Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Backport of Update server-acl-init to always check for the deployed serviceAccountToken secret into release/1.0.x #1905

Conversation

thisisnotashwin
Copy link
Contributor

Backport

This PR is auto-generated from #1770 to be assessed for backporting due to the inclusion of the label backport/1.0.x.

WARNING automatic cherry-pick of commits failed. Commits will require human attention.

merge conflict error: POST https://api.github.com/repos/hashicorp/consul-k8s/merges: 409 Merge conflict []

The below text is copied from the body of the original PR.


Changes proposed in this PR:

  • OpenShift injects SecretRefs into ServiceAccounts (one for service account and the other for docker registry credentials), even in Kubernetes 1.24+. In the current logic of server-acl-init we expect to use the Secret deployed by the helm chart, but only in the case where the ServiceAccount does not contain SecretRefs. Due to OpenShift injecting these we never look for the deployed Secret for the consul-auth-method.
  • Since the helm chart and consul-k8s versions are sync'd and we do not have backward compatibility issues we should be able to rely on the consul auth method Secret always existing and we should use that.
  • I believe this should resolve Consul-server-acl-init found no secret of type 'kubernetes.io/service-account-token' associated with the consul-auth-method service account #1768.

How I've tested this PR:
Unit + acceptance tests should pass.

How I expect reviewers to test this PR:
👀
Looking for some review comments about the approach as well :)

Checklist:

  • Tests added
  • CHANGELOG entry added

    HashiCorp engineers only, community PRs should not add a changelog entry.
    Entries should use present tense (e.g. Add support for...)


Overview of commits

@thisisnotashwin thisisnotashwin force-pushed the backport/test_fix_server_acl_init_openshift/evenly-harmless-kingfish branch 2 times, most recently from 1a55027 to 249e32c Compare February 14, 2023 16:21
@thisisnotashwin thisisnotashwin marked this pull request as ready for review February 14, 2023 16:30
@thisisnotashwin thisisnotashwin deleted the backport/test_fix_server_acl_init_openshift/evenly-harmless-kingfish branch April 17, 2023 18:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants