Change:
config := clientcmdapi.NewConfig() credentials := clientcmdapi.NewAuthInfo() <del> credentials.Token = clientCfg.BearerToken </del> <ins> credentials.TokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token" </ins> credentials.ClientCertificate = clientCfg.TLSClientConfig.CertFile if len(credentials.ClientCertificate) == 0 { credentials.ClientCertificateData = clientCfg.TLSClientConfig.CertData

Discussion:
Is this a BUG REPORT: Sonobuoy runs the kubernetes e2e's differently then test-infra. It constructs an in-cluster config vs. being handed a kubeconfig from the infra. In 1.12 something has broken this behavior, I'm still digging into the details. What happened: Run tests from within the cluster error occurs - What you expected to happen: Works fine, just like it had in 1.11 How to reproduce it (as minimally and precisely as possible): Run tests from within the cluster given proper RBAC rules. Anything else we need to know?: Discovered when updating sonobuoy for 1.12. /sig testing /kind bug /cc
One data point, the in-cluster-client-configuration example seems to work (but was missing RBAC step):
is there a known time when it last worked?
11 worked fine Sonobuoy's legacy in-cluster config works as well. The e2e test suite relies on a single utility wrapper that seems to not be tested. I'm still digging through the e2e setup, I haven't touched it since 1.9-ish timeframe.
needs a binary search bisect between 1.11 and 1.12. :
I'm definitely interested in this as VMware runs e2e tests in cluster. We're still handing the tests a kubeconfig from the outside, but the plan is to move to the same model as used by Sonobuoy.
The token field in /tmp/kubeconfig-xxx is missing. BearerToken in client-go is apparently empty. Probably caused by this:
FYI, the following command can trick sonobuoy/e2e 0.12 into running the tests but beware it is a hack: kubectl create clusterrolebinding cluster-system-anonymous --clusterrole=cluster-admin --user=system:anonymous
i don't have proof, but looking through swathes of stuff, this one stood out - wanna try a local test in your environment with that removed?
shared a possible solution in the sig-cluster-life chat, can confirm if that was a fix for the same thing or perhaps something else.
i'll take back my comment about . trying to recreate the scenario i was able to print out the tmp file with the in-cluster config info.

11 - 12 - Looks like the information is missing in 1.12 exactly as mentioned. So i support the darxkies's theory that is causing it.
Thanks I verified that does fix.
/reopen
Reopening this issue. <detailsIn response to : /reopen Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details
What should we do with Sonobuoy now that this is merged and cherry-picked? Do we need to wait for 1.12.1 to drop before we can use that test suite? Will we use that test suite for 1.12.0 clusters?
Closing, I've been verifying with release-1.12 and with latest patches is works now.
/close per
Closing this issue. <detailsIn response to : /close per Instructions for interacting with me using PR comments are available . If you have questions or suggestions related to my behavior, please file an issue against the repository. </details