Create service account secret if not found (stolostron#3508)

* Create service account secret if not found

Signed-off-by: Kevin Cormier <kcormier@redhat.com>

* Fix for jq 1.7.1

Signed-off-by: Kevin Cormier <kcormier@redhat.com>

* Use service account secret in MCE namespace created by setup script

Signed-off-by: Kevin Cormier <kcormier@redhat.com>

---------

Signed-off-by: Kevin Cormier <kcormier@redhat.com>

Author: KevinFCormier

setup.sh

@@ -27,7 +27,21 @@ INSTALLATION_NAMESPACE=`oc get multiclusterhub -A -o jsonpath='{.items[0].metada
 INSTALLATION_NAMESPACE_MCE=`oc get multiclusterengine -A -o jsonpath='{.items[0].spec.targetNamespace}'`
 
 SA=$(oc get serviceaccounts -n $INSTALLATION_NAMESPACE_MCE console-mce -o jsonpath='{.metadata.name}')
-SA_SECRET=$(oc get secrets -n $INSTALLATION_NAMESPACE_MCE -o json | jq -r "[.items[] | select(.metadata.annotations[\"kubernetes.io/service-account.name\"] == \"$SA\" and .type == \"kubernetes.io/service-account-token\")][0].metadata.name")
+SA_SECRET=$(oc get secrets -n $INSTALLATION_NAMESPACE_MCE -o json | jq -r "[.items[] | select(.metadata.annotations[\"kubernetes.io/service-account.name\"] == \"$SA\" and .type == \"kubernetes.io/service-account-token\")][0].metadata.name // \"\"")
+if [[ -z "$SA_SECRET" ]]; then
+  oc apply -f - << EOF
+apiVersion: v1
+kind: Secret
+metadata:
+  name: console-mce-token
+  namespace: $INSTALLATION_NAMESPACE_MCE
+  annotations:
+    kubernetes.io/service-account.name: $SA 
+type: kubernetes.io/service-account-token 
+EOF
+  SA_SECRET="console-mce-token"
+fi
+
 SA_TOKEN=`oc get secret -n $INSTALLATION_NAMESPACE_MCE ${SA_SECRET} -o="jsonpath={.data.token}" | base64 -d`
 CA_CERT=`oc get secret -n $INSTALLATION_NAMESPACE_MCE ${SA_SECRET} -o="jsonpath={.data.ca\.crt}"`
 SERVICE_CA_CERT=`oc get secret -n $INSTALLATION_NAMESPACE_MCE ${SA_SECRET} -o="jsonpath={.data.service-ca\.crt}"`

start-ocp-console.sh

@@ -7,7 +7,8 @@ oc process -f ocp-console-oauth-client.yaml | oc apply -f -
 
 oc get oauthclient console-oauth-client -o jsonpath='{.secret}' > ocp-console/console-client-secret
 
-oc get secrets -n default --field-selector type=kubernetes.io/service-account-token -o json | \
+INSTALLATION_NAMESPACE_MCE=`oc get multiclusterengine -A -o jsonpath='{.items[0].spec.targetNamespace}'`
+oc get secrets -n $INSTALLATION_NAMESPACE_MCE --field-selector type=kubernetes.io/service-account-token -o json | \
     jq '.items[0].data."ca.crt"' -r | python -m base64 -d > ocp-console/ca.crt
 
 CONSOLE_VERSION=${CONSOLE_VERSION:=4.13}