extended/controller_manager/pull_secret.go

@@ -18,44 +18,6 @@ import (
 	exutil "github.com/openshift/origin/test/extended/util"
 )
 
-func waitForServiceAccountToken(client kubernetes.Interface, ns, name string, attempts int, interval time.Duration) (string, error) {
-	for i := 0; i <= attempts; i++ {
-		time.Sleep(interval)
-		token, err := getServiceAccountToken(client, ns, name)
-		if err != nil {
-			return "", err
-		}
-		if len(token) > 0 {
-			return token, nil
-		}
-	}
-	return "", nil
-}
-
-func getServiceAccountToken(client kubernetes.Interface, ns, name string) (string, error) {
-	secrets, err := client.CoreV1().Secrets(ns).List(context.Background(), metav1.ListOptions{})
-	if err != nil {
-		return "", err
-	}
-	for _, secret := range secrets.Items {
-		if secret.Type == corev1.SecretTypeServiceAccountToken && secret.Annotations[corev1.ServiceAccountNameKey] == name {
-			sa, err := client.CoreV1().ServiceAccounts(ns).Get(context.Background(), name, metav1.GetOptions{})
-			if err != nil {
-				return "", err
-			}
-
-			for _, ref := range sa.Secrets {
-				if ref.Name == secret.Name {
-					return string(secret.Data[corev1.ServiceAccountTokenKey]), nil
-				}
-			}
-
-		}
-	}
-
-	return "", nil
-}
-
 var _ = g.Describe("[sig-devex][Feature:OpenShiftControllerManager]", func() {
 	defer g.GinkgoRecover()
 	oc := exutil.NewCLI("pull-secrets")
@@ -111,7 +73,14 @@ func getServiceAccountPullSecret(client kubernetes.Interface, ns, name string) (
 		return "", "", err
 	}
 	for _, secret := range secrets.Items {
-		if secret.Type == corev1.SecretTypeDockercfg && secret.Annotations[corev1.ServiceAccountNameKey] == name {
+		if secret.Type != corev1.SecretTypeDockercfg {
+			continue
+		}
+		if secret.Annotations["openshift.io/internal-registry-auth-token.service-account"] == name {
+			return secret.Name, string(secret.Data[corev1.DockerConfigKey]), nil
+		}
+		// TODO remove after 4.16
+		if secret.Annotations[corev1.ServiceAccountNameKey] == name {
 			return secret.Name, string(secret.Data[corev1.DockerConfigKey]), nil
 		}
 	}
@@ -159,6 +128,13 @@ var _ = g.Describe("[sig-devex][Feature:OpenShiftControllerManager]", func() {
 		if err != nil {
 			t.Fatalf("unexpected error: %v", err)
 		}
+
+		// TODO the rest of this test can be removed after 4.16
+
+		if dockercfgSecret.Annotations["openshift.io/internal-registry-auth-token.binding"] == "bound" {
+			// image pull secret auth contains bound service account API tokens so no service account API token secret to be found
+			return
+		}
 		secretName := dockercfgSecret.Annotations["openshift.io/token-secret.name"]
 		if len(secretName) == 0 {
 			t.Fatal("secret was not created")