Kops - Use Kubernetes service for SA issuer URLs in gossip clusters

[rifelpet]

The GCE and DO jobs started failing their OIDC tests due to kubernetes/kops#12297 changing the default back to the k8s.local domain for gossip clusters which doesn't resolve. This overrides the issuer on those jobs back to the kubernetes service so that the e2e jobs that actually resolve the URL will pass.

ref: https://prow.k8s.io/view/gs/kubernetes-jenkins/logs/e2e-kops-gce-latest/1439723215860535296

2021/09/19 23:11:19 OK: got issuer https://api.internal.e2e-f2dae1cd6d-d3d02.k8s.local 2021/09/19 23:11:19 Full, not-validated claims: openidmetadata.claims{Claims:jwt.Claims{Issuer:"https://api.internal.e2e-f2dae1cd6d-d3d02.k8s.local", Subject:"system:serviceaccount:svcaccounts-3514:default", Audience:jwt.Audience{"oidc-discovery-test"}, Expiry:1632093674, NotBefore:1632093074, IssuedAt:1632093074, ID:""}, Kubernetes:openidmetadata.kubeClaims{Namespace:"svcaccounts-3514", ServiceAccount:openidmetadata.kubeName{Name:"default", UID:"db9542ca-0cae-478d-b1e2-01a3cf4eef23"}}} 2021/09/19 23:11:19 Get "https://api.internal.e2e-f2dae1cd6d-d3d02.k8s.local/.well-known/openid-configuration": dial tcp: lookup api.internal.e2e-f2dae1cd6d-d3d02.k8s.local on 100.64.0.10:53: no such host

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: hakman, rifelpet

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• config/jobs/kubernetes/kops/OWNERS [hakman,rifelpet]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

@rifelpet: Updated the job-config configmap in namespace default at cluster test-infra-trusted using the following files:

• key kops-periodics-gce.yaml using file config/jobs/kubernetes/kops/kops-periodics-gce.yaml
• key kops-periodics-misc.yaml using file config/jobs/kubernetes/kops/kops-periodics-misc.yaml

In response to this:

The GCE and DO jobs started failing their OIDC tests due to kubernetes/kops#12297 changing the default back to the k8s.local domain for gossip clusters which doesn't resolve. This overrides the issuer on those jobs back to the kubernetes service so that the e2e jobs that actually resolve the URL will pass.

ref: https://prow.k8s.io/view/gs/kubernetes-jenkins/logs/e2e-kops-gce-latest/1439723215860535296

2021/09/19 23:11:19 OK: got issuer https://api.internal.e2e-f2dae1cd6d-d3d02.k8s.local 2021/09/19 23:11:19 Full, not-validated claims: openidmetadata.claims{Claims:jwt.Claims{Issuer:"https://api.internal.e2e-f2dae1cd6d-d3d02.k8s.local", Subject:"system:serviceaccount:svcaccounts-3514:default", Audience:jwt.Audience{"oidc-discovery-test"}, Expiry:1632093674, NotBefore:1632093074, IssuedAt:1632093074, ID:""}, Kubernetes:openidmetadata.kubeClaims{Namespace:"svcaccounts-3514", ServiceAccount:openidmetadata.kubeName{Name:"default", UID:"db9542ca-0cae-478d-b1e2-01a3cf4eef23"}}} 2021/09/19 23:11:19 Get "https://api.internal.e2e-f2dae1cd6d-d3d02.k8s.local/.well-known/openid-configuration": dial tcp: lookup api.internal.e2e-f2dae1cd6d-d3d02.k8s.local on 100.64.0.10:53: no such host

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.