OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing #898

grokspawn · 2024-11-19T20:09:20Z

… (#3377)

This is a backport of the original commit. Original description follows:

fix: call TokenRequest API when service account token secret is missing

Beyond Kubernetes 1.22, the service account token secret is not automatically, created. Therefore, when OLM is not able to find the service account token secret, it should request one from the k8s api server.

Ref: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#manual-secret-management-for-serviceaccounts

fix: return error
handle error when creating sa token from TokenRequest API fails
move return from inner loop

Move the return to line 48. This will ensure a value is returned whether we successully create a service account token from the TokenRequest API or get an error

Upstream-repository: operator-lifecycle-manager
Upstream-commit: e20778cbb590f82dbe9cba500e98e7317222e5b5

…ng (#3377) * fix: call TokenRequest API when service account token secret is missing Beyond Kubernetes 1.22, the service account token secret is not automatically, created. Therefore, when OLM is not able to find the service account token secret, it should request one from the k8s api server. Ref: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#manual-secret-management-for-serviceaccounts Signed-off-by: Edmund Ochieng <[email protected]> * fix: return error Signed-off-by: Edmund Ochieng <[email protected]> * handle error when creating sa token from TokenRequest API fails Signed-off-by: Edmund Ochieng <[email protected]> * move return from inner loop Move the return to line 48. This will ensure a value is returned whether we successully create a service account token from the TokenRequest API or get an error Signed-off-by: Edmund Ochieng <[email protected]> --------- Signed-off-by: Edmund Ochieng <[email protected]> Upstream-repository: operator-lifecycle-manager Upstream-commit: e20778cbb590f82dbe9cba500e98e7317222e5b5

grokspawn · 2024-11-19T20:10:14Z

/jira cherrypick OCPBUGS-42360

openshift-ci-robot · 2024-11-19T20:10:29Z

@grokspawn: Jira Issue OCPBUGS-42360 has been cloned as Jira Issue OCPBUGS-44760. Will retitle bug to link to clone.
/retitle OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing

In response to this:

/jira cherrypick OCPBUGS-42360

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2024-11-19T20:10:43Z

@grokspawn: This pull request references Jira Issue OCPBUGS-44760, which is invalid:

release note text must be set and not match the template OR release note type must be set to "Release Note Not Required". For more information you can reference the OpenShift Bug Process.
expected dependent Jira Issue OCPBUGS-42360 to target a version in 4.18.0, but it targets "4.18" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

… (#3377)

This is a backport of the original commit. Original description follows:

fix: call TokenRequest API when service account token secret is missing

Beyond Kubernetes 1.22, the service account token secret is not automatically, created. Therefore, when OLM is not able to find the service account token secret, it should request one from the k8s api server.

Ref: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#manual-secret-management-for-serviceaccounts

fix: return error

handle error when creating sa token from TokenRequest API fails

move return from inner loop

Move the return to line 48. This will ensure a value is returned whether we successully create a service account token from the TokenRequest API or get an error

Upstream-repository: operator-lifecycle-manager
Upstream-commit: e20778cbb590f82dbe9cba500e98e7317222e5b5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

grokspawn · 2024-11-19T20:27:17Z

/cherry-pick release-4.16

openshift-cherrypick-robot · 2024-11-19T20:27:19Z

@grokspawn: once the present PR merges, I will cherry-pick it on top of release-4.16 in a new PR and assign it to you.

In response to this:

/cherry-pick release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

bentito

lgtm

openshift-ci · 2024-11-19T20:51:54Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bentito, grokspawn

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~DOWNSTREAM_OWNERS~~ [grokspawn]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

grokspawn · 2024-11-19T21:06:13Z

/jira refresh

openshift-ci-robot · 2024-11-19T21:06:21Z

@grokspawn: This pull request references Jira Issue OCPBUGS-44760, which is valid. The bug has been moved to the POST state.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.17.z) matches configured target version for branch (4.17.z)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-42360 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-42360 targets the "4.18.0" version, which is one of the valid target versions: 4.18.0
bug has dependents

No GitHub users were found matching the public email listed for the QA contact in Jira ([email protected]), skipping review request.

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Xia-Zhao-rh · 2024-11-20T08:59:55Z

/label cherry-pick-approved
/label qe-approved

openshift-ci-robot · 2024-11-20T09:00:01Z

@grokspawn: This pull request references Jira Issue OCPBUGS-44760, which is valid.

7 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.17.z) matches configured target version for branch (4.17.z)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)
release note text is set and does not match the template
dependent bug Jira Issue OCPBUGS-42360 is in the state Verified, which is one of the valid states (VERIFIED, RELEASE PENDING, CLOSED (ERRATA), CLOSED (CURRENT RELEASE), CLOSED (DONE), CLOSED (DONE-ERRATA))
dependent Jira Issue OCPBUGS-42360 targets the "4.18.0" version, which is one of the valid target versions: 4.18.0
bug has dependents

Requesting review from QA contact:
/cc @Xia-Zhao-rh

In response to this:

… (#3377)

This is a backport of the original commit. Original description follows:

fix: call TokenRequest API when service account token secret is missing

Beyond Kubernetes 1.22, the service account token secret is not automatically, created. Therefore, when OLM is not able to find the service account token secret, it should request one from the k8s api server.

