chore: Fix to intermittent E2E test failures in deployment_test.go (#…

…20974)

Signed-off-by: Jonathan West <[email protected]>

test/e2e/deployment_test.go

@@ -13,6 +13,7 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	rbacv1 "k8s.io/api/rbac/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/tools/clientcmd"
 
 	"github.com/argoproj/argo-cd/v2/common"
@@ -310,10 +311,19 @@ func createNamespaceScopedUser(t *testing.T, username string, clusterScopedSecre
 	_, err = KubeClientset.RbacV1().RoleBindings(roleBinding.Namespace).Create(context.Background(), &roleBinding, metav1.CreateOptions{})
 	require.NoError(t, err)
 
-	// Retrieve the bearer token from the ServiceAccount
-	token, err := clusterauth.GetServiceAccountBearerToken(KubeClientset, ns.Name, serviceAccountName, time.Second*60)
-	require.NoError(t, err)
-	assert.NotEmpty(t, token)
+	var token string
+
+	// Attempting to patch the ServiceAccount can intermittently fail with 'failed to patch serviceaccount "(...)" with bearer token secret: Operation cannot be fulfilled on serviceaccounts "(...)": the object has been modified; please apply your changes to the latest version and try again'
+	// We thus keep trying for up to 20 seconds.
+	waitErr := wait.PollUntilContextTimeout(context.Background(), 1*time.Second, 20*time.Second, true, func(context.Context) (done bool, err error) {
+		// Retrieve the bearer token from the ServiceAccount
+		token, err = clusterauth.GetServiceAccountBearerToken(KubeClientset, ns.Name, serviceAccountName, time.Second*60)
+
+		// Success is no error and a real token, otherwise keep trying
+		return (err == nil && token != ""), nil
+	})
+	require.NoError(t, waitErr)
+	require.NotEmpty(t, token)
 
 	// In order to test a cluster-scoped Argo CD Cluster Secret, we may optionally grant the ServiceAccount read-all permissions at cluster scope.
 	if clusterScopedSecrets {