use the upstream SA token controller

[deads2k]

This patches in our service serving cert CA initialization in the upstream SA token controller when requested. This makes it easier to run the upstream controllers in 3.10 and doing it in 3.9 makes for a smooth transition on the leases.

[simo5]

/unassign

[deads2k]

/retest

[deads2k]

/retest

[deads2k]

/retest

[deads2k]

/assign @mfojtik

prereq for cluster up

[soltysh]

/lgtm

[openshift-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deads2k, soltysh

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• pkg/cmd/OWNERS [deads2k]
• test/util/OWNERS [deads2k,soltysh]
• vendor/k8s.io/kubernetes/cmd/kube-controller-manager/OWNERS [deads2k]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[openshift-merge-robot]

/test all [submit-queue is verifying that this PR is safe to merge]

[openshift-merge-robot]

Automatic merge from submit-queue (batch tested with PRs 18591, 18508).

[openshift-ci-robot]

@deads2k: The following test failed, say /retest to rerun them all:

Test name	Commit	Details	Rerun command
ci/openshift-jenkins/extended_conformance_install	cedcafd	link	/test extended_conformance_install

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[smarterclayton]

This probably introduced a flake. Please fix (1/5-1/6 runs)

[sig-network] Networking Granular Checks: Pods should function for intra-pod communication: http [Conformance] [Suite:openshift/conformance/parallel] [Suite:k8s] 26s

/tmp/openshift/build-rpms/rpm/BUILD/origin-3.9.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/kubernetes/test/e2e/framework/framework.go:648
Error creating Pod
Expected error:
    <*errors.StatusError | 0xc420274ea0>: {
        ErrStatus: {
            TypeMeta: {Kind: "", APIVersion: ""},
            ListMeta: {SelfLink: "", ResourceVersion: "", Continue: ""},
            Status: "Failure",
            Message: "No API token found for service account \"default\", retry after the token is automatically created and added to the service account",
            Reason: "ServerTimeout",
            Details: {
                Name: "create pod",
                Group: "",
                Kind: "serviceaccounts",
                UID: "",
                Causes: nil,
                RetryAfterSeconds: 1,
            },
            Code: 500,
        },
    }
    No API token found for service account "default", retry after the token is automatically created and added to the service account
not to have occurred
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.9.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/kubernetes/test/e2e/framework/pods.go:76

https://openshift-gce-devel.appspot.com/build/origin-ci-test/logs/test_branch_origin_extended_conformance_gce/2510/

and

[sig-storage] Projected should be consumable from pods in volume [Conformance] [Suite:openshift/conformance/parallel] [Suite:k8s] 25s

/tmp/openshift/build-rpms/rpm/BUILD/origin-3.9.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/kubernetes/test/e2e/framework/framework.go:648
Error creating Pod
Expected error:
    <*errors.StatusError | 0xc420d42ab0>: {
        ErrStatus: {
            TypeMeta: {Kind: "", APIVersion: ""},
            ListMeta: {SelfLink: "", ResourceVersion: "", Continue: ""},
            Status: "Failure",
            Message: "No API token found for service account \"default\", retry after the token is automatically created and added to the service account",
            Reason: "ServerTimeout",
            Details: {
                Name: "create pod",
                Group: "",
                Kind: "serviceaccounts",
                UID: "",
                Causes: nil,
                RetryAfterSeconds: 1,
            },
            Code: 500,
        },
    }
    No API token found for service account "default", retry after the token is automatically created and added to the service account
not to have occurred
/tmp/openshift/build-rpms/rpm/BUILD/origin-3.9.0/_output/local/go/src/github.com/openshift/origin/vendor/k8s.io/kubernetes/test/e2e/framework/pods.go:76

https://openshift-gce-devel.appspot.com/build/origin-ci-test/logs/test_branch_origin_extended_conformance_gce/2511/

and https://openshift-gce-devel.appspot.com/build/origin-ci-test/logs/test_branch_origin_extended_conformance_gce/2501/

and https://openshift-gce-devel.appspot.com/build/origin-ci-test/logs/test_branch_origin_extended_conformance_gce/2500/

and https://openshift-gce-devel.appspot.com/build/origin-ci-test/logs/test_branch_origin_extended_conformance_gce/2494/