package serviceaccount

import "k8s.io/apiserver/pkg/authentication/serviceaccount"

Index ¶

• Constants
• func GetOrCreateServiceAccount(coreClient v1core.CoreV1Interface, namespace, name string) (*v1.ServiceAccount, error)
• func IsServiceAccountToken(secret *v1.Secret, sa *v1.ServiceAccount) bool
• func MakeGroupNames(namespace string) []string
• func MakeNamespaceGroupName(namespace string) string
• func MakeUsername(namespace, name string) string
• func MatchesUsername(namespace, name string, username string) bool
• func SplitUsername(username string) (string, string, error)
• func UserInfo(namespace, name, uid string) user.Info
• type ServiceAccountInfo
• func (sa *ServiceAccountInfo) UserInfo() user.Info

Constants ¶

const (
	ServiceAccountUsernamePrefix    = "system:serviceaccount:"
	ServiceAccountUsernameSeparator = ":"
	ServiceAccountGroupPrefix       = "system:serviceaccounts:"
	AllServiceAccountsGroup         = "system:serviceaccounts"
	// PodNameKey is the key used in a user's "extra" to specify the pod name of
	// the authenticating request.
	PodNameKey = "authentication.kubernetes.io/pod-name"
	// PodUIDKey is the key used in a user's "extra" to specify the pod UID of
	// the authenticating request.
	PodUIDKey = "authentication.kubernetes.io/pod-uid"
)

Functions ¶

func GetOrCreateServiceAccount ¶

func GetOrCreateServiceAccount(coreClient v1core.CoreV1Interface, namespace, name string) (*v1.ServiceAccount, error)

func IsServiceAccountToken ¶

func IsServiceAccountToken(secret *v1.Secret, sa *v1.ServiceAccount) bool

IsServiceAccountToken returns true if the secret is a valid api token for the service account

func MakeGroupNames ¶

func MakeGroupNames(namespace string) []string

MakeGroupNames generates service account group names for the given namespace

func MakeNamespaceGroupName ¶

func MakeNamespaceGroupName(namespace string) string

MakeNamespaceGroupName returns the name of the group all service accounts in the namespace are included in

func MakeUsername ¶

func MakeUsername(namespace, name string) string

MakeUsername generates a username from the given namespace and ServiceAccount name. The resulting username can be passed to SplitUsername to extract the original namespace and ServiceAccount name.

func MatchesUsername ¶

func MatchesUsername(namespace, name string, username string) bool

MatchesUsername checks whether the provided username matches the namespace and name without allocating. Use this when checking a service account namespace and name against a known string.

func SplitUsername ¶

func SplitUsername(username string) (string, string, error)

SplitUsername returns the namespace and ServiceAccount name embedded in the given username, or an error if the username is not a valid name produced by MakeUsername

func UserInfo ¶

func UserInfo(namespace, name, uid string) user.Info

UserInfo returns a user.Info interface for the given namespace, service account name and UID

Types ¶

type ServiceAccountInfo ¶

type ServiceAccountInfo struct {
	Name, Namespace, UID string
	PodName, PodUID      string
}

func (*ServiceAccountInfo) UserInfo ¶

func (sa *ServiceAccountInfo) UserInfo() user.Info

Source Files ¶

util.go