Integration tests should use a valid value for CredentialIssuer spec.impersonationProxy.service.type

internal/testutil/kube_server_compatibility.go

@@ -10,6 +10,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	certificatesv1 "k8s.io/api/certificates/v1"
+	v1 "k8s.io/api/core/v1"
 	"k8s.io/client-go/discovery"
 )
 
@@ -48,3 +49,54 @@ func KubeServerMinorVersionInBetweenInclusive(t *testing.T, discoveryClient disc
 
 	return minor >= min && minor <= max
 }
+
+func convertMap[K1, K2 comparable, V1, V2 any](m1 map[K1]V1, fT func(K1) K2, fU func(V1) V2) map[K2]V2 {
+	m2 := make(map[K2]V2)
+	for k, v := range m1 {
+		m2[fT(k)] = fU(v)
+	}
+	return m2
+}
+
+func identity[T any](t T) T {
+	return t
+}
+
+func CheckServiceAccountExtraFieldsAccountingForChangesInK8s1_30[M ~map[string]V, V ~[]string](
+	t *testing.T,
+	discoveryClient discovery.DiscoveryInterface,
+	actualExtras M,
+	expectedPodValues *v1.Pod,
+) {
+	t.Helper()
+
+	extra := convertMap(
+		actualExtras,
+		identity[string],
+		func(v V) []string {
+			return v
+		},
+	)
+
+	require.Equal(t, extra["authentication.kubernetes.io/pod-name"], []string{expectedPodValues.Name})
+	require.Equal(t, extra["authentication.kubernetes.io/pod-uid"], []string{string(expectedPodValues.UID)})
+
+	if KubeServerMinorVersionAtLeastInclusive(t, discoveryClient, 30) {
+		// Starting in K8s 1.30, three additional `Extra` fields were added with unpredictable values.
+		// This is because the following three feature gates were enabled by default in 1.30.
+		// https://kubernetes.io/docs/reference/command-line-tools-reference/feature-gates/
+		// - ServiceAccountTokenJTI
+		// - ServiceAccountTokenNodeBindingValidation
+		// - ServiceAccountTokenPodNodeInfo
+		// These were added in source code in 1.29 but not enabled by default until 1.30.
+		// <1.29: https://pkg.go.dev/k8s.io/apiserver@v0.28.7/pkg/authentication/serviceaccount
+		// 1.29+: https://pkg.go.dev/k8s.io/apiserver@v0.29.0/pkg/authentication/serviceaccount
+
+		require.Equal(t, 5, len(extra))
+		require.NotEmpty(t, extra["authentication.kubernetes.io/credential-id"])
+		require.NotEmpty(t, extra["authentication.kubernetes.io/node-name"])
+		require.NotEmpty(t, extra["authentication.kubernetes.io/node-uid"])
+	} else {
+		require.Equal(t, 2, len(extra))
+	}
+}