fix: added docs for operator managed service account tokens & made audience optional

k8-operator/.gitignore

@@ -24,3 +24,6 @@ Dockerfile.cross
 *.swp
 *.swo
 *~
+
+# Testing directories
+auto-token

k8-operator/api/v1alpha1/common.go

@@ -51,7 +51,7 @@ type GenericKubernetesAuth struct {
 	ServiceAccountRef KubernetesServiceAccountRef `json:"serviceAccountRef"`
 
 	// Optionally automatically create a service account token for the configured service account.
-	// If this is set to `true`, the operator will automatically create a service account token for the configured service account.
+	// If this is set to `true`, the operator will automatically create a service account token for the configured service account. This field is recommended in most cases.
 	// +kubebuilder:validation:Optional
 	AutoCreateServiceAccountToken bool `json:"autoCreateServiceAccountToken"`
 	// The audiences to use for the service account token. This is only relevant if `autoCreateServiceAccountToken` is true.

k8-operator/packages/util/auth.go

@@ -19,10 +19,6 @@ import (
 func GetServiceAccountToken(k8sClient client.Client, namespace string, serviceAccountName string, autoCreateServiceAccountToken bool, serviceAccountTokenAudiences []string) (string, error) {
 
 	if autoCreateServiceAccountToken {
-		if len(serviceAccountTokenAudiences) == 0 {
-			return "", fmt.Errorf("serviceAccountTokenAudiences is required when autoCreateServiceAccountToken is true")
-		}
-
 		restClient, err := GetRestClientFromClient()
 		if err != nil {
 			return "", fmt.Errorf("failed to get REST client: %w", err)
@@ -30,11 +26,16 @@ func GetServiceAccountToken(k8sClient client.Client, namespace string, serviceAc
 
 		tokenRequest := &authenticationv1.TokenRequest{
 			Spec: authenticationv1.TokenRequestSpec{
-				Audiences:         serviceAccountTokenAudiences,
 				ExpirationSeconds: ptr.Int64(600), // 10 minutes. the token only needs to be valid for when we do the initial k8s login.
 			},
 		}
 
+		if len(serviceAccountTokenAudiences) > 0 {
+			// Conditionally add the audiences if they are specified.
+			// Failing to do this causes a default audience to be used, which is not what we want if the user doesn't specify any.
+			tokenRequest.Spec.Audiences = serviceAccountTokenAudiences
+		}
+
 		result := &authenticationv1.TokenRequest{}
 		err = restClient.
 			Post().