Adds support for waiting for default service account in ns resource

kubernetes/resource_kubernetes_namespace.go

@@ -31,6 +31,12 @@ func resourceKubernetesNamespace() *schema.Resource {
 
 		Schema: map[string]*schema.Schema{
 			"metadata": metadataSchema("namespace", true),
+			"wait_for_default_service_account": {
+				Type:        schema.TypeBool,
+				Optional:    true,
+				Default:     false,
+				Description: "Terraform will wait for the default service account to be created.",
+			},
 		},
 		Timeouts: &schema.ResourceTimeout{
 			Delete: schema.DefaultTimeout(5 * time.Minute),
@@ -56,6 +62,31 @@ func resourceKubernetesNamespaceCreate(ctx context.Context, d *schema.ResourceDa
 	log.Printf("[INFO] Submitted new namespace: %#v", out)
 	d.SetId(out.Name)
 
+	if d.Get("wait_for_default_service_account").(bool) {
+		log.Printf("[DEBUG] Waiting for default service account to be created")
+		// FIXME: Since the creation of the Default ServiceAccount is asynchronous to the Namespace
+		// We need to wait some period of time, using something like d.Timeout(schema.TimeoutCreate)
+		// is not long enough for a Kind cluster to pass without timing out (about 10 seconds).
+		// Using an undefined word here forces the timeout to use the defaultTimeout of 20mins.
+		// I do not consider this production ready.
+		err = resource.RetryContext(ctx, d.Timeout("FIXME"), func() *resource.RetryError {
+			_, err := conn.CoreV1().ServiceAccounts(out.Name).Get(ctx, "default", metav1.GetOptions{})
+			if err != nil {
+				if errors.IsNotFound(err) {
+					log.Printf("[INFO] Default service account does not exist, will retry: %s", metadata.Namespace)
+					return resource.RetryableError(err)
+				}
+
+				return resource.NonRetryableError(err)
+			}
+
+			log.Printf("[INFO] Default service account exists: %s", metadata.Namespace)
+			return nil
+		})
+		if err != nil {
+			return diag.FromErr(err)
+		}
+	}
 	return resourceKubernetesNamespaceRead(ctx, d, meta)
 }
 

kubernetes/resource_kubernetes_namespace_test.go

@@ -44,7 +44,7 @@ func TestAccKubernetesNamespace_basic(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "wait_for_default_service_account"},
 			},
 			{
 				Config: testAccKubernetesNamespaceConfig_addAnnotations(nsName),
@@ -109,6 +109,35 @@ func TestAccKubernetesNamespace_basic(t *testing.T) {
 	})
 }
 
+func TestAccKubernetesNamespace_default_service_account(t *testing.T) {
+	var nsConf api.Namespace
+	var saConf api.ServiceAccount
+	nsName := fmt.Sprintf("tf-acc-test-%s", acctest.RandStringFromCharSet(10, acctest.CharSetAlphaNum))
+	resourceName := "kubernetes_namespace.test"
+
+	resource.Test(t, resource.TestCase{
+		PreCheck:          func() { testAccPreCheck(t) },
+		IDRefreshName:     resourceName,
+		ProviderFactories: testAccProviderFactories,
+		CheckDestroy:      testAccCheckKubernetesNamespaceDestroy,
+		Steps: []resource.TestStep{
+			{
+				Config: testAccKubernetesNamespaceConfig_wait_for_default_service_acccount(nsName),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					testAccCheckKubernetesNamespaceExists("kubernetes_namespace.test", &nsConf),
+					testAccCheckKubernetesDefaultServiceAccountExists(resourceName, &saConf),
+				),
+			},
+			{
+				ResourceName:            resourceName,
+				ImportState:             true,
+				ImportStateVerify:       true,
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "wait_for_default_service_account"},
+			},
+		},
+	})
+}
+
 func TestAccKubernetesNamespace_generatedName(t *testing.T) {
 	var conf api.Namespace
 	prefix := "tf-acc-test-gen-"
@@ -138,7 +167,7 @@ func TestAccKubernetesNamespace_generatedName(t *testing.T) {
 				ResourceName:            resourceName,
 				ImportState:             true,
 				ImportStateVerify:       true,
-				ImportStateVerifyIgnore: []string{"metadata.0.resource_version"},
+				ImportStateVerifyIgnore: []string{"metadata.0.resource_version", "wait_for_default_service_account"},
 			},
 		},
 	})
@@ -363,3 +392,42 @@ func testAccKubernetesNamespaceConfig_deleteTimeout(nsName string) string {
 }
 `, nsName)
 }
+
+func testAccKubernetesNamespaceConfig_wait_for_default_service_acccount(nsName string) string {
+	return fmt.Sprintf(`resource "kubernetes_namespace" "test" {
+  metadata {
+    name = "%s"
+  }
+  wait_for_default_service_account = "true"
+}
+`, nsName)
+}
+
+func testAccCheckKubernetesDefaultServiceAccountExists(n string,
+	obj *api.ServiceAccount) resource.TestCheckFunc {
+	return func(s *terraform.State) error {
+		rs, ok := s.RootModule().Resources[n]
+		if !ok {
+			return fmt.Errorf("Not found: %s", n)
+		}
+
+		conn, err := testAccProvider.Meta().(KubeClientsets).MainClientset()
+		if err != nil {
+			return err
+		}
+		ctx := context.TODO()
+
+		namespace, _, err := idParts(rs.Primary.ID + "/")
+		if err != nil {
+			return err
+		}
+
+		out, err := conn.CoreV1().ServiceAccounts(namespace).Get(ctx, "default", metav1.GetOptions{})
+		if err != nil {
+			return err
+		}
+
+		*obj = *out
+		return nil
+	}
+}