[GitHub] [pulsar] zzzz465 edited a discussion: pulsar function's statefulset pod have sa token with expiration 0

["zzzz465 (via GitHub)" <gi...@apache.org>]

GitHub user zzzz465 edited a discussion: pulsar function's statefulset pod have sa token with expiration 0

Hi, I'm trying to deploy pulsar cluster on k8s (EKS), with OIDC authentication enabled.
while I was able to provision the pulsar cluster, I cannot make pulsar function works.

the problem is, when I create a pulsar function using pulsar-admin CLI, it creates a statefulset that have service account token volume projection with `expirationSeconds: 0`, causing pod launch failure.

the error message
```txt
Pod "pf-test-test-namespace-example-0" is invalid: [spec.volumes[0].projected.sources[0].serviceAccountToken.expirationSeconds: Invalid value: 0: may not specify a duration less than 10 minutes
```

the created statefulset yaml looks like this.

```yaml
# ... other stuffs above
  template:
    metadata:
      creationTimestamp: null
      labels:
        component: function
        name: example
        namespace: test-namespace
        tenant: test
      annotations:
        prometheus.io/port: "9094"
        prometheus.io/scrape: "true"
    spec:
      volumes:
        - name: service-account-token
          projected:
            sources:
              - serviceAccountToken:
                  expirationSeconds: 0 # <- this must have minimum 10 minutes
                  path: token
            defaultMode: 420
```

also, I setup broker's config like this.

```yaml
PF_functionAuthProviderClassName: "org.apache.pulsar.functions.auth.KubernetesServiceAccountTokenAuthProvider"
PF_kubernetesContainerFactory_kubernetesFunctionAuthProviderConfig_serviceAccountTokenExpirationSeconds: "600"
PF_kubernetesContainerFactory_kubernetesFunctionAuthProviderConfig_serviceAccountTokenAudience: "https://kubernetes.default.svc"
```

[as the document says](https://pulsar.apache.org/docs/next/functions-runtime-kubernetes/#enable-kubernetes-service-account-token-projection-for-function-pod-authentication), the `serviceAccountTokenExpirationSeconds` should configure the target value.
 
this is broker's yaml printed and we can check that the `serviceAccountTokenExpirationSeconds` are set properly.

```yaml
kubernetesContainerFactory:
  changeConfigMapNamespace: test-pulsar
  expectedMetricsCollectionInterval: '30'
  installUserCodeDependencies: 'true'
  jobNamespace: test-pulsar
  kubernetesFunctionAuthProviderConfig:
    serviceAccountTokenExpirationSeconds: "600"
    serviceAccountTokenAudience: https://kubernetes.default.svc
```

also, I tried omitting that value and it still not works. according to the source code, [it should have default value to 3600 second](https://github.com/apache/pulsar/blob/e8a3011ecb78bb325a34a3dc5559ac1d4f7a620d/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/auth/KubernetesServiceAccountTokenAuthProvider.java#L52-L53)

am I missing something?

GitHub link: https://github.com/apache/pulsar/discussions/20708

----
This is an automatically sent email for commits@pulsar.apache.org.
To unsubscribe, please send an email to: commits-unsubscribe@pulsar.apache.org