From c62aafa6f29a134fdc96c6e75364807933e41f40 Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Thu, 7 May 2026 16:19:04 -0700 Subject: [PATCH] adjust an expected err msg in impersonator int test Signed-off-by: Ryan Richard --- test/integration/concierge_impersonation_proxy_test.go | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/test/integration/concierge_impersonation_proxy_test.go b/test/integration/concierge_impersonation_proxy_test.go index b6f35d7c3..338cd52bf 100644 --- a/test/integration/concierge_impersonation_proxy_test.go +++ b/test/integration/concierge_impersonation_proxy_test.go @@ -589,11 +589,8 @@ func TestImpersonationProxy(t *testing.T) { //nolint:gocyclo // yeah, it's compl _, err = nestedImpersonationClient.Kubernetes.CoreV1().Secrets(env.ConciergeNamespace).Get(ctx, impersonationProxyTLSSecretName(env), metav1.GetOptions{}) // this user is not allowed to impersonate other users require.True(t, apierrors.IsForbidden(err), err) - require.EqualError(t, err, fmt.Sprintf( - `secrets "%s" is forbidden: `+ - `User "%s" cannot impersonate-on:user-info:get resource "secrets" in API group "" in the namespace "%s": `+ - `decision made by impersonation-proxy.concierge.pinniped.dev`, - impersonationProxyTLSSecretName(env), env.TestUser.ExpectedUsername, env.ConciergeNamespace)) + require.Contains(t, err.Error(), fmt.Sprintf(`is forbidden: User "%s" cannot impersonate`, env.TestUser.ExpectedUsername)) + require.Contains(t, err.Error(), `decision made by impersonation-proxy.concierge.pinniped.dev`) // impersonate the GC service account instead which can read anything (the binding to edit allows this) nestedImpersonationClientAsSA, credentialsAsSA := newImpersonationProxyClient(t, impersonationProxyURL, impersonationProxyCACertPEM,