fix: prune consecutive auto-generated ServiceAccount token secrets

pkg/resourceinterpreter/default/native/prune/prune.go

@@ -173,12 +173,17 @@ func removeServiceAccountIrrelevantField(workload *unstructured.Unstructured) er
 	// If 'secrets' exists in ServiceAccount, remove the automatic generation secrets (e.g. default-token-xxx)
 	if exist && len(secrets) > 0 {
 		tokenPrefix := fmt.Sprintf("%s-token-", workload.GetName())
-		for idx := 0; idx < len(secrets); idx++ {
-			if strings.HasPrefix(secrets[idx].(map[string]any)["name"].(string), tokenPrefix) {
-				secrets = append(secrets[:idx], secrets[idx+1:]...)
+		retained := make([]any, 0, len(secrets))
+		for _, secret := range secrets {
+			entry, ok := secret.(map[string]any)
+			if ok {
+				if name, ok := entry["name"].(string); ok && strings.HasPrefix(name, tokenPrefix) {
+					continue
+				}
 			}
+			retained = append(retained, secret)
 		}
-		_ = unstructured.SetNestedSlice(workload.Object, secrets, "secrets")
+		_ = unstructured.SetNestedSlice(workload.Object, retained, "secrets")
 	}
 	return nil
 }

pkg/resourceinterpreter/default/native/prune/prune_test.go

@@ -46,6 +46,7 @@ type test struct {
 	containsFunc            func(any, string) bool
 }
 
+//nolint:gocyclo
 func TestRemoveIrrelevantField(t *testing.T) {
 	var tests = []*test{
 		{
@@ -184,6 +185,89 @@ func TestRemoveIrrelevantField(t *testing.T) {
 				return false
 			},
 		},
+		{
+			name: "remove consecutive serviceaccount token secrets",
+			workload: &unstructured.Unstructured{
+				Object: map[string]any{
+					"kind": util.ServiceAccountKind,
+					"metadata": map[string]any{
+						"name": "foo",
+					},
+					"secrets": []any{
+						map[string]any{
+							"name": "foo-token-aaaaa",
+						},
+						map[string]any{
+							"name": "foo-token-bbbbb",
+						},
+						map[string]any{
+							"name": "foo-dockercfg-zdr2j",
+						},
+					},
+				},
+			},
+			extraHooks:              nil,
+			unexpectedFields:        []field{{"secrets"}},
+			unexpectedResource:      "foo-token-bbbbb",
+			shouldNotRemoveFields:   []field{{"secrets"}},
+			shouldNotRemoveResource: "foo-dockercfg-zdr2j",
+			containsFunc: func(obj any, resource string) bool {
+				maps, _ := obj.([]any)
+
+				for _, m := range maps {
+					entry, ok := m.(map[string]any)
+					if !ok {
+						continue
+					}
+					if name, ok := entry["name"].(string); ok && name == resource {
+						return true
+					}
+				}
+				return false
+			},
+		},
+		{
+			name: "remove token secrets while tolerating malformed secret entries",
+			workload: &unstructured.Unstructured{
+				Object: map[string]any{
+					"kind": util.ServiceAccountKind,
+					"metadata": map[string]any{
+						"name": "foo",
+					},
+					"secrets": []any{
+						"malformed-non-map-entry",
+						map[string]any{
+							"kind": "Secret",
+						},
+						map[string]any{
+							"name": "foo-token-ccccc",
+						},
+						map[string]any{
+							"name": "foo-dockercfg-mmmmm",
+						},
+					},
+				},
+			},
+			extraHooks:              nil,
+			unexpectedFields:        []field{{"secrets"}},
+			unexpectedResource:      "foo-token-ccccc",
+			shouldNotRemoveFields:   []field{{"secrets"}},
+			shouldNotRemoveResource: "foo-dockercfg-mmmmm",
+			containsFunc: func(obj any, resource string) bool {
+				maps, _ := obj.([]any)
+
+				for _, m := range maps {
+					entry, ok := m.(map[string]any)
+					if !ok {
+						continue
+					}
+					if name, ok := entry["name"].(string); ok && name == resource {
+						return true
+					}
+				}
+				return false
+			},
+		},
 		{
 			name: "remove service-account token secret irrelevant fields",
 			workload: &unstructured.Unstructured{