[1.24] change windows calico setup to generate a sa token (#2940)

* change windows calico setup to generate a sa token

* remove secrets list/get as it is no longer needed for rke2-controller

pkg/rke2/clusterrole_bootstrap.go

@@ -40,7 +40,7 @@ func clusterRoles() []rbacv1.ClusterRole {
 				rbacv1helpers.NewRule("list", "watch").Groups(legacyGroup).Resources("namespaces").RuleOrDie(),
 				rbacv1helpers.NewRule("list", "watch").Groups(networkingGroup).Resources("networkpolicies").RuleOrDie(),
 				rbacv1helpers.NewRule("list", "watch", "get").Groups(legacyGroup).Resources("endpoints", "pods").RuleOrDie(),
-				rbacv1helpers.NewRule("list", "get").Groups(legacyGroup).Resources("secrets").RuleOrDie(),
+				rbacv1helpers.NewRule("create").Groups(legacyGroup).Resources("serviceaccounts/token").RuleOrDie(),
 				rbacv1helpers.NewRule("list", "get").Groups(helmGroup).Resources("helmcharts", "helmchartconfigs").RuleOrDie(),
 			},
 		},

pkg/windows/calico.go

@@ -6,7 +6,6 @@ package windows
 import (
 	"context"
 	"encoding/json"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -25,13 +24,16 @@ import (
 	"github.com/k3s-io/k3s/pkg/daemons/agent"
 	"github.com/k3s-io/k3s/pkg/daemons/config"
 	daemonconfig "github.com/k3s-io/k3s/pkg/daemons/config"
-	netroute "github.com/libp2p/go-netroute"
+	"github.com/k3s-io/k3s/pkg/version"
+	"github.com/libp2p/go-netroute"
+	"github.com/pkg/errors"
 	"github.com/sirupsen/logrus"
-	v1 "k8s.io/api/core/v1"
+	authv1 "k8s.io/api/authentication/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/rest"
+	"k8s.io/utils/pointer"
 )
 
 type Calico struct{}
@@ -59,25 +61,20 @@ func (c *Calico) Setup(ctx context.Context, dataDir string, nodeConfig *daemonco
 	if err != nil {
 		return nil, err
 	}
+	serviceAccounts := client.CoreV1().ServiceAccounts(CalicoSystemNamespace)
 
-	secrets, err := client.CoreV1().Secrets(CalicoSystemNamespace).List(ctx, metav1.ListOptions{})
-	if err != nil {
-		return nil, err
+	req := authv1.TokenRequest{
+		Spec: authv1.TokenRequestSpec{
+			Audiences:         []string{version.Program},
+			ExpirationSeconds: pointer.Int64(60 * 60 * 24 * 365),
+		},
 	}
 
-	for _, secret := range secrets.Items {
-		if !isCalicoNodeToken(&secret) {
-			continue
-		}
-		value, ok := secret.Data["token"]
-		if !ok {
-			continue
-		}
-		calicoKubeConfig.Token = string(value)
-	}
-	if calicoKubeConfig.Token == "" {
-		return nil, errors.New("could not retrieve calico node token from the cluster")
+	token, err := serviceAccounts.CreateToken(ctx, calicoNode, &req, metav1.CreateOptions{})
+	if err != nil {
+		return nil, errors.Wrapf(err, "failed to create token for service account (%s/%s)", CalicoSystemNamespace, calicoNode)
 	}
+	calicoKubeConfig.Token = token.Status.Token
 
 	cfg := &CNIConfig{NodeConfig: nodeConfig, NetworkName: "Calico", BindAddress: nodeConfig.AgentConfig.NodeIP}
 
@@ -203,7 +200,7 @@ func startFelix(ctx context.Context, config *CalicoConfig) {
 		"-felix",
 	}
 
-	logrus.Infof("Felix Envs: ", append(generateGeneralCalicoEnvs(config), specificEnvs...))
+	logrus.Infof("Felix Envs: %s", append(generateGeneralCalicoEnvs(config), specificEnvs...))
 	cmd := exec.CommandContext(ctx, "calico-node.exe", args...)
 	cmd.Env = append(generateGeneralCalicoEnvs(config), specificEnvs...)
 	cmd.Stdout = os.Stdout
@@ -221,7 +218,7 @@ func startCalico(ctx context.Context, config *CalicoConfig) error {
 	args := []string{
 		"-startup",
 	}
-	logrus.Infof("Calico Envs: ", append(generateGeneralCalicoEnvs(config), specificEnvs...))
+	logrus.Infof("Calico Envs: %s", append(generateGeneralCalicoEnvs(config), specificEnvs...))
 	cmd := exec.CommandContext(ctx, "calico-node.exe", args...)
 	cmd.Env = append(generateGeneralCalicoEnvs(config), specificEnvs...)
 	cmd.Stdout = os.Stdout
@@ -541,10 +538,3 @@ func getCNIConfigOverrides(cniConfig *CNIConfig, hc *helm.Factory) error {
 func coreClient(restConfig *rest.Config) (kubernetes.Interface, error) {
 	return kubernetes.NewForConfig(restConfig)
 }
-
-func isCalicoNodeToken(s *v1.Secret) bool {
-	if v, ok := s.Annotations["kubernetes.io/service-account.name"]; ok && v == calicoNode {
-		return true
-	}
-	return false
-}