From 1fe9a6264a2971c27f00ca82eee4f7ea788057ef Mon Sep 17 00:00:00 2001
From: Chris Farhood <chris@farhood.org>
Date: Tue, 5 May 2026 18:47:01 +0000
Subject: [PATCH] fix(e2e): disable automount SA token to avoid kubelet fetch
 race

Kubelet tries to fetch SA token immediately after deployment creates the pod,
but the SA may not be propagated yet. Setting automountServiceAccountToken: false
avoids this race. The SA token is not needed since E2E tests authenticate
via HEADLAMP_TOKEN passed as env var.
---
 scripts/deploy-e2e-headlamp.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/deploy-e2e-headlamp.sh b/scripts/deploy-e2e-headlamp.sh
index 8f7a872..31bb566 100755
--- a/scripts/deploy-e2e-headlamp.sh
+++ b/scripts/deploy-e2e-headlamp.sh
@@ -97,7 +97,7 @@ spec:
         app.kubernetes.io/instance: ${E2E_RELEASE}
     spec:
       serviceAccountName: ${E2E_RELEASE}
-      automountServiceAccountToken: true
+      automountServiceAccountToken: false
       securityContext: {}
       containers:
         - name: headlamp
@@ -159,6 +159,7 @@ spec:
 EOF
 
 echo "Waiting for rollout..."
+sleep 2
 kubectl rollout status "deployment/${E2E_RELEASE}" \
   -n "$E2E_NAMESPACE" --timeout=120s