From e4f888ae60b6afb520b898b6558289cc55d148db Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Tue, 5 May 2026 18:46:54 +0000
Subject: [PATCH] fix(e2e): disable automount SA token to avoid kubelet fetch
 race

Kubelet tries to fetch SA token immediately after deployment creates the pod,
but the SA may not be propagated yet. Setting automountServiceAccountToken: false
avoids this race. The SA token is not needed since E2E tests authenticate
via HEADLAMP_TOKEN passed as env var.
---
 scripts/deploy-e2e-headlamp.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy-e2e-headlamp.sh b/scripts/deploy-e2e-headlamp.sh
index 8b76beb..8dad3d6 100755
--- a/scripts/deploy-e2e-headlamp.sh
+++ b/scripts/deploy-e2e-headlamp.sh
@@ -88,7 +88,7 @@ spec:
         app.kubernetes.io/instance: ${E2E_RELEASE}
     spec:
       serviceAccountName: ${E2E_RELEASE}
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       securityContext: {}
       containers:
         - name: headlamp
@@ -150,6 +150,7 @@ spec:
 EOF
 
 echo "Waiting for rollout..."
+sleep 2
 kubectl rollout status "deployment/${E2E_RELEASE}" \
   -n "$E2E_NAMESPACE" --timeout=120s