auth

Documentation

Overview

* Package responsible for returning an AWS SDK session with credentials * given an AWS region, K8s namespace, and K8s service account. * * This package requries that the K8s service account be associated with an IAM * role via IAM Roles for Service Accounts (IRSA).

Index

• Constants
• type Auth
  • func NewAuth(ctx context.Context, region, nameSpace, svcAcc string, ...) (auth *Auth, e error)
  • func (p Auth) GetAWSSession() (awsSession *session.Session, e error)

Constants

const (
	ProviderName = "secrets-store-csi-driver-provider-aws"
)

Types

type Auth

type Auth struct {
	// contains filtered or unexported fields
}

Auth is the main entry point to retrive an AWS session. The caller initializes a new Auth object with NewAuth passing the region, namespace, and K8s service account (and request context). The caller can then obtain AWS sessions by calling GetAWSSession.

func NewAuth

func NewAuth(
	ctx context.Context,
	region, nameSpace, svcAcc string,
	k8sClient k8sv1.CoreV1Interface,
) (auth *Auth, e error)

Factory method to create a new Auth object for an incomming mount request.

func (Auth) GetAWSSession

func (p Auth) GetAWSSession() (awsSession *session.Session, e error)

Get the AWS session credentials associated with a given pod's service account.

The returned session is capable of automatically refreshing creds as needed by using a private TokenFetcher helper.