Ref: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#manual-secret-management-for-serviceaccounts

fix: return error

handle error when creating sa token from TokenRequest API fails

move return from inner loop

Move the return to line 48. This will ensure a value is returned whether we successully create a service account token from the TokenRequest API or get an error

Upstream-repository: operator-lifecycle-manager
Upstream-commit: e20778cbb590f82dbe9cba500e98e7317222e5b5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

Xia-Zhao-rh · 2024-11-20T09:01:01Z

/retest

openshift-ci · 2024-11-20T12:04:44Z

@grokspawn: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

perdasilva · 2024-11-20T14:55:48Z

/label backport-risk-assessed

openshift-ci-robot · 2024-11-20T14:59:45Z

@grokspawn: Jira Issue OCPBUGS-44760: All pull requests linked via external trackers have merged:

openshift/operator-framework-olm#898

Jira Issue OCPBUGS-44760 has been moved to the MODIFIED state.

In response to this:

… (#3377)

This is a backport of the original commit. Original description follows:

fix: call TokenRequest API when service account token secret is missing

Beyond Kubernetes 1.22, the service account token secret is not automatically, created. Therefore, when OLM is not able to find the service account token secret, it should request one from the k8s api server.

Ref: https://kubernetes.io/docs/reference/access-authn-authz/service-accounts-admin/#manual-secret-management-for-serviceaccounts

fix: return error

handle error when creating sa token from TokenRequest API fails

move return from inner loop

Move the return to line 48. This will ensure a value is returned whether we successully create a service account token from the TokenRequest API or get an error

Upstream-repository: operator-lifecycle-manager
Upstream-commit: e20778cbb590f82dbe9cba500e98e7317222e5b5

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-cherrypick-robot · 2024-11-20T15:00:49Z

@grokspawn: new pull request created: #900

In response to this:

/cherry-pick release-4.16

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-bot · 2024-11-20T18:02:27Z

[ART PR BUILD NOTIFIER]

Distgit: operator-registry
This PR has been included in build operator-registry-container-v4.17.0-202411201704.p0.g649dfc4.assembly.stream.el9.
All builds following this will include this PR.

openshift-bot · 2024-11-20T18:02:46Z

[ART PR BUILD NOTIFIER]

Distgit: operator-lifecycle-manager
This PR has been included in build operator-lifecycle-manager-container-v4.17.0-202411201704.p0.g649dfc4.assembly.stream.el9.
All builds following this will include this PR.

openshift-bot · 2024-11-20T18:05:25Z

[ART PR BUILD NOTIFIER]

Distgit: ose-operator-framework-tools
This PR has been included in build ose-operator-framework-tools-container-v4.17.0-202411201704.p0.g649dfc4.assembly.stream.el9.
All builds following this will include this PR.

openshift-ci bot changed the title ~~fix: call TokenRequest API when service account token secret is missing~~ OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing Nov 19, 2024

openshift-ci-robot added the jira/severity-critical Referenced Jira bug's severity is critical for the branch this PR is targeting. label Nov 19, 2024

openshift-ci bot requested review from ankitathomas and kevinrizza November 19, 2024 20:10

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 19, 2024

openshift-ci-robot added the jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. label Nov 19, 2024

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 19, 2024

bentito approved these changes Nov 19, 2024

View reviewed changes

openshift-ci bot assigned bentito Nov 19, 2024

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Nov 19, 2024

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Nov 19, 2024

openshift-ci bot added cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. qe-approved Signifies that QE has signed off on this PR labels Nov 20, 2024

openshift-ci bot requested a review from Xia-Zhao-rh November 20, 2024 09:00

openshift-ci bot added the backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. label Nov 20, 2024

openshift-ci bot assigned bandrade, emmajiafan, jianzhangbjz, KeenonLee, kuiwang02 and Xia-Zhao-rh Nov 20, 2024

openshift-merge-bot bot merged commit 649dfc4 into openshift:release-4.17 Nov 20, 2024
13 checks passed

grokspawn deleted the backport-token-request-for-sa-missing-secret branch November 20, 2024 15:00

openshift-cherrypick-robot mentioned this pull request Nov 20, 2024

[release-4.16] OCPBUGS-44802: fix: call TokenRequest API when service account token secret is missing #900

Merged

OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing #898

OCPBUGS-44760: fix: call TokenRequest API when service account token secret is missing #898

Uh oh!

Conversation

grokspawn commented Nov 19, 2024

Uh oh!

grokspawn commented Nov 19, 2024

Uh oh!

openshift-ci-robot commented Nov 19, 2024

Uh oh!

openshift-ci-robot commented Nov 19, 2024

Uh oh!

grokspawn commented Nov 19, 2024

Uh oh!

openshift-cherrypick-robot commented Nov 19, 2024

Uh oh!

bentito left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Nov 19, 2024

Uh oh!

grokspawn commented Nov 19, 2024

Uh oh!

openshift-ci-robot commented Nov 19, 2024

Uh oh!

Xia-Zhao-rh commented Nov 20, 2024

Uh oh!

openshift-ci-robot commented Nov 20, 2024

Uh oh!

Xia-Zhao-rh commented Nov 20, 2024

Uh oh!

openshift-ci bot commented Nov 20, 2024

Uh oh!

perdasilva commented Nov 20, 2024

Uh oh!

Uh oh!

openshift-ci-robot commented Nov 20, 2024

Uh oh!

openshift-cherrypick-robot commented Nov 20, 2024

Uh oh!

openshift-bot commented Nov 20, 2024

Uh oh!

openshift-bot commented Nov 20, 2024

Uh oh!

openshift-bot commented Nov 20, 2024

Uh oh!

Uh oh!