serviceaccount

Documentation

Overview

Package serviceaccount provides implementations to manage service accounts and service account tokens

Index

• Variables
• func NewGetterFromClient(c clientset.Interface, secretLister v1listers.SecretLister, ...) serviceaccount.ServiceAccountTokenGetter
• type ServiceAccountsController
  • func NewServiceAccountsController(saInformer coreinformers.ServiceAccountInformer, ...) (*ServiceAccountsController, error)
  • func (c *ServiceAccountsController) Run(ctx context.Context, workers int)
• type ServiceAccountsControllerOptions
  • func DefaultServiceAccountsControllerOptions() ServiceAccountsControllerOptions
• type TokensController
  • func NewTokensController(serviceAccