Change:
return false, nil })) <del> pod := &v1.Pod{ </del> <ins> zero := int64(0) pod, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(&v1.Pod{ </ins> ObjectMeta: metav1.ObjectMeta{ <del> GenerateName: "pod-service-account-" + string(uuid.NewUUID()) + "-", </del> <ins> Name: "pod-service-account-" + string(uuid.NewUUID()), </ins> }, Spec: v1.PodSpec{ <del> Containers: []v1.Container{ { Name:  "token-test", Image: mountImage, Args: []string{ fmt.Sprintf("--file_content=%s/%s", serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountTokenKey), }, }, { Name:  "root-ca-test", Image: mountImage, Args: []string{ fmt.Sprintf("--file_content=%s/%s", serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountRootCAKey), }, }, }, RestartPolicy: v1.RestartPolicyNever, }, } pod.Spec.Containers = append(pod.Spec.Containers, v1.Container{ Name:  "namespace-test", Image: mountImage, Args: []string{ fmt.Sprintf("--file_content=%s/%s", serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountNamespaceKey), </del> <ins> ServiceAccountName: sa.Name, Containers: []v1.Container{{ Name:    "test", Image:   imageutils.GetE2EImage(imageutils.BusyBox), Command: []string{"sleep", "100000"}, // run and pause }}, TerminationGracePeriodSeconds: &zero,                 // terminate quickly when deleted RestartPolicy:                 v1.RestartPolicyNever, // never restart </ins> }, }) <ins> framework.ExpectNoError(err) framework.ExpectNoError(framework.WaitForPodRunningInNamespace(f.ClientSet, pod)) </ins> <del> f.TestContainerOutput("consume service account token", pod, 0, []string{ fmt.Sprintf(`content of file "%s/%s": %s`, serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountTokenKey, tokenContent), }) f.TestContainerOutput("consume service account root CA", pod, 1, []string{ fmt.Sprintf(`content of file "%s/%s": %s`, serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountRootCAKey, rootCAContent), }) </del> <ins> mountedToken, err := f.ReadFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, path.Join(serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountTokenKey)) framework.ExpectNoError(err) mountedCA, err := f.ReadFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, path.Join(serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountRootCAKey)) framework.ExpectNoError(err) mountedNamespace, err := f.ReadFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, path.Join(serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountNamespaceKey)) framework.ExpectNoError(err) </ins> <del> f.TestContainerOutput("consume service account namespace", pod, 2, []string{ fmt.Sprintf(`content of file "%s/%s": %s`, serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountNamespaceKey, f.Namespace.Name), }) </del> <ins> // CA and namespace should be identical Expect(mountedCA).To(Equal(rootCAContent)) Expect(mountedNamespace).To(Equal(f.Namespace.Name)) // Token should be a valid credential that identifies the pod's service account tokenReview := &authenticationv1.TokenReview{Spec: authenticationv1.TokenReviewSpec{Token: mountedToken}} tokenReview, err = f.ClientSet.AuthenticationV1().TokenReviews().Create(tokenReview) framework.ExpectNoError(err) Expect(tokenReview.Status.Authenticated).To(Equal(true)) Expect(tokenReview.Status.Error).To(Equal("")) Expect(tokenReview.Status.User.Username).To(Equal("system:serviceaccount:" + f.Namespace.Name + ":" + sa.Name)) groups := sets.NewString(tokenReview.Status.User.Groups...) Expect(groups.Has("system:authenticated")).To(Equal(true), fmt.Sprintf("expected system:authenticated group, had %v", groups.List())) Expect(groups.Has("system:serviceaccounts")).To(Equal(true), fmt.Sprintf("expected system:serviceaccounts group, had %v", groups.List())) Expect(groups.Has("system:serviceaccounts:"+f.Namespace.Name)).To(Equal(true), fmt.Sprintf("expected system:serviceaccounts:"+f.Namespace.Name+" group, had %v", groups.List())) </ins> }) /*

Discussion:
https://k8s- /sig auth /kind failing-test
Adding a priority to this: /priority important-soon Please raise the priority if you consider this a release blocker. Given the test job, it normally wouldn't be.
It's a test issue. I'm hoping to fix this before 1.13 but I don't consider it a release blocker.