OCPBUGS-29900:fix the Metric cco_credentials_mode issue

[jianping-shu]

See OCPBUGS-29900 for the details.

Try to use AI tools to facilitate the bug fix.
(1) Tried deepwiki, its answers were positioning related code functions and providing the fix suggestions
https://deepwiki.com/search/for-aws-sts-cluster-metric-cco_6fe2f619-3e29-4d31-8aeb-5c85a8f589db

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@jianping-shu: This pull request references Jira Issue OCPBUGS-29900, which is invalid:

• expected the bug to target the "4.20.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

See OCPBUGS-29900 for the details.

Try to use AI tools to facilitate the bug fix.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: jianping-shu
Once this PR has been reviewed and has the lgtm label, please assign suhanime for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[jianping-shu]

To use utils.IsTimedTokenCluster is a better and more efficient solution than func credRequestIsPodIdentity which is called for every CR in func processCR. And it did fix the issue.
Need check if it is safe to remove func credRequestIsPodIdentity.

[codecov]

Codecov Report

❌ Patch coverage is 66.66667% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.81%. Comparing base (f019679) to head (5f9e984).
⚠️ Report is 25 commits behind head on master.

Files with missing lines	Patch %	Lines
pkg/operator/metrics/metrics.go	66.66%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #901      +/-   ##
==========================================
- Coverage   46.93%   46.81%   -0.12%     
==========================================
  Files          97       97              
  Lines       11943    11931      -12     
==========================================
- Hits         5605     5586      -19     
- Misses       5720     5730      +10     
+ Partials      618      615       -3     

Files with missing lines	Coverage Δ
pkg/operator/metrics/metrics.go	42.94% <66.66%> (-4.15%)	⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[openshift-ci]

@jianping-shu: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/okd-scos-e2e-aws-ovn	5f9e984	link	false	/test okd-scos-e2e-aws-ovn
ci/prow/e2e-aws-qe	5f9e984	link	false	/test e2e-aws-qe

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jianping-shu]

@jstuever @dlom please help review this PR when you got time, TIA

[jstuever]

/cc

[jstuever]

My apologies for taking so long to review this PR. I wanted to make sure I fully understood the manualpodidentity use case. I don't think AI provided the right solution here. It is clear that manualpodidentity is intended to show that at least one secret is actually using short term tokens. However, this solution instead shows that the cluster is configured to use short term tokens without verifying that any of the secrets are actually configured to do so.

Instead, this PR needs to figure out if credRequestIsPodIdenty() is returning false when there are short term tokens being used, and if so, resolve why that is happening. As it is currently written, there is no logic for the GCP platform.