@Test
public void shouldNotRunIfServiceAccountSecretEnsureFails() throws IOException {

  final InvalidExecutionException error = new InvalidExecutionException("SA not found");
  when(serviceAccountSecretManager.ensureServiceAccountKeySecret(
      WORKFLOW_INSTANCE.workflowId().toString(), SERVICE_ACCOUNT)).thenThrow(error);
  exception.expect(is(error));
  kdr.start(RUN_STATE, RUN_SPEC_WITH_SA);
}