unable to mount additional volumes by mutating StatefulSet since rc11 without error

[Jon Seager]

I've been experimenting with the new `juju trust` functionality with my kubernetes dashboard charm (https://github.com/jnsgruk/charm-kubernetes-dashboard).

I previously had this working by creating a bunch of Kubernetes resources using the K8s API, including a ServiceAccount -- this is done in a method called during the `install` hook.

When the PebbleReadyEvent fires, I was then using the Kubernetes API to mutate the StatefulSet to ensure that the ServiceAccount token was mounted into the dashboard container. Since rc11, that results in repeated errors like so:

```
controller-0: 15:44:30 ERROR juju.worker.caasapplicationprovisioner.runner exited "jnsgruk-kubernetes-dashboard": finding filesystem info for kubernetes-dashboard-token-sq69p: volume {kubernetes-dashboard-token-sq69p {nil nil nil nil nil &SecretVolumeSource{SecretName:kubernetes-dashboard-token-sq69p,Items:[]KeyToPath{},DefaultMode:*420,Optional:nil,} nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil nil}} not supported
```

The line where I'm adding the various parts to the StatefulSet is: https://github.com/jnsgruk/charm-kubernetes-dashboard/blob/1f0d31bde941acd4e5fe0b88a6e63bd10386ba07/src/charm.py#L148

Possibly related (or at least similar) to: https://github.com/juju/juju/pull/12889

[Ian Booth (wallyworld)]

Looks like this check

if vol.Secret != nil && strings.HasPrefix(vol.Secret.SecretName, a.name+"-token") {
 logger.Tracef("ignoring volume source for service account secret: %v", vol.Name)
 continue
}

in caas/kubernetes/provider/appication/application.go

needs to be tweaked

[Jon Seager (jnsgruk)]

As per Mattermost conversation; there is some weirdness here which I suspect won't be unique to this particular Kubernetes app:

In this case, the charm is called `jnsgruk-kubernetes-dashboard`, but I'm creating resources (and mounts) named `kubernetes-dashboard`. This is unfortunate, but necessary because the Kubernetes Dashboard has the names of the ServiceAccounts/Roles/ConfigMaps it relies upon hardcoded

[Ian Booth (wallyworld)]

I think a quick fix just needs to be to remove appName from the check

if vol.Secret != nil && strings.Contains(vol.Secret.SecretName, "-token") {
 logger.Tracef("ignoring volume source for service account secret: %v", vol.Name)
 continue
}

[Heather Lanigan (hmlanigan)]

https://github.com/juju/juju/pull/12925