Add awaiter for service-account-token secret

CHANGELOG.md

@@ -1,6 +1,7 @@
 ## Unreleased
 
 - Implement Server-Side Apply mode (https://github.com/pulumi/pulumi-kubernetes/pull/2029)
+- Add awaiter for service-account-token secret (https://github.com/pulumi/pulumi-kubernetes/pull/2048)
 
 ## 3.19.4 (June 21, 2022)
 

provider/pkg/await/awaiters.go

@@ -223,7 +223,9 @@ var awaiters = map[string]awaitSpec{
 		awaitCreation: untilCoreV1ResourceQuotaInitialized,
 		awaitUpdate:   untilCoreV1ResourceQuotaUpdated,
 	},
-	coreV1Secret: { /* NONE */ },
+	coreV1Secret: {
+		awaitCreation: untilCoreV1SecretInitialized,
+	},
 	coreV1Service: {
 		awaitCreation: awaitServiceInit,
 		awaitRead:     awaitServiceRead,
@@ -613,6 +615,44 @@ func untilCoreV1ResourceQuotaUpdated(c updateAwaitConfig) error {
 
 // --------------------------------------------------------------------------
 
+// core/v1/Secret
+
+// --------------------------------------------------------------------------
+
+func untilCoreV1SecretInitialized(c createAwaitConfig) error {
+	//
+	// Some types secrets do not have data available immediately and therefore are not considered initialized where data map is empty.
+	// For example service-account-token as described in the docs: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#to-create-additional-api-tokens
+	//
+	secretType, _ := openapi.Pluck(c.currentInputs.Object, "type")
+
+	// Other secret types are not generated by controller therefore we do not need to create a watcher for them.
+	// nolint:gosec
+	if secretType != "kubernetes.io/service-account-token" {
+		return nil
+	}
+
+	secretDataAllocated := func(secret *unstructured.Unstructured) bool {
+		data, _ := openapi.Pluck(secret.Object, "data")
+		if secretData, isMap := data.(map[string]interface{}); isMap {
+			// We don't need to wait for any specific initialization. Most of the time we create a secret with
+			// empty data which are propagated by controller so it's enough to check if data map is not empty.
+			return len(secretData) > 0
+		}
+		return false
+	}
+
+	client, err := c.clientSet.ResourceClient(c.currentOutputs.GroupVersionKind(), c.currentOutputs.GetNamespace())
+	if err != nil {
+		return err
+	}
+
+	return watcher.ForObject(c.ctx, client, c.currentOutputs.GetName()).
+		WatchUntil(secretDataAllocated, 5*time.Second)
+}
+
+// --------------------------------------------------------------------------
+
 // core/v1/ServiceAccount
 
 // --------------------------------------------------------------------------

tests/sdk/nodejs/nodejs_test.go

@@ -1098,3 +1098,23 @@ func TestReplaceDaemonSet(t *testing.T) {
 	})
 	integration.ProgramTest(t, &test)
 }
+
+func TestServiceAccountTokenSecret(t *testing.T) {
+	test := baseOptions.With(integration.ProgramTestOptions{
+		Dir:           filepath.Join("service-account-token-secret", "step1"),
+		Quick:         true,
+		ExpectFailure: false,
+		SkipRefresh:   true,
+		ExtraRuntimeValidation: func(t *testing.T, stackInfo integration.RuntimeValidationStackInfo) {
+			assert.NotNil(t, stackInfo.Deployment)
+			_, err := json.Marshal(stackInfo.Deployment)
+			assert.NoError(t, err)
+
+			secretData := stackInfo.Outputs["data"].(map[string]interface{})
+
+			assert.Contains(t, secretData, "ca.crt")
+			assert.Contains(t, secretData, "token")
+		},
+	})
+	integration.ProgramTest(t, &test)
+}

tests/sdk/nodejs/service-account-token-secret/step1/Pulumi.yaml

@@ -0,0 +1,3 @@
+name: service-account-token-secret
+description: Test for service account token.
+runtime: nodejs

tests/sdk/nodejs/service-account-token-secret/step1/index.ts

@@ -0,0 +1,37 @@
+// Copyright 2016-2022, Pulumi Corporation.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+import * as pulumi from "@pulumi/pulumi";
+import * as k8s from "@pulumi/kubernetes";
+
+const namespace = new k8s.core.v1.Namespace("test-namespace");
+
+const serviceAccount = new k8s.core.v1.ServiceAccount("test-service-account", {
+    metadata: {
+        namespace: namespace.metadata.namespace,
+    },
+});
+
+const secret = new k8s.core.v1.Secret("test-service-account-token-secret", {
+    metadata: {
+        name: "test",
+        namespace: namespace.metadata.namespace,
+        annotations: {
+            "kubernetes.io/service-account.name": serviceAccount.metadata.name,
+        },
+    },
+    type: "kubernetes.io/service-account-token",
+});
+
+export const data: pulumi.Output<{[key: string]: string}> = pulumi.unsecret(secret.data);

tests/sdk/nodejs/service-account-token-secret/step1/package.json

@@ -0,0 +1,12 @@
+{
+    "name": "secrets",
+    "version": "0.1.0",
+    "dependencies": {
+        "@pulumi/pulumi": "latest"
+    },
+    "devDependencies": {
+    },
+    "peerDependencies": {
+        "@pulumi/kubernetes": "latest"
+    }
+}

tests/sdk/nodejs/service-account-token-secret/step1/tsconfig.json

@@ -0,0 +1,21 @@
+{
+    "compilerOptions": {
+        "outDir": "bin",
+        "target": "es6",
+        "module": "commonjs",
+        "moduleResolution": "node",
+        "declaration": true,
+        "sourceMap": true,
+        "stripInternal": true,
+        "experimentalDecorators": true,
+        "pretty": true,
+        "noFallthroughCasesInSwitch": true,
+        "noImplicitAny": true,
+        "noImplicitReturns": true,
+        "forceConsistentCasingInFileNames": true,
+        "strictNullChecks": true
+    },
+    "files": [
+        "index.ts"
+    ]
+}