From 86d5cc696c13f2f62aedf96f38892d65d0ef03ca Mon Sep 17 00:00:00 2001 From: Knative Prow Robot Date: Thu, 10 Oct 2024 13:50:03 +0100 Subject: [PATCH] [release-1.15] workaround DeepDerivative CreationTimestamp comparison (#8234) workaround DeepDerivative CreationTimestamp comparison Co-authored-by: Marek Schmidt --- pkg/auth/serviceaccount.go | 3 +++ pkg/auth/serviceaccount_test.go | 46 +++++++++++++++++++++++++++++---- 2 files changed, 44 insertions(+), 5 deletions(-) diff --git a/pkg/auth/serviceaccount.go b/pkg/auth/serviceaccount.go index 5b98d61c79a..12e0fe130b3 100644 --- a/pkg/auth/serviceaccount.go +++ b/pkg/auth/serviceaccount.go @@ -109,6 +109,9 @@ func EnsureOIDCServiceAccountExistsForResource(ctx context.Context, serviceAccou return fmt.Errorf("service account %s not owned by %s %s", sa.Name, gvk.Kind, objectMeta.Name) } + // DeepDerivative does not understand default metav1.Time{} as an empty value + expected.CreationTimestamp = sa.CreationTimestamp + if !equality.Semantic.DeepDerivative(expected, sa) { expected.ResourceVersion = sa.ResourceVersion diff --git a/pkg/auth/serviceaccount_test.go b/pkg/auth/serviceaccount_test.go index 8c9564b9d92..06fedbbad7d 100644 --- a/pkg/auth/serviceaccount_test.go +++ b/pkg/auth/serviceaccount_test.go @@ -19,7 +19,10 @@ package auth import ( "context" "testing" + "time" + "k8s.io/apimachinery/pkg/api/equality" + clientgotesting "k8s.io/client-go/testing" duckv1 "knative.dev/pkg/apis/duck/v1" kubeclient "knative.dev/pkg/client/injection/kube/client/fake" @@ -133,18 +136,51 @@ func TestEnsureOIDCServiceAccountExistsForResource(t *testing.T) { eventtypes := make([]runtime.Object, 0, 10) listers := rttestingv1.NewListers(eventtypes) - err := EnsureOIDCServiceAccountExistsForResource(ctx, listers.GetServiceAccountLister(), kubeclient.Get(ctx), gvk, objectMeta) - if err != nil { - t.Errorf("EnsureOIDCServiceAccountExistsForResource failed: %s", err) + client := kubeclient.Get(ctx) + err := EnsureOIDCServiceAccountExistsForResource(ctx, listers.GetServiceAccountLister(), client, gvk, objectMeta) + if err != nil { + t.Fatalf("EnsureOIDCServiceAccountExistsForResource failed: %s", err) } expected := GetOIDCServiceAccountForResource(gvk, objectMeta) sa, err := kubeclient.Get(ctx).CoreV1().ServiceAccounts(objectMeta.Namespace).Get(context.TODO(), expected.Name, metav1.GetOptions{}) if err != nil { - t.Errorf("get ServiceAccounts failed: %s", err) + t.Fatalf("get ServiceAccounts failed: %s", err) } if sa == nil || sa.Name != expected.Name { - t.Errorf("EnsureOIDCServiceAccountExistsForResource create ServiceAccounts failed: %s", err) + t.Fatalf("EnsureOIDCServiceAccountExistsForResource create ServiceAccounts failed: %s", err) + } + + updated := expected.DeepCopy() + updated.Secrets = []v1.ObjectReference{{ + Kind: "Secret", + Name: "test-secret", + APIVersion: "v1", + }} + updated.Annotations["testannotation"] = "testvalue" + updated.CreationTimestamp = metav1.Time{Time: time.Now()} + + listers = rttestingv1.NewListers([]runtime.Object{updated}) + + _, err = client.CoreV1().ServiceAccounts(objectMeta.Namespace).Update(context.TODO(), updated, metav1.UpdateOptions{}) + if err != nil { + t.Fatalf("Update ServiceAccounts failed: %s", err) + } + err = EnsureOIDCServiceAccountExistsForResource(ctx, listers.GetServiceAccountLister(), client, gvk, objectMeta) + if err != nil { + t.Fatalf("EnsureOIDCServiceAccountExistsForResource failed: %s", err) + } + client.Fake.AddReactor("*", "*", func(action clientgotesting.Action) (handled bool, ret runtime.Object, err error) { + t.Fatalf("Action detected %#v", action) + return + }) + sa, err = client.CoreV1().ServiceAccounts(objectMeta.Namespace).Get(context.TODO(), expected.Name, metav1.GetOptions{}) + if err != nil { + t.Fatalf("get ServiceAccounts failed: %s", err) + } + + if len(sa.Secrets) != len(updated.Secrets) || !equality.Semantic.DeepEqual(sa.Secrets, updated.Secrets) { + t.Fatalf("Got secrets is not equal to updated secret, got %#v, want %#v", sa.Secrets, updated.Secrets) } }