Remove association between ServiceAccounts and token Secrets

cmd/subctl/root.go

@@ -43,7 +43,8 @@ import (
 type suppressWarnings struct{}
 
 func (suppressWarnings) HandleWarningHeader(code int, agent, message string) {
-	if code == 299 && strings.Contains(message, "would violate PodSecurity") {
+	if code == 299 && (strings.Contains(message, "would violate PodSecurity") ||
+		strings.Contains(message, "instead of auto-generated secret-based tokens")) {
 		return
 	}
 

pkg/broker/ensure.go

@@ -20,12 +20,10 @@ package broker
 
 import (
 	"context"
-	"time"
 
 	"github.com/pkg/errors"
 	"github.com/submariner-io/subctl/internal/component"
 	"github.com/submariner-io/subctl/internal/constants"
-	"github.com/submariner-io/subctl/internal/rbac"
 	"github.com/submariner-io/subctl/pkg/gateway"
 	"github.com/submariner-io/subctl/pkg/namespace"
 	"github.com/submariner-io/subctl/pkg/role"
@@ -39,7 +37,6 @@ import (
 	rbacv1 "k8s.io/api/rbac/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/kubernetes"
 )
 
@@ -88,9 +85,7 @@ func Ensure(ctx context.Context, crdUpdater crd.Updater, kubeClient kubernetes.I
 		return errors.Wrap(err, "error creating broker role")
 	}
 
-	_, err = WaitForClientToken(ctx, kubeClient, constants.SubmarinerBrokerAdminSA, brokerNS)
-
-	return err
+	return nil
 }
 
 // CreateSAForCluster creates a new SA for each new cluster joined and binds it to the submariner cluster role.
@@ -107,8 +102,8 @@ func CreateSAForCluster(ctx context.Context, kubeClient kubernetes.Interface, cl
 		return nil, errors.Wrap(err, "error binding sa to cluster role")
 	}
 
-	clientToken, err := WaitForClientToken(ctx, kubeClient, saName, inNamespace)
-	if err != nil && !apierrors.IsAlreadyExists(err) {
+	clientToken, err := serviceaccount.EnsureTokenSecret(ctx, kubeClient, inNamespace, saName)
+	if err != nil {
 		return nil, errors.Wrap(err, "error getting cluster sa token")
 	}
 
@@ -137,37 +132,6 @@ func createBrokerAdministratorRoleAndSA(ctx context.Context, kubeClient kubernet
 	return nil
 }
 
-func WaitForClientToken(ctx context.Context, kubeClient kubernetes.Interface, submarinerBrokerSA, inNamespace string) (*v1.Secret, error) {
-	// wait for the client token to be ready, while implementing
-	// exponential backoff pattern, it will wait a total of:
-	// sum(n=0..9, 1.2^n * 5) seconds, = 130 seconds
-	backoff := wait.Backoff{
-		Steps:    10,
-		Duration: 5 * time.Second,
-		Factor:   1.2,
-		Jitter:   1,
-	}
-
-	var secret *v1.Secret
-	var lastErr error
-
-	err := wait.ExponentialBackoff(backoff, func() (bool, error) {
-		secret, lastErr = rbac.GetClientTokenSecret(ctx, kubeClient, inNamespace, submarinerBrokerSA)
-		if lastErr != nil {
-			//nolint:nilerr // Intentional - the error is propagated via the outer-scoped var 'lastErr'
-			return false, nil
-		}
-
-		return true, nil
-	})
-
-	if wait.Interrupted(err) {
-		return nil, lastErr //nolint:wrapcheck // No need to wrap here
-	}
-
-	return secret, err //nolint:wrapcheck // No need to wrap here
-}
-
 //nolint:wrapcheck // No need to wrap here
 func CreateOrUpdateClusterBrokerRole(ctx context.Context, kubeClient kubernetes.Interface, inNamespace string) (bool, error) {
 	return role.EnsureFromYAML(ctx, kubeClient, inNamespace, embeddedyamls.Config_broker_broker_client_role_yaml)
@@ -196,14 +160,19 @@ func CreateOrUpdateBrokerAdminRoleBinding(ctx context.Context, kubeClient kubern
 //nolint:wrapcheck // No need to wrap here
 func CreateNewBrokerSA(ctx context.Context, kubeClient kubernetes.Interface, submarinerBrokerSA, inNamespace string) (err error) {
 	sa := NewBrokerSA(submarinerBrokerSA)
-	_, err = serviceaccount.Ensure(ctx, kubeClient, inNamespace, sa, true)
+	_, err = serviceaccount.Ensure(ctx, kubeClient, inNamespace, sa)
 
 	return err
 }
 
 //nolint:wrapcheck // No need to wrap here
 func CreateNewBrokerAdminSA(ctx context.Context, kubeClient kubernetes.Interface, inNamespace string) (err error) {
 	_, err = serviceaccount.EnsureFromYAML(ctx, kubeClient, inNamespace, embeddedyamls.Config_broker_broker_admin_service_account_yaml)
+	if err != nil {
+		return err
+	}
+
+	_, err = serviceaccount.EnsureTokenSecret(ctx, kubeClient, inNamespace, constants.SubmarinerBrokerAdminSA)
 
 	return err
 }

pkg/broker/file.go

@@ -31,7 +31,7 @@ import (
 	"github.com/submariner-io/admiral/pkg/reporter"
 	"github.com/submariner-io/subctl/internal/component"
 	"github.com/submariner-io/subctl/internal/constants"
-	"github.com/submariner-io/subctl/internal/rbac"
+	"github.com/submariner-io/subctl/pkg/serviceaccount"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
 	"k8s.io/utils/set"
@@ -61,7 +61,7 @@ func WriteInfoToFile(restConfig *rest.Config, brokerNamespace string, ipsecPSK [
 
 	data := &Info{}
 
-	data.ClientToken, err = rbac.GetClientTokenSecret(context.TODO(), kubeClient, brokerNamespace, constants.SubmarinerBrokerAdminSA)
+	data.ClientToken, err = serviceaccount.GetTokenSecretFor(context.TODO(), kubeClient, brokerNamespace, constants.SubmarinerBrokerAdminSA)
 	if err != nil {
 		return errors.Wrap(err, "error getting broker client secret")
 	}