flake: TestServiceAccounts/Bound_service_token/Access_another_workspace_in_the_same_org

[ntnn]

Describe the bug

Test keeps flaking.

See:

• bug: global service account flakes #3289 (comment)
• https://kubernetes.slack.com/archives/C021U8WSAFK/p1746526608378019?thread_ts=1746515155.386659&cid=C021U8WSAFK
• https://public-prow.kcp.k8c.io/view/s3/prow-public-data/pr-logs/pull/kcp-dev_kcp/3393/pull-kcp-test-e2e-sharded/1919691698787586048

Steps To Reproduce

Expected Behaviour

Additional Context

No response

[ntnn]

/kind flake

[xrstf]

Okay so I debugged this a bit on the current main branch. The flake is still there and can easily be shown (it fails ~50% of the time) by first re-enabling the test (there is a t.Skip() in it) and then it's enough to just run this one specific subsubsubtest:

TEST_ARGS="-run TestServiceAccounts/Bound_service_token/Access_another_workspace_in_the_same_org" WHAT="./test/e2e/authorizer" make test-e2e-sharded-minimal

After some digging my thoughts are:

• It's shard-related since running the nonsharded e2e tests work reliably.
• The test creates 3 workspaces: one for the org, one to hold the ServiceAccount and the one to access.
• If the 2nd workspace (i.e. where the ServiceAccount is) is scheduled on another shard than the final workspace, the authenticator cannot work anymore.
• This is because the BuildGenericConfig from the genericcontrolplane uses the loopback config to feed into the ServiceAccountGetter. It's therefore impossible for the shard to know about foreign clusters.

I am not sure if this is intended. It feels that for these cases, authentication should happen in the front-proxy, but no authentication happens in the front-proxy.

[xrstf]

I've seen the concept of a custom serviceaccountgetter, and the front-proxy does indeed make use of that. But shards currently don't.

[xrstf]

Solving this is also tracked in #3510.

[xrstf]

We settled on changing the test to ensure all relevant resources are scheduled onto the same shard, and once #3510 is implemented we can add a new testcase with cross shard objects.