Repository: zalando-incubator/kube-ingress-aws-controller
Pull request #548 (2022-09-14 15:27:54)

Bump github.com/zalando/skipper from 0.13.245 to 0.13.250
Bumps [github.com/zalando/skipper](https://github.com/zalando/skipper) from 0.13.245 to 0.13.250.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a href="https://github.com/zalando/skipper/releases">github.com/zalando/skipper's releases</a>.</em></p>
<blockquote>
<h2>v0.13.250</h2>
<h3>Changes</h3>
<p>Tool/govulncheck should not block build (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2075">#2075</a>)</p>
<h3>Docker image</h3>
<p>Docker image is available in Zalando's Open Source registry:</p>
<pre><code>docker run -it registry.opensource.zalan.do/teapot/skipper:v0.13.250 skipper --help
# arm64
docker run -it registry.opensource.zalan.do/teapot/skipper-arm64:v0.13.250 skipper --help
# arm v7 32bit
docker run -it registry.opensource.zalan.do/teapot/skipper-armv7:v0.13.250 skipper --help
</code></pre>
<h2>v0.13.249</h2>
<h3>Changes</h3>
<p>godoc: reformat all sources with gofmt 1.19  (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2074">#2074</a>)
<code>gofmt</code> misinterprets code blocks of <code>eskip</code> examples starting with <code>*</code> as a bullet list.
This change adds route id to all such eskip examples such that subsequent reformatting
with gofmt 1.18 and 1.19 does not produce any changes.</p>
<h3>Docker image</h3>
<p>Docker image is available in Zalando's Open Source registry:</p>
<pre><code>docker run -it registry.opensource.zalan.do/teapot/skipper:v0.13.249 skipper --help
# arm64
docker run -it registry.opensource.zalan.do/teapot/skipper-arm64:v0.13.249 skipper --help
# arm v7 32bit
docker run -it registry.opensource.zalan.do/teapot/skipper-armv7:v0.13.249 skipper --help
</code></pre>
<h2>v0.13.248</h2>
<h3>Changes</h3>
<p>Support K8S labelSelector filters for API requests (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2048">#2048</a>)</p>
<h3>Docker image</h3>
<p>Docker image is available in Zalando's Open Source registry:</p>
<pre><code>docker run -it registry.opensource.zalan.do/teapot/skipper:v0.13.248 skipper --help
# arm64
docker run -it registry.opensource.zalan.do/teapot/skipper-arm64:v0.13.248 skipper --help
&lt;/tr&gt;&lt;/table&gt; 
</code></pre>
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a href="https://github.com/zalando/skipper/commit/d4b2a6299ef304ef22d9bd1d19899b82f9cb6359"><code>d4b2a62</code></a> Tool/govulncheck should not block build (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2075">#2075</a>)</li>
<li><a href="https://github.com/zalando/skipper/commit/54ff9d009ad4e09295480f51c8d7ec0afeb2be67"><code>54ff9d0</code></a> godoc: reformat all sources with gofmt 1.19  (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2074">#2074</a>)</li>
<li><a href="https://github.com/zalando/skipper/commit/8b7cd03b2c77c07cd6a50f5ce4e4b572dd5ab23e"><code>8b7cd03</code></a> Support K8S labelSelector filters for API requests (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2048">#2048</a>)</li>
<li><a href="https://github.com/zalando/skipper/commit/6a0a59076ae4a67220ae9711980bc7527d3af011"><code>6a0a590</code></a> Feature/scheduler filter fifo (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2044">#2044</a>)</li>
<li><a href="https://github.com/zalando/skipper/commit/c511dfcdad5232bf9dfc818e97888b84c9198e04"><code>c511dfc</code></a> enable govulncheck (<a href="https://github-redirect.dependabot.com/zalando/skipper/issues/2072">#2072</a>)</li>
<li>See full diff in <a href="https://github.com/zalando/skipper/compare/v0.13.245...v0.13.250">compare view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/zalando/skipper&package-manager=go_modules&previous-version=0.13.245&new-version=0.13.250)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)


</details>


Patch:
diff --git a/go.mod b/go.mod
index 3eb26e5..2f48587 100644
--- a/go.mod
+++ b/go.mod
@@ -3,16 +3,16 @@ module github.com/zalando-incubator/kube-ingress-aws-controller
 go 1.18
 
 require (
-	github.com/aws/aws-sdk-go v1.44.91
+	github.com/aws/aws-sdk-go v1.44.97
 	github.com/ghodss/yaml v1.0.0
-	github.com/google/go-cmp v0.5.8
+	github.com/google/go-cmp v0.5.9
 	github.com/google/uuid v1.3.0
 	github.com/linki/instrumented_http v0.3.0
 	github.com/mweagle/go-cloudformation v0.0.0-20210117063902-00aa242fdc67
 	github.com/prometheus/client_golang v1.13.0
 	github.com/sirupsen/logrus v1.9.0
 	github.com/stretchr/testify v1.8.0
-	github.com/zalando/skipper v0.13.245
+	github.com/zalando/skipper v0.13.250
 	gopkg.in/alecthomas/kingpin.v2 v2.2.6
 	k8s.io/api v0.22.5
 	k8s.io/apimachinery v0.22.5
diff --git a/go.sum b/go.sum
index a849fcd..5d14c0f 100644
--- a/go.sum
+++ b/go.sum
@@ -60,8 +60,8 @@ github.com/andybalholm/brotli v1.0.4 h1:V7DdXeJtZscaqfNuAdSRuRFzuiKlHSC/Zh3zl9qY
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/aryszka/jobqueue v0.0.2 h1:LYPhzklo0XFpVF+QtzfP9XRQPEsbJ2EW5Pur6pxxaS4=
 github.com/asaskevich/govalidator v0.0.0-20190424111038-f61b66f89f4a/go.mod h1:lB+ZfQJz7igIIfQNfa7Ml4HSf2uFQQRzpGGRXenZAgY=
-github.com/aws/aws-sdk-go v1.44.91 h1:SRWmuX7PTyhBdLuvSfM7KWrWISJsrRsUPcFDSFduRxY=
-github.com/aws/aws-sdk-go v1.44.91/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
+github.com/aws/aws-sdk-go v1.44.97 h1:lxgxp7d6uuGsP7jHKIX3GHd7ExFigCIF04VuKf8XUII=
+github.com/aws/aws-sdk-go v1.44.97/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/beorn7/perks v0.0.0-20180321164747-3a771d992973/go.mod h1:Dwedo/Wpr24TaqPxmxbtue+5NUziq4I4S80YR8gNf3Q=
 github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+CedLV8=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
@@ -207,8 +207,8 @@ github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.7/go.mod h1:n+brtR0CgQNWTVd5ZUFpTBC8YFBDLK/h/bpaJ8/DtOE=
-github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
-github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
+github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.1.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
@@ -430,8 +430,8 @@ github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9dec
 github.com/yuin/gopher-lua v0.0.0-20210529063254-f4c35e4016d9 h1:k/gmLsJDWwWqbLCur2yWnJzwQEKRcAHXo6seXGuSwWw=
 github.com/yusufpapurcu/wmi v1.2.2 h1:KBNDSne4vP5mbSWnJbO+51IMOXJB67QiYCSBrubbPRg=
 github.com/yusufpapurcu/wmi v1.2.2/go.mod h1:SBZ9tNy3G9/m5Oi98Zks0QjeHVDvuK0qfxQmPyzfmi0=
-github.com/zalando/skipper v0.13.245 h1:ajjEilhzD5x8/NgsEvJTW2ovAGLNhMmMFwFCtj3Y3oo=
-github.com/zalando/skipper v0.13.245/go.mod h1:jxRZZc3WdKUoPsDadLYIwrSWGBO8wkaCx31pTOCje/w=
+github.com/zalando/skipper v0.13.250 h1:D8tYLJsq7ORiBukUzy7kiXc99Cr9FOVOFW+d890FK4w=
+github.com/zalando/skipper v0.13.250/go.mod h1:L8wxArT64HF+mAcWxkj3kcks/n5N98PZ/uk1E14PGaw=
 go.opencensus.io v0.21.0/go.mod h1:mSImk1erAIZhrmZN+AvHh14ztQfjbGwt4TtuofqLduU=
 go.opencensus.io v0.22.0/go.mod h1:+kGneAE2xo2IficOXnaByMWTGM9T73dGwxeWcUqIpI8=
 go.opencensus.io v0.22.2/go.mod h1:yxeiOL68Rb0Xd1ddK5vPZ/oVn4vY4Ynel7k9FzqtOIw=
diff --git a/kubernetes/adapter.go b/kubernetes/adapter.go
index 9263982..615cff1 100644
--- a/kubernetes/adapter.go
+++ b/kubernetes/adapter.go
@@ -395,7 +395,7 @@ func (a *Adapter) UpdateIngressLoadBalancer(ingress *Ingress, loadBalancerDNSNam
 	case TypeIngress:
 		return a.ingressClient.updateIngressLoadBalancer(a.kubeClient, ingress.Namespace, ingress.Name, loadBalancerDNSName)
 	}
-	return fmt.Errorf("Unknown resourceType '%s', failed to update Kubernetes resource", ingress.ResourceType)
+	return fmt.Errorf("unknown resourceType '%s', failed to update Kubernetes resource", ingress.ResourceType)
 }
 
 // GetConfigMap retrieves the ConfigMap with name from namespace.
diff --git a/kubernetes/client.go b/kubernetes/client.go
index 5ec196b..2b334e7 100644
--- a/kubernetes/client.go
+++ b/kubernetes/client.go
@@ -154,8 +154,12 @@ func (c *simpleClient) createRequest(method, resource string, body io.Reader) (*
 	if c.cfg.UserAgent != "" {
 		req.Header.Set("User-Agent", c.cfg.UserAgent)
 	}
-	if c.cfg.BearerToken != "" {
-		req.Header.Set("Authorization", "Bearer "+c.cfg.BearerToken)
+	if c.cfg.TokenProvider != nil {
+		token, ok := c.cfg.TokenProvider.GetSecret(serviceAccountTokenKey)
+		if !ok {
+			return nil, fmt.Errorf("secret not found: %v", serviceAccountTokenKey)
+		}
+		req.Header.Set("Authorization", "Bearer "+string(token))
 	}
 	return req, nil
 }
@@ -163,7 +167,7 @@ func (c *simpleClient) createRequest(method, resource string, body io.Reader) (*
 func (a *Adapter) NewInclusterConfigClientset(ctx context.Context) error {
 	cfg, err := rest.InClusterConfig()
 	if err != nil {
-		return fmt.Errorf("Can't get in cluster config: %w", err)
+		return fmt.Errorf("can't get in cluster config: %w", err)
 	}
 	// cfg.Timeout = timeout
 	trCfg, err := cfg.TransportConfig()
diff --git a/kubernetes/config.go b/kubernetes/config.go
index f401bb4..9f37e89 100644
--- a/kubernetes/config.go
+++ b/kubernetes/config.go
@@ -1,9 +1,12 @@
 package kubernetes
 
 import (
+	"fmt"
 	"net"
 	"os"
 	"time"
+
+	"github.com/zalando/skipper/secrets"
 )
 
 // Config holds the common attributes that can be passed to a
@@ -17,7 +20,7 @@ type Config struct {
 	// Server requires Bearer authentication. This client will not
 	// attempt to use refresh tokens for an OAuth2 flow.
 	// TODO: demonstrate an OAuth2 compatible client.
-	BearerToken string
+	TokenProvider secrets.SecretsProvider
 
 	// TLSClientConfig contains settings to enable transport layer
 	// security
@@ -67,10 +70,13 @@ func InClusterConfig() (*Config, error) {
 	}
 
 	dir := serviceAccountLocator()
-	token, err := os.ReadFile(dir + serviceAccountTokenKey)
+	tokenProvider := secrets.NewSecretPaths(time.Minute)
+	err := tokenProvider.Add(dir + serviceAccountTokenKey)
+
 	if err != nil {
-		return nil, err
+		return nil, fmt.Errorf("error when adding token file to token provider: %v", err)
 	}
+
 	rootCAFile := dir + serviceAccountRootCAKey
 	if _, err := os.Stat(rootCAFile); os.IsNotExist(err) {
 		return nil, err
@@ -79,7 +85,7 @@ func InClusterConfig() (*Config, error) {
 	return &Config{
 		BaseURL:         "https://" + net.JoinHostPort(host, port),
 		UserAgent:       "kube-ingress-aws-controller",
-		BearerToken:     string(token),
+		TokenProvider:   tokenProvider,
 		Timeout:         10 * time.Second,
 		TLSClientConfig: TLSClientConfig{CAFile: rootCAFile},
 	}, nil
diff --git a/kubernetes/pods.go b/kubernetes/pods.go
index a4f42c3..b358b4b 100644
--- a/kubernetes/pods.go
+++ b/kubernetes/pods.go
@@ -29,7 +29,7 @@ func (a *Adapter) PodInformer(ctx context.Context, endpointChan chan<- []string)
 	informer := factory.Core().V1().Pods().Informer()
 	factory.Start(ctx.Done())
 	if !cache.WaitForCacheSync(ctx.Done(), informer.HasSynced) {
-		return fmt.Errorf("Timed out waiting for caches to sync")
+		return fmt.Errorf("timed out waiting for caches to sync")
 	}
 
 	// list warms the pod cache and verifies whether pods for given specs can be found, preventing to fail silently


Test patch:
diff --git a/kubernetes/adapter_test.go b/kubernetes/adapter_test.go
index ecbb123..730338b 100644
--- a/kubernetes/adapter_test.go
+++ b/kubernetes/adapter_test.go
@@ -469,8 +469,8 @@ func TestInsecureConfig(t *testing.T) {
 	if cfg.CAFile != "" {
 		t.Error("unexpected CAFile attribute")
 	}
-	if cfg.BearerToken != "" {
-		t.Error("unexpected Bearer token attribute")
+	if cfg.TokenProvider != nil {
+		t.Error("unexpected token provider attribute")
 	}
 	if cfg.UserAgent != defaultControllerUserAgent {
 		t.Error("unexpected User Agent attribute")
diff --git a/kubernetes/client_test.go b/kubernetes/client_test.go
index f7a0b68..0e37f0c 100644
--- a/kubernetes/client_test.go
+++ b/kubernetes/client_test.go
@@ -166,7 +166,7 @@ func TestTLS(t *testing.T) {
 	cfg := &Config{
 		BaseURL:         server.URL,
 		UserAgent:       "kube-ingress-aws-controller",
-		BearerToken:     "foo",
+		TokenProvider:   mockSecretProvider("foo"),
 		TLSClientConfig: TLSClientConfig{CAFile: "testdata/cert.pem"},
 		Timeout:         5 * time.Second,
 	}
@@ -183,3 +183,17 @@ func TestTLS(t *testing.T) {
 		defer r.Close()
 	}
 }
+
+// mock the SecretProvider from skipper module
+type mockSecretProvider string
+
+func (sp mockSecretProvider) GetSecret(_ string) ([]byte, bool) {
+	return []byte(sp), true
+}
+
+func (sp mockSecretProvider) Add(_ string) error {
+	return nil
+}
+
+func (sp mockSecretProvider) Close() {
+}