Skip to content

Commit

Permalink
fix: don't mount SA token when automountServiceAccountToken: false. F…
Browse files Browse the repository at this point in the history
…ixes #12848 (#13820)

Signed-off-by: Minyi Zhong <[email protected]>
Co-authored-by: Minyi Zhong <[email protected]>
  • Loading branch information
MinyiZ and Minyi Zhong authored Oct 27, 2024
1 parent 1017c1d commit 3dfea6d
Show file tree
Hide file tree
Showing 3 changed files with 42 additions and 82 deletions.
42 changes: 42 additions & 0 deletions test/e2e/resource_template_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -157,6 +157,48 @@ func (s *ResourceTemplateSuite) TestResourceTemplateWithOutputs() {
})
}

func (s *ResourceTemplateSuite) TestResourceTemplateAutomountServiceAccountTokenDisabled() {
s.Given().
Workflow(`
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: k8s-resource-tmpl-with-automountservicetoken-disabled-
spec:
serviceAccountName: argo
automountServiceAccountToken: false
executor:
serviceAccountName: argo
entrypoint: main
templates:
- name: main
resource:
action: create
setOwnerReference: true
successCondition: status.phase == Succeeded
failureCondition: status.phase == Failed
manifest: |
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: k8s-wf-resource-
spec:
entrypoint: main
templates:
- name: main
container:
image: argoproj/argosay:v2
command: ["/argosay"]
`).
When().
SubmitWorkflow().
WaitForWorkflow().
Then().
ExpectWorkflow(func(t *testing.T, _ *metav1.ObjectMeta, status *wfv1.WorkflowStatus) {
assert.Equal(t, wfv1.WorkflowSucceeded, status.Phase)
})
}

func (s *ResourceTemplateSuite) TestResourceTemplateFailed() {
s.Given().
Workflow("@testdata/resource-templates/failed.yaml").
Expand Down
66 changes: 0 additions & 66 deletions test/e2e/workflow_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -22,72 +22,6 @@ type WorkflowSuite struct {
fixtures.E2ESuite
}

func (s *WorkflowSuite) TestContainerTemplateAutomountServiceAccountTokenDisabled() {
s.Given().Workflow(`
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: get-resources-via-container-template-
namespace: argo
spec:
serviceAccountName: argo
automountServiceAccountToken: false
executor:
serviceAccountName: get-cm
entrypoint: main
templates:
- name: main
container:
name: main
image: bitnami/kubectl
command:
- sh
args:
- -c
- |
kubectl get cm
`).
When().
SubmitWorkflow().
WaitForWorkflow(fixtures.ToBeSucceeded, time.Minute*11).
Then().
ExpectWorkflow(func(t *testing.T, metadata *metav1.ObjectMeta, status *wfv1.WorkflowStatus) {
assert.Equal(t, wfv1.WorkflowSucceeded, status.Phase)
})
}

func (s *WorkflowSuite) TestScriptTemplateAutomountServiceAccountTokenDisabled() {
s.Given().Workflow(`
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
generateName: get-resources-via-script-template-
namespace: argo
spec:
serviceAccountName: argo
automountServiceAccountToken: false
executor:
serviceAccountName: get-cm
entrypoint: main
templates:
- name: main
script:
name: main
image: bitnami/kubectl
command:
- sh
source:
kubectl get cm
`).
When().
SubmitWorkflow().
WaitForWorkflow(fixtures.ToBeSucceeded, time.Minute*11).
Then().
ExpectWorkflow(func(t *testing.T, metadata *metav1.ObjectMeta, status *wfv1.WorkflowStatus) {
assert.Equal(t, wfv1.WorkflowSucceeded, status.Phase)
})
}

func (s *WorkflowSuite) TestWorkflowFailedWhenAllPodSetFailedFromPending() {
(s.Given().Workflow(`
apiVersion: argoproj.io/v1alpha1
Expand Down
16 changes: 0 additions & 16 deletions workflow/controller/workflowpod.go
Original file line number Diff line number Diff line change
Expand Up @@ -224,22 +224,6 @@ func (woc *wfOperationCtx) createWorkflowPod(ctx context.Context, nodeName strin
// container's PID and root filesystem.
pod.Spec.Containers = append(pod.Spec.Containers, mainCtrs...)

// Configure service account token volume for the main container when AutomountServiceAccountToken is disabled
if (woc.execWf.Spec.AutomountServiceAccountToken != nil && !*woc.execWf.Spec.AutomountServiceAccountToken) ||
(tmpl.AutomountServiceAccountToken != nil && !*tmpl.AutomountServiceAccountToken) {
for i, c := range pod.Spec.Containers {
if c.Name == common.WaitContainerName {
continue
}
c.VolumeMounts = append(c.VolumeMounts, apiv1.VolumeMount{
Name: common.ServiceAccountTokenVolumeName,
MountPath: common.ServiceAccountTokenMountPath,
ReadOnly: true,
})
pod.Spec.Containers[i] = c
}
}

// Configuring default container to be used with commands like "kubectl exec/logs".
// Select "main" container if it's available. In other case use the last container (can happen when pod created from ContainerSet).
defaultContainer := pod.Spec.Containers[len(pod.Spec.Containers)-1].Name
Expand Down

0 comments on commit 3dfea6d

Please sign in to comment.