pulsar function's statefulset pod have sa token with expiration 0

[zzzz465]

Hi, I'm trying to deploy pulsar cluster on k8s (EKS), with OIDC authentication enabled.
while I was able to provision the pulsar cluster, I cannot make pulsar function works.

the problem is, when I create a pulsar function using pulsar-admin CLI, it creates a statefulset that have service account token volume projection with expirationSeconds: 0, causing pod launch failure.

the error message

Pod "pf-test-test-namespace-example-0" is invalid: [spec.volumes[0].projected.sources[0].serviceAccountToken.expirationSeconds: Invalid value: 0: may not specify a duration less than 10 minutes

the created statefulset yaml looks like this.

# ... other stuffs above
  template:
    metadata:
      creationTimestamp: null
      labels:
        component: function
        name: example
        namespace: test-namespace
        tenant: test
      annotations:
        prometheus.io/port: "9094"
        prometheus.io/scrape: "true"
    spec:
      volumes:
        - name: service-account-token
          projected:
            sources:
              - serviceAccountToken:
                  expirationSeconds: 0 # <- this must have minimum 10 minutes
                  path: token
            defaultMode: 420

also, I setup broker's config like this.

PF_functionAuthProviderClassName: "org.apache.pulsar.functions.auth.KubernetesServiceAccountTokenAuthProvider"
PF_kubernetesContainerFactory_kubernetesFunctionAuthProviderConfig_serviceAccountTokenExpirationSeconds: "600"
PF_kubernetesContainerFactory_kubernetesFunctionAuthProviderConfig_serviceAccountTokenAudience: "https://kubernetes.default.svc"

as the document says, the serviceAccountTokenExpirationSeconds should configure the target value.

this is broker's yaml printed and we can check that the serviceAccountTokenExpirationSeconds are set properly.

kubernetesContainerFactory:
  changeConfigMapNamespace: test-pulsar
  expectedMetricsCollectionInterval: '30'
  installUserCodeDependencies: 'true'
  jobNamespace: test-pulsar
  kubernetesFunctionAuthProviderConfig:
    serviceAccountTokenExpirationSeconds: "600" # <- this should work
    serviceAccountTokenAudience: https://kubernetes.default.svc

also, I tried omitting that value and it still not works. according to the source code, it should have default value to 3600 second

am I missing something?

[zzzz465]

after digging source codes, I've found these codes.

pulsar/pulsar-functions/runtime/src/main/java/org/apache/pulsar/functions/worker/WorkerConfig.java

Lines 884 to 887 in 17ea4b8

	/**
	* @Deprecated in favor for using functionRuntimeFactoryClassName and functionRuntimeFactoryConfigs
	* for specifying the function runtime and configs to use
	*/

and it works.

[zzzz465]

so, you have to change value

from

PF_kubernetesContainerFactory_kubernetesFunctionAuthProviderConfig_serviceAccountTokenExpirationSeconds: "600"
PF_kubernetesContainerFactory_kubernetesFunctionAuthProviderConfig_serviceAccountTokenAudience: "https://kubernetes.default.svc"

to

PF_functionRuntimeFactoryConfigs_kubernetesFunctionAuthProviderConfig_serviceAccountTokenExpirationSeconds: "600"
PF_functionRuntimeFactoryConfigs_kubernetesFunctionAuthProviderConfig_serviceAccountTokenAudience: "https://kubernetes.default.svc"