Fix: Strip ServiceAccount token volume mounts from EphemeralContainers in PodAction (#10349)

Signed-off-by: opbot_xd <awasthikrishna23052005@gmail.com>
Co-authored-by: Daniel Jiang <daniel.jiang@broadcom.com>

changelogs/unreleased/10349-opbot-xd

@@ -0,0 +1 @@
+Fix: Strip ServiceAccount token volume mounts from EphemeralContainers during restore

pkg/restore/actions/pod_action.go

@@ -62,25 +62,9 @@ func (a *PodAction) Execute(input *velero.RestoreItemActionExecuteInput) (*veler
 	}
 	pod.Spec.Volumes = preservedVolumes
 
-	for i, container := range pod.Spec.Containers {
-		var preservedVolumeMounts []corev1api.VolumeMount
-		for _, mount := range container.VolumeMounts {
-			if !strings.HasPrefix(mount.Name, serviceAccountTokenPrefix) {
-				preservedVolumeMounts = append(preservedVolumeMounts, mount)
-			}
-		}
-		pod.Spec.Containers[i].VolumeMounts = preservedVolumeMounts
-	}
-
-	for i, container := range pod.Spec.InitContainers {
-		var preservedVolumeMounts []corev1api.VolumeMount
-		for _, mount := range container.VolumeMounts {
-			if !strings.HasPrefix(mount.Name, serviceAccountTokenPrefix) {
-				preservedVolumeMounts = append(preservedVolumeMounts, mount)
-			}
-		}
-		pod.Spec.InitContainers[i].VolumeMounts = preservedVolumeMounts
-	}
+	pod.Spec.Containers = filterContainerVolumeMounts(pod.Spec.Containers, serviceAccountTokenPrefix)
+	pod.Spec.InitContainers = filterContainerVolumeMounts(pod.Spec.InitContainers, serviceAccountTokenPrefix)
+	pod.Spec.EphemeralContainers = filterEphemeralContainerVolumeMounts(pod.Spec.EphemeralContainers, serviceAccountTokenPrefix)
 
 	res, err := runtime.DefaultUnstructuredConverter.ToUnstructured(pod)
 	if err != nil {
@@ -94,3 +78,27 @@ func (a *PodAction) Execute(input *velero.RestoreItemActionExecuteInput) (*veler
 	}
 	return restoreExecuteOutput, nil
 }
+
+func filterVolumeMounts(mounts []corev1api.VolumeMount, prefix string) []corev1api.VolumeMount {
+	var preserved []corev1api.VolumeMount
+	for _, mount := range mounts {
+		if !strings.HasPrefix(mount.Name, prefix) {
+			preserved = append(preserved, mount)
+		}
+	}
+	return preserved
+}
+
+func filterContainerVolumeMounts(containers []corev1api.Container, prefix string) []corev1api.Container {
+	for i, container := range containers {
+		containers[i].VolumeMounts = filterVolumeMounts(container.VolumeMounts, prefix)
+	}
+	return containers
+}
+
+func filterEphemeralContainerVolumeMounts(containers []corev1api.EphemeralContainer, prefix string) []corev1api.EphemeralContainer {
+	for i, container := range containers {
+		containers[i].VolumeMounts = filterVolumeMounts(container.VolumeMounts, prefix)
+	}
+	return containers
+}

pkg/restore/actions/pod_action_test.go

@@ -169,6 +169,47 @@ func TestPodActionExecute(t *testing.T) {
 				},
 			},
 		},
+		{
+			name: "ephemeralContainer volumeMounts matching prefix <service account name>-token- should be deleted",
+			obj: corev1api.Pod{
+				ObjectMeta: metav1.ObjectMeta{Name: "pod-1"},
+				Spec: corev1api.PodSpec{
+					ServiceAccountName: "foo",
+					Volumes: []corev1api.Volume{
+						{Name: "foo"},
+						{Name: "foo-token-foo"},
+					},
+					EphemeralContainers: []corev1api.EphemeralContainer{
+						{
+							EphemeralContainerCommon: corev1api.EphemeralContainerCommon{
+								VolumeMounts: []corev1api.VolumeMount{
+									{Name: "foo"},
+									{Name: "foo-token-foo"},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedRes: corev1api.Pod{
+				ObjectMeta: metav1.ObjectMeta{Name: "pod-1"},
+				Spec: corev1api.PodSpec{
+					ServiceAccountName: "foo",
+					Volumes: []corev1api.Volume{
+						{Name: "foo"},
+					},
+					EphemeralContainers: []corev1api.EphemeralContainer{
+						{
+							EphemeralContainerCommon: corev1api.EphemeralContainerCommon{
+								VolumeMounts: []corev1api.VolumeMount{
+									{Name: "foo"},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
 		{
 			name: "containers and initContainers with no volume mounts should not error",
 			obj: corev1api.Pod{