Change:
https://k8s- /sig auth /kind failing-test
Adding a priority to this: /priority important-soon Please raise the priority if you consider this a release blocker. Given the test job, it normally wouldn't be.
It's a test issue. I'm hoping to fix this before 1.13 but I don't consider it a release blocker.

Discussion:
"//pkg/security/podsecuritypolicy/util:go_default_library", "//plugin/pkg/admission/serviceaccount:go_default_library", "//staging/src/k8s.io/api/apps/v1:go_default_library", <ins> "//staging/src/k8s.io/api/authentication/v1:go_default_library", </ins> "//staging/src/k8s.io/api/batch/v1:go_default_library", "//staging/src/k8s.io/api/certificates/v1beta1:go_default_library", "//staging/src/k8s.io/api/core/v1:go_default_library",

"//staging/src/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/runtime/schema:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/types:go_default_library", <ins> "//staging/src/k8s.io/apimachinery/pkg/util/sets:go_default_library", </ins> "//staging/src/k8s.io/apimachinery/pkg/util/uuid:go_default_library", "//staging/src/k8s.io/apimachinery/pkg/util/wait:go_default_library", "//staging/src/k8s.io/apiserver/pkg/apis/audit:go_default_library",

import ( "fmt" <ins> "path" </ins> "time" <ins> authenticationv1 "k8s.io/api/authentication/v1" </ins> "k8s.io/api/core/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" <ins> "k8s.io/apimachinery/pkg/util/sets" </ins> "k8s.io/apimachinery/pkg/util/uuid" "k8s.io/apimachinery/pkg/util/wait" "k8s.io/kubernetes/plugin/pkg/admission/serviceaccount"

Account mount path MUST be auto mounted to the Container. */ framework.ConformanceIt("should mount an API token into pods ", func() { <del> var tokenContent string </del> var rootCAContent string <ins> sa, err := f.ClientSet.CoreV1().ServiceAccounts(f.Namespace.Name).Create(&v1.ServiceAccount{ObjectMeta: metav1.ObjectMeta{Name: "mount-test"}}) framework.ExpectNoError(err) </ins> // Standard get, update retry loop framework.ExpectNoError(wait.Poll(time.Millisecond*500, framework.ServiceAccountProvisionTimeout, func() (bool, error) { By("getting the auto-created API token") <del> sa, err := f.ClientSet.CoreV1().ServiceAccounts(f.Namespace.Name).Get("default", metav1.GetOptions{}) </del> <ins> sa, err := f.ClientSet.CoreV1().ServiceAccounts(f.Namespace.Name).Get("mount-test", metav1.GetOptions{}) </ins> if apierrors.IsNotFound(err) { <del> framework.Logf("default service account was not found") </del> <ins> framework.Logf("mount-test service account was not found") </ins> return false, nil } if err != nil { <del> framework.Logf("error getting default service account: %v", err) </del> <ins> framework.Logf("error getting mount-test service account: %v", err) </ins> return false, err } if len(sa.Secrets) == 0 { <del> framework.Logf("default service account has no secret references") </del> <ins> framework.Logf("mount-test service account has no secret references") </ins> return false, nil } for _, secretRef := range sa.Secrets {

continue } if secret.Type == v1.SecretTypeServiceAccountToken { <del> tokenContent = string(secret.Data[v1.ServiceAccountTokenKey]) </del> rootCAContent = string(secret.Data[v1.ServiceAccountRootCAKey]) return true, nil }

return false, nil })) <del> pod := &v1.Pod{ </del> <ins> zero := int64(0) pod, err := f.ClientSet.CoreV1().Pods(f.Namespace.Name).Create(&v1.Pod{ </ins> ObjectMeta: metav1.ObjectMeta{ <del> GenerateName: "pod-service-account-" + string(uuid.NewUUID()) + "-", </del> <ins> Name: "pod-service-account-" + string(uuid.NewUUID()), </ins> }, Spec: v1.PodSpec{ <del> Containers: []v1.Container{ { Name:  "token-test", Image: mountImage, Args: []string{ fmt.Sprintf("--file_content=%s/%s", serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountTokenKey), }, }, { Name:  "root-ca-test", Image: mountImage, Args: []string{ fmt.Sprintf("--file_content=%s/%s", serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountRootCAKey), }, }, }, RestartPolicy: v1.RestartPolicyNever, }, } pod.Spec.Containers = append(pod.Spec.Containers, v1.Container{ Name:  "namespace-test", Image: mountImage, Args: []string{ fmt.Sprintf("--file_content=%s/%s", serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountNamespaceKey), </del> <ins> ServiceAccountName: sa.Name, Containers: []v1.Container{{ Name:    "test", Image:   imageutils.GetE2EImage(imageutils.BusyBox), Command: []string{"sleep", "100000"}, // run and pause }}, TerminationGracePeriodSeconds: &zero,                 // terminate quickly when deleted RestartPolicy:                 v1.RestartPolicyNever, // never restart </ins> }, }) <ins> framework.ExpectNoError(err) framework.ExpectNoError(framework.WaitForPodRunningInNamespace(f.ClientSet, pod)) </ins> <del> f.TestContainerOutput("consume service account token", pod, 0, []string{ fmt.Sprintf(`content of file "%s/%s": %s`, serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountTokenKey, tokenContent), }) f.TestContainerOutput("consume service account root CA", pod, 1, []string{ fmt.Sprintf(`content of file "%s/%s": %s`, serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountRootCAKey, rootCAContent), }) </del> <ins> mountedToken, err := f.ReadFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, path.Join(serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountTokenKey)) framework.ExpectNoError(err) mountedCA, err := f.ReadFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, path.Join(serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountRootCAKey)) framework.ExpectNoError(err) mountedNamespace, err := f.ReadFileViaContainer(pod.Name, pod.Spec.Containers[0].Name, path.Join(serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountNamespaceKey)) framework.ExpectNoError(err) </ins> <del> f.TestContainerOutput("consume service account namespace", pod, 2, []string{ fmt.Sprintf(`content of file "%s/%s": %s`, serviceaccount.DefaultAPITokenMountPath, v1.ServiceAccountNamespaceKey, f.Namespace.Name), }) </del> <ins> // CA and namespace should be identical Expect(mountedCA).To(Equal(rootCAContent)) Expect(mountedNamespace).To(Equal(f.Namespace.Name)) // Token should be a valid credential that identifies the pod's service account tokenReview := &authenticationv1.TokenReview{Spec: authenticationv1.TokenReviewSpec{Token: mountedToken}} tokenReview, err = f.ClientSet.AuthenticationV1().TokenReviews().Create(tokenReview) framework.ExpectNoError(err) Expect(tokenReview.Status.Authenticated).To(Equal(true)) Expect(tokenReview.Status.Error).To(Equal("")) Expect(tokenReview.Status.User.Username).To(Equal("system:serviceaccount:" + f.Namespace.Name + ":" + sa.Name)) groups := sets.NewString(tokenReview.Status.User.Groups...) Expect(groups.Has("system:authenticated")).To(Equal(true), fmt.Sprintf("expected system:authenticated group, had %v", groups.List())) Expect(groups.Has("system:serviceaccounts")).To(Equal(true), fmt.Sprintf("expected system:serviceaccounts group, had %v", groups.List())) Expect(groups.Has("system:serviceaccounts:"+f.Namespace.Name)).To(Equal(true), fmt.Sprintf("expected system:serviceaccounts:"+f.Namespace.Name+" group, had %v", groups.List())) </ins> }) /*