Skip to content

Backport of Update server-acl-init to always check for the deployed serviceAccountToken secret into release/1.0.x#1905

Closed
thisisnotashwin wants to merge 2 commits intorelease/1.0.xfrom
backport/test_fix_server_acl_init_openshift/evenly-harmless-kingfish
Closed

Backport of Update server-acl-init to always check for the deployed serviceAccountToken secret into release/1.0.x#1905
thisisnotashwin wants to merge 2 commits intorelease/1.0.xfrom
backport/test_fix_server_acl_init_openshift/evenly-harmless-kingfish

Conversation

@thisisnotashwin
Copy link
Copy Markdown
Contributor

Backport

This PR is auto-generated from #1770 to be assessed for backporting due to the inclusion of the label backport/1.0.x.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

merge conflict error: POST https://api.github.com/repos/hashicorp/consul-k8s/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.


Changes proposed in this PR:

  • OpenShift injects SecretRefs into ServiceAccounts (one for service account and the other for docker registry credentials), even in Kubernetes 1.24+. In the current logic of server-acl-init we expect to use the Secret deployed by the helm chart, but only in the case where the ServiceAccount does not contain SecretRefs. Due to OpenShift injecting these we never look for the deployed Secret for the consul-auth-method.
  • Since the helm chart and consul-k8s versions are sync'd and we do not have backward compatibility issues we should be able to rely on the consul auth method Secret always existing and we should use that.
  • I believe this should resolve Consul-server-acl-init found no secret of type 'kubernetes.io/service-account-token' associated with the consul-auth-method service account #1768.

How I've tested this PR:
Unit + acceptance tests should pass.

How I expect reviewers to test this PR:
👀
Looking for some review comments about the approach as well :)

Checklist:

  • Tests added
  • CHANGELOG entry added

    HashiCorp engineers only, community PRs should not add a changelog entry.
    Entries should use present tense (e.g. Add support for...)


Overview of commits

@thisisnotashwin thisisnotashwin force-pushed the backport/test_fix_server_acl_init_openshift/evenly-harmless-kingfish branch 2 times, most recently from 1a55027 to 249e32c Compare February 14, 2023 16:21
@thisisnotashwin thisisnotashwin marked this pull request as ready for review February 14, 2023 16:30
@thisisnotashwin thisisnotashwin deleted the backport/test_fix_server_acl_init_openshift/evenly-harmless-kingfish branch April 17, 2023 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants