[release-1.35] test: fix workload identity e2e test#3155
Conversation
Premium_LRS has a minimum share size of 100GiB. The test was requesting 10Gi which Azure auto-expanded to 100Gi, causing the pvCapacity assertion to fail.
…ad identity e2e test Port critical workload identity infrastructure from blob-csi-driver PR kubernetes-sigs#2445: 1. Background AAD token exchange warm-up (waitForAADTokenExchange) - polls AAD for up to 45min until token exchange succeeds, running in parallel with other tests to avoid blocking the suite. 2. OIDC JWKS readiness check (waitForOIDCJWKS) - ensures the JWKS endpoint returns valid signing keys before proceeding. 3. CAPZ JWKS key mismatch detection and repair (verifyJWKSKeyMatch) - detects when blob-hosted JWKS has different signing keys than kube-apiserver and re-uploads the correct JWKS. Without this, AAD permanently rejects token exchanges with AADSTS7000272. 4. WI test now waits on wiReady channel for warm-up completion before running, preventing the 30min pod Pending timeout. 5. setupWorkloadIdentity now returns (clientID, error) to pass the client ID to the background warm-up goroutine. Also adds github.com/Azure/azure-sdk-for-go/sdk/storage/azblob dependency for blob upload operations.
…t false for WI CSI tokenRequests for workload identity are handled by kubelet based on the pod's service account; no in-container token mount is needed.
|
@andyzhangx: GitHub didn't allow me to request PR reviews from the following users: andyzhangx. Note that only kubernetes-sigs members and repo collaborators can review this PR, and authors cannot review their own PRs. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: andyzhangx The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
k8s-ci-robot
added
approved
andyzhangx
changed the title
|
/retest |
|
@andyzhangx: The following test failed, say
Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
andyzhangx
merged commit 937f865
into
kubernetes-sigs:release-1.35
2 participants
Cherry-pick of #3154 to release-1.35
Changes
SetAutomountServiceAccountTokenfunction (CSI tokenRequests handled by kubelet, no pod SA token mount needed)Why cherry-pick
The WI e2e test on release-1.35 has the same AADSTS7000272 / CAPZ JWKS key mismatch issues as master. This fix is needed to make the WI test reliable on release-1.35 CI.
/cc @andyzhangx