Skip to content

Commit eacc2e8

Browse files
committed
Adjusting create-kubeconfig.sh script to avoid race condition where the service-account-token secret was created, but the .data.token has not yet been populated.
1 parent 6fc411c commit eacc2e8

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

hack/create-kubeconfig.sh

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,10 @@ kubectl config view --minify --raw > "${kubeconfig}"
3535
# Grab the service account token. If one has not already been generated,
3636
# create a secret to do so. See the LegacyServiceAccountTokenNoAutoGeneration
3737
# feature gate.
38-
for i in 1 2; do
38+
for i in 1 2 3 4; do
3939
token=$(kubectl get secret -n "${namespace}" -o go-template='
4040
{{- range .items }}
41-
{{- if and (eq (or .type "") "kubernetes.io/service-account-token") .metadata.annotations }}
41+
{{- if and (eq (or .type "") "kubernetes.io/service-account-token") .metadata.annotations .data }}
4242
{{- if (eq (or (index .metadata.annotations "kubernetes.io/service-account.name") "") "'"${account}"'") }}
4343
{{- if (ne (or (index .metadata.annotations "kubernetes.io/created-by") "") "openshift.io/create-dockercfg-secrets") }}
4444
{{- .data.token | base64decode }}
@@ -57,6 +57,10 @@ metadata: {
5757
name: ${account}-token,
5858
annotations: { kubernetes.io/service-account.name: ${account} }
5959
}"
60+
# If we are on our third or fourth loop, try sleeping to give kube time to create the token
61+
if [ $i -gt 2 ]; then
62+
sleep $(($i-2))
63+
fi
6064
done
6165
kubectl config --kubeconfig="${kubeconfig}" set-credentials "${account}" --token="${token}"
6266

0 commit comments

Comments
 (0)