@@ -50,10 +50,12 @@ import (
50
50
"k8s.io/apimachinery/pkg/fields"
51
51
"k8s.io/apimachinery/pkg/labels"
52
52
"k8s.io/apimachinery/pkg/runtime"
53
+ "k8s.io/apimachinery/pkg/runtime/schema"
53
54
"k8s.io/apimachinery/pkg/util/sets"
54
55
"k8s.io/apimachinery/pkg/util/uuid"
55
56
"k8s.io/apimachinery/pkg/util/wait"
56
57
utilyaml "k8s.io/apimachinery/pkg/util/yaml"
58
+ "k8s.io/apimachinery/pkg/watch"
57
59
clientset "k8s.io/client-go/kubernetes"
58
60
"k8s.io/client-go/kubernetes/scheme"
59
61
"k8s.io/client-go/rest"
@@ -62,7 +64,6 @@ import (
62
64
clientcmdapi "k8s.io/client-go/tools/clientcmd/api"
63
65
watchtools "k8s.io/client-go/tools/watch"
64
66
podutil "k8s.io/kubernetes/pkg/api/v1/pod"
65
- "k8s.io/kubernetes/pkg/client/conditions"
66
67
"k8s.io/kubernetes/pkg/controller"
67
68
taintutils "k8s.io/kubernetes/pkg/util/taints"
68
69
testutils "k8s.io/kubernetes/test/utils"
@@ -281,10 +282,24 @@ func waitForServiceAccountInNamespace(c clientset.Interface, ns, serviceAccountN
281
282
}
282
283
ctx , cancel := watchtools .ContextWithOptionalTimeout (context .Background (), timeout )
283
284
defer cancel ()
284
- _ , err = watchtools .UntilWithoutRetry (ctx , w , conditions . ServiceAccountHasSecrets )
285
+ _ , err = watchtools .UntilWithoutRetry (ctx , w , serviceAccountHasSecrets )
285
286
return err
286
287
}
287
288
289
+ // serviceAccountHasSecrets returns true if the service account has at least one secret,
290
+ // false if it does not, or an error.
291
+ func serviceAccountHasSecrets (event watch.Event ) (bool , error ) {
292
+ switch event .Type {
293
+ case watch .Deleted :
294
+ return false , apierrors .NewNotFound (schema.GroupResource {Resource : "serviceaccounts" }, "" )
295
+ }
296
+ switch t := event .Object .(type ) {
297
+ case * v1.ServiceAccount :
298
+ return len (t .Secrets ) > 0 , nil
299
+ }
300
+ return false , nil
301
+ }
302
+
288
303
// WaitForDefaultServiceAccountInNamespace waits for the default service account to be provisioned
289
304
// the default service account is what is associated with pods when they do not specify a service account
290
305
// as a result, pods are not able to be provisioned in a namespace until the service account is provisioned
0 commit comments