fieldRef:
                fieldPath: metadata.labels
            - path: "annotations"
              fieldRef:
                fieldPath: metadata.annotations
      - name: istio-token
        projected:
          sources:
          - serviceAccountToken:
              path: istio-token
              expirationSeconds: 43200
              audience: {{ .Values.global.sds.token.aud }}

			Annotations: map[string]string{
				kubelet.ConfigMirrorAnnotationKey: "true",
			},
		},
		Spec: api.PodSpec{
			Volumes: []api.Volume{
				{VolumeSource: api.VolumeSource{
					Projected: &api.ProjectedVolumeSource{
						Sources: []api.VolumeProjection{{ServiceAccountToken: &api.ServiceAccountTokenProjection{}}},
					},
				},
				},
			},
		},
	}

import (
	"fmt"
	"os"
	"testing"
	"time"

	"github.com/google/uuid"

	"istio.io/istio/pkg/test/util/retry"
)

var (
	// thirdPartyJwt is generated in a testing K8s cluster, using the "istio-token" projected volume.
	// Token is issued at 2020-04-04 22:13:54 Pacific Daylight time.
	// Expiration time is 2020-04-05 10:13:54 Pacific Daylight time.
	thirdPartyJwt = "eyJhbGciOiJSUzI1NiIsImtpZCI6IiJ9." +

    tolerationSeconds: 300
  volumes:
  - configMap:
      defaultMode: 420
      name: kube-dns
      optional: true
    name: kube-dns-config
  - name: kube-api-access-s8rz5
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt

    tolerationSeconds: 300
  volumes:
  - configMap:
      defaultMode: 420
      name: kube-dns
      optional: true
    name: kube-dns-config
  - name: kube-api-access-s8rz5
    projected:
      defaultMode: 420
      sources:
      - serviceAccountToken:
          expirationSeconds: 3607
          path: token
      - configMap:
          items:
          - key: ca.crt

		req.Spec.ExpirationSeconds = r.maxExpirationSeconds
	}

	// Tweak expiration for safe transition of projected service account token.
	// Warn (instead of fail) after requested expiration time.
	// Fail after hard-coded extended expiration time.
	// Only perform the extension when token is pod-bound.
	var warnAfter int64

        - path: "labels"
          fieldRef:
            fieldPath: metadata.labels
        - path: "annotations"
          fieldRef:
            fieldPath: metadata.annotations
  - name: istio-token
    projected:
      sources:
      - serviceAccountToken:
          path: istio-token
          expirationSeconds: 43200
          audience: {{ .Values.global.sds.token.aud }}

# Deploy if 'mode == gateway' - 4 replicas. gateway: type: "nas" # currently only "nas,gcs" are supported. replicas: 4 gcs: serviceAccountFile: "" # credential JSON file of service account key (not required if using existing secret) projectId: "" # Google cloud project id required ## TLS Settings for MinIO tls: enabled: false ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret certSecret:...

# Deploy if 'mode == gateway' - 4 replicas. gateway: type: "nas" # currently only "nas,gcs" are supported. replicas: 4 gcs: serviceAccountFile: "" # credential JSON file of service account key (not required if using existing secret) projectId: "" # Google cloud project id required ## TLS Settings for MinIO tls: enabled: false ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret certSecret:...

# Deploy if 'mode == gateway' - 4 replicas. gateway: type: "nas" # currently only "nas,gcs" are supported. replicas: 4 gcs: serviceAccountFile: "" # credential JSON file of service account key (not required if using existing secret) projectId: "" # Google cloud project id required ## TLS Settings for MinIO tls: enabled: false ## Create a secret with private.key and public.crt files and pass that here. Ref: https://github.com/minio/minio/tree/master/docs/tls/kubernetes#2-create-kubernetes-secret certSecret:...