From 13c31f7c1cb598136128dcbab14affaa1a0c0070 Mon Sep 17 00:00:00 2001 From: Anjali-Chauhan1 Date: Thu, 2 Jul 2026 00:21:17 +0530 Subject: [PATCH 1/3] fix: prune consecutive auto-generated ServiceAccount token secrets Signed-off-by: Anjali-Chauhan1 --- .../default/native/prune/prune.go | 13 +++++-- .../default/native/prune/prune_test.go | 37 +++++++++++++++++++ 2 files changed, 46 insertions(+), 4 deletions(-) diff --git a/pkg/resourceinterpreter/default/native/prune/prune.go b/pkg/resourceinterpreter/default/native/prune/prune.go index bcb9f0915402..55ec11452756 100644 --- a/pkg/resourceinterpreter/default/native/prune/prune.go +++ b/pkg/resourceinterpreter/default/native/prune/prune.go @@ -173,12 +173,17 @@ func removeServiceAccountIrrelevantField(workload *unstructured.Unstructured) er // If 'secrets' exists in ServiceAccount, remove the automatic generation secrets (e.g. default-token-xxx) if exist && len(secrets) > 0 { tokenPrefix := fmt.Sprintf("%s-token-", workload.GetName()) - for idx := 0; idx < len(secrets); idx++ { - if strings.HasPrefix(secrets[idx].(map[string]any)["name"].(string), tokenPrefix) { - secrets = append(secrets[:idx], secrets[idx+1:]...) + retained := make([]any, 0, len(secrets)) + for _, secret := range secrets { + entry, ok := secret.(map[string]any) + if ok { + if name, ok := entry["name"].(string); ok && strings.HasPrefix(name, tokenPrefix) { + continue + } } + retained = append(retained, secret) } - _ = unstructured.SetNestedSlice(workload.Object, secrets, "secrets") + _ = unstructured.SetNestedSlice(workload.Object, retained, "secrets") } return nil } diff --git a/pkg/resourceinterpreter/default/native/prune/prune_test.go b/pkg/resourceinterpreter/default/native/prune/prune_test.go index f0edf7b385f3..be128f0d0edf 100755 --- a/pkg/resourceinterpreter/default/native/prune/prune_test.go +++ b/pkg/resourceinterpreter/default/native/prune/prune_test.go @@ -184,6 +184,43 @@ func TestRemoveIrrelevantField(t *testing.T) { return false }, }, + { + name: "remove consecutive serviceaccount token secrets", + workload: &unstructured.Unstructured{ + Object: map[string]any{ + "kind": util.ServiceAccountKind, + "metadata": map[string]any{ + "name": "foo", + }, + "secrets": []any{ + map[string]any{ + "name": "foo-token-aaaaa", + }, + map[string]any{ + "name": "foo-token-bbbbb", + }, + map[string]any{ + "name": "foo-dockercfg-zdr2j", + }, + }, + }, + }, + extraHooks: nil, + unexpectedFields: []field{{"secrets"}}, + unexpectedResource: "foo-token-bbbbb", + shouldNotRemoveFields: []field{{"secrets"}}, + shouldNotRemoveResource: "foo-dockercfg-zdr2j", + containsFunc: func(obj any, resource string) bool { + maps, _ := obj.([]any) + + for _, m := range maps { + if m.(map[string]any)["name"] == resource { + return true + } + } + return false + }, + }, { name: "remove service-account token secret irrelevant fields", workload: &unstructured.Unstructured{ From 3873e27490124c11e7c3aa825854c0b71e4036eb Mon Sep 17 00:00:00 2001 From: Anjali-Chauhan1 Date: Thu, 2 Jul 2026 00:45:09 +0530 Subject: [PATCH 2/3] test: cover malformed ServiceAccount secret entries Signed-off-by: Anjali-Chauhan1 --- .../default/native/prune/prune_test.go | 48 ++++++++++++++++++- 1 file changed, 47 insertions(+), 1 deletion(-) diff --git a/pkg/resourceinterpreter/default/native/prune/prune_test.go b/pkg/resourceinterpreter/default/native/prune/prune_test.go index be128f0d0edf..37402dc21c7c 100755 --- a/pkg/resourceinterpreter/default/native/prune/prune_test.go +++ b/pkg/resourceinterpreter/default/native/prune/prune_test.go @@ -214,7 +214,53 @@ func TestRemoveIrrelevantField(t *testing.T) { maps, _ := obj.([]any) for _, m := range maps { - if m.(map[string]any)["name"] == resource { + entry, ok := m.(map[string]any) + if !ok { + continue + } + if name, ok := entry["name"].(string); ok && name == resource { + return true + } + } + return false + }, + }, + { + name: "remove token secrets while tolerating malformed secret entries", + workload: &unstructured.Unstructured{ + Object: map[string]any{ + "kind": util.ServiceAccountKind, + "metadata": map[string]any{ + "name": "foo", + }, + "secrets": []any{ + "malformed-non-map-entry", + map[string]any{ + "kind": "Secret", + }, + map[string]any{ + "name": "foo-token-ccccc", + }, + map[string]any{ + "name": "foo-dockercfg-mmmmm", + }, + }, + }, + }, + extraHooks: nil, + unexpectedFields: []field{{"secrets"}}, + unexpectedResource: "foo-token-ccccc", + shouldNotRemoveFields: []field{{"secrets"}}, + shouldNotRemoveResource: "foo-dockercfg-mmmmm", + containsFunc: func(obj any, resource string) bool { + maps, _ := obj.([]any) + + for _, m := range maps { + entry, ok := m.(map[string]any) + if !ok { + continue + } + if name, ok := entry["name"].(string); ok && name == resource { return true } } From 2c59dfdc813f9620067bbb2e2aea1eb791877322 Mon Sep 17 00:00:00 2001 From: Anjali-Chauhan1 Date: Thu, 2 Jul 2026 01:37:44 +0530 Subject: [PATCH 3/3] fix: add cyclomatic complexity linting directive to TestRemoveIrrelevantField Signed-off-by: Anjali-Chauhan1 --- pkg/resourceinterpreter/default/native/prune/prune_test.go | 1 + 1 file changed, 1 insertion(+) diff --git a/pkg/resourceinterpreter/default/native/prune/prune_test.go b/pkg/resourceinterpreter/default/native/prune/prune_test.go index 37402dc21c7c..c4080d4fd13e 100755 --- a/pkg/resourceinterpreter/default/native/prune/prune_test.go +++ b/pkg/resourceinterpreter/default/native/prune/prune_test.go @@ -46,6 +46,7 @@ type test struct { containsFunc func(any, string) bool } +//nolint:gocyclo func TestRemoveIrrelevantField(t *testing.T) { var tests = []*test{ {