fix: update interceptor.go and docs

Signed-off-by: Yuan Tang <[email protected]>
argoproj · Sep 25, 2022 · 7b4e2f6 · 7b4e2f6
1 parent 76832b0
commit 7b4e2f6
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 3 deletions.
diff --git a/docs/access-token.md b/docs/access-token.md
@@ -36,8 +36,16 @@ kubectl create rolebinding jenkins --role=jenkins --serviceaccount=argo:jenkins
 You now need to get a token:
 
 ```bash
-SECRET=$(kubectl get sa jenkins -o=jsonpath='{.secrets[0].name}')
-ARGO_TOKEN="Bearer $(kubectl get secret $SECRET -o=jsonpath='{.data.token}' | base64 --decode)"
+kubectl apply -f - <<EOF
+    apiVersion: v1
+    kind: Secret
+    metadata:
+      name: jenkins-secret
+      annotations:
+        kubernetes.io/service-account.name: jenkins
+    type: kubernetes.io/service-account-token
+EOF
+ARGO_TOKEN="Bearer $(kubectl get secret jenkins-secret -o=jsonpath='{.data.token}' | base64 --decode)"
 echo $ARGO_TOKEN
 Bearer ZXlKaGJHY2lPaUpTVXpJMU5pSXNJbXRwWkNJNkltS...
 ```

diff --git a/server/auth/webhook/interceptor.go b/server/auth/webhook/interceptor.go
@@ -3,6 +3,7 @@ package webhook
 import (
 	"bytes"
 	"fmt"
+	"github.com/argoproj/argo-workflows/v3/util/secrets"
 	"io/ioutil"
 	"net/http"
 	"strings"
@@ -87,7 +88,7 @@ func addWebhookAuthorization(r *http.Request, kube kubernetes.Interface) error {
 			if len(serviceAccount.Secrets) == 0 {
 				return fmt.Errorf("failed to get secret for service account \"%s\": no secrets", serviceAccountName)
 			}
-			tokenSecret, err := secretsInterface.Get(ctx, serviceAccount.Secrets[0].Name, metav1.GetOptions{})
+			tokenSecret, err := secretsInterface.Get(ctx, secrets.SecretName(serviceAccount), metav1.GetOptions{})
 			if err != nil {
 				return fmt.Errorf("failed to get token secret \"%s\": %w", tokenSecret, err)
 			}