apiserver – k8s.io/apiserver/pkg/authentication/serviceaccount Index | Files

package serviceaccount

import "k8s.io/apiserver/pkg/authentication/serviceaccount"

Index

Constants 

const (
	ServiceAccountUsernamePrefix    = "system:serviceaccount:"
	ServiceAccountUsernameSeparator = ":"
	ServiceAccountGroupPrefix       = "system:serviceaccounts:"
	AllServiceAccountsGroup         = "system:serviceaccounts"
	// IssuedCredentialIDAuditAnnotationKey is the annotation key used in the audit event that is persisted to the
	// '/token' endpoint for service accounts.
	// This annotation indicates the generated credential identifier for the service account token being issued.
	// This is useful when tracing back the origin of tokens that have gone on to make request that have persisted
	// their credential-identifier into the audit log via the user's extra info stored on subsequent audit events.
	IssuedCredentialIDAuditAnnotationKey = "authentication.kubernetes.io/issued-credential-id"
	// PodNameKey is the key used in a user's "extra" to specify the pod name of
	// the authenticating request.
	PodNameKey = "authentication.kubernetes.io/pod-name"
	// PodUIDKey is the key used in a user's "extra" to specify the pod UID of
	// the authenticating request.
	PodUIDKey = "authentication.kubernetes.io/pod-uid"
	// NodeNameKey is the key used in a user's "extra" to specify the node name of
	// the authenticating request.
	NodeNameKey = "authentication.kubernetes.io/node-name"
	// NodeUIDKey is the key used in a user's "extra" to specify the node UID of
	// the authenticating request.
	NodeUIDKey = "authentication.kubernetes.io/node-uid"
)

Functions

func IsServiceAccountToken 

func IsServiceAccountToken(secret *v1.Secret, sa *v1.ServiceAccount) bool

IsServiceAccountToken returns true if the secret is a valid api token for the service account

func MakeGroupNames 

func MakeGroupNames(namespace string) []string

MakeGroupNames generates service account group names for the given namespace

func MakeNamespaceGroupName 

func MakeNamespaceGroupName(namespace string) string

MakeNamespaceGroupName returns the name of the group all service accounts in the namespace are included in

func MakeUsername 

func MakeUsername(namespace, name string) string

MakeUsername generates a username from the given namespace and ServiceAccount name. The resulting username can be passed to SplitUsername to extract the original namespace and ServiceAccount name.

func MatchesUsername 

func MatchesUsername(namespace, name string, username string) bool

MatchesUsername checks whether the provided username matches the namespace and name without allocating. Use this when checking a service account namespace and name against a known string.

func SplitUsername 

func SplitUsername(username string) (string, string, error)

SplitUsername returns the namespace and ServiceAccount name embedded in the given username, or an error if the username is not a valid name produced by MakeUsername

func UserInfo 

func UserInfo(namespace, name, uid string) user.Info

UserInfo returns a user.Info interface for the given namespace, service account name and UID

Types

type ServiceAccountInfo 

type ServiceAccountInfo struct {
	Name, Namespace, UID string
	PodName, PodUID      string
	CredentialID         string
	NodeName, NodeUID    string
}

func (*ServiceAccountInfo) UserInfo 

func (sa *ServiceAccountInfo) UserInfo() user.Info

Source Files

util.go

Version
v0.33.0 (latest)
Published
Apr 23, 2025
Platform
linux/amd64
Imports
5 packages
Last checked
52 minutes ago –

Tools for package owners.