Test commit to get more insights on the failing aws e2e test

Author: mytreya-rh

Makefile

@@ -431,7 +431,8 @@ e2e-helm-deploy:
 		--set tokenRequests[0].audience="aud1" \
 		--set tokenRequests[1].audience="aud2" \
 		--set tokenRequests[2].audience="conjur" \
-		--set tokenRequests[3].audience="api://AzureADTokenExchange"
+		--set tokenRequests[3].audience="api://AzureADTokenExchange" \
+		--set tokenRequests[4].audience="sts.amazonaws.com"
 
 .PHONY: e2e-helm-upgrade
 e2e-helm-upgrade:

test/bats/aws.bats

@@ -70,7 +70,22 @@ teardown_file() {
 
 @test "CSI inline volume test with pod portability" {
    kubectl --namespace $NAMESPACE apply -f $BATS_TEST_DIR/BasicTestMount.yaml
-   kubectl --namespace $NAMESPACE  wait --for=condition=Ready --timeout=60s pod/basic-test-mount
+
+   if ! kubectl --namespace $NAMESPACE wait --for=condition=Ready --timeout=${WAIT_TIME}s pod/basic-test-mount; then
+     echo "=== Pod failed to become Ready. Dumping diagnostics ===" >&3
+     echo "--- Pod describe ---" >&3
+     kubectl --namespace $NAMESPACE describe pod/$POD_NAME >&3 2>&1
+     echo "--- Pod env (IRSA check) ---" >&3
+     kubectl --namespace $NAMESPACE get pod/$POD_NAME -o jsonpath='{range .spec.containers[*].env[*]}{.name}={.value}{"\n"}{end}' >&3 2>&1
+     echo "--- ServiceAccount annotation ---" >&3
+     kubectl --namespace $NAMESPACE get sa basic-test-mount-sa -o jsonpath='{.metadata.annotations}' >&3 2>&1
+     echo "" >&3
+     echo "--- CSI driver logs (last 50 lines) ---" >&3
+     kubectl -n kube-system logs -l app=secrets-store-csi-driver --tail 50 -c secrets-store >&3 2>&1
+     echo "--- AWS provider logs (last 50 lines) ---" >&3
+     kubectl -n kube-system logs -l app=csi-secrets-store-provider-aws --tail 50 >&3 2>&1
+     return 1
+   fi
 
    run kubectl --namespace $NAMESPACE  get pod/$POD_NAME
    assert_success

test/scripts/initialize_eks_cluster.bash

@@ -67,6 +67,27 @@ eksctl create iamserviceaccount \
      --approve \
      --region $AWS_REGION
 
+
+echo "Wait 60s after IAM service account creation..."
+sleep 60
+
+# Validate IRSA configuration
+echo "=== IRSA debug: ServiceAccount annotation ==="
+SA_ROLE_ARN=$(kubectl -n $NAMESPACE get sa $AWS_SERVICE_ACCOUNT_NAME -o jsonpath='{.metadata.annotations.eks\.amazonaws\.com/role-arn}' 2>&1)
+echo "ServiceAccount role-arn: $SA_ROLE_ARN"
+if [ -z "$SA_ROLE_ARN" ]; then
+    echo "ERROR: ServiceAccount $AWS_SERVICE_ACCOUNT_NAME is missing eks.amazonaws.com/role-arn annotation"
+    kubectl -n $NAMESPACE get sa $AWS_SERVICE_ACCOUNT_NAME -o yaml
+fi
+
+echo "=== IRSA debug: IAM role trust policy ==="
+ROLE_NAME=$(echo "$SA_ROLE_ARN" | awk -F'/' '{print $NF}')
+aws iam get-role --role-name "$ROLE_NAME" --query 'Role.AssumeRolePolicyDocument' --output json --region $AWS_REGION 2>&1 || echo "WARNING: Could not fetch IAM role trust policy"
+
+echo "=== IRSA Diagnostic: OIDC provider ==="
+OIDC_URL=$(aws eks describe-cluster --name $EKS_CLUSTER_NAME --region $AWS_REGION --query 'cluster.identity.oidc.issuer' --output text 2>&1)
+echo "Cluster OIDC issuer: $OIDC_URL"
+
 # on a release test the caller will perform the driver installation
 if [ -z "$RELEASE" ]; then
     REGISTRY=$ECR_REGISTRY_URL make e2e-helm-deploy