fix: propagate SERVICE_ACCOUNT_ISSUER to workload cluster template#6302
fix: propagate SERVICE_ACCOUNT_ISSUER to workload cluster template#6302andyzhangx wants to merge 1 commit into
Conversation
kind-with-registry.sh creates an OIDC storage account and sets
SERVICE_ACCOUNT_ISSUER, but this value was lost when
create-workload-cluster runs envsubst in a separate shell context.
The workload cluster template has:
service-account-issuer: ${SERVICE_ACCOUNT_ISSUER:-https://kubernetes.default.svc.cluster.local}
Without the propagation, the fallback value is used, which is
unreachable by AAD for OIDC discovery, breaking Workload Identity
on CAPZ workload clusters.
Fix: persist SERVICE_ACCOUNT_ISSUER to a .env file in
kind-with-registry.sh and source it in the create-workload-cluster
Makefile target before running envsubst.
k8s-ci-robot
added
do-not-merge/release-note-label-needed
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
k8s-ci-robot
added
release-note-none
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-1.23 #6302 +/- ##
=============================================
Coverage 43.74% 43.74%
=============================================
Files 289 289
Lines 25475 25475
=============================================
Hits 11145 11145
Misses 13527 13527
Partials 803 803 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
There was a problem hiding this comment.
@andyzhangx this looks good to me, but could you reopen it against main? Then we can cherry-pick it into the release-1.24 and release-1.23 branches.
|
addressed by #6306 |
3 participants
What this PR does
kind-with-registry.shcreates an OIDC storage account and exportsSERVICE_ACCOUNT_ISSUER, but this value is lost whencreate-workload-clusterrunsenvsubstin a separate Make recipe (each recipe line runs in its own shell).The workload cluster template (#6288) has:
Without propagation, the fallback
https://kubernetes.default.svc.cluster.localis used. AAD cannot reach this URL for OIDC discovery, breaking Workload Identity on CAPZ workload clusters.How it works
kind-with-registry.sh: After resolvingSERVICE_ACCOUNT_ISSUER(either BYO or auto-created), persist it to${REPO_ROOT}/.service-account-issuer.envMakefile(create-workload-cluster): Source the.envfile before runningenvsubston the cluster templateWhy this is needed
Downstream CSI driver E2E tests (e.g., blob-csi-driver) that test Workload Identity on CAPZ workload clusters fail because AAD returns
AADSTS501661— it cannot perform OIDC discovery against the cluster-internalkubernetes.default.svc.cluster.localURL.Related: #6288
Release note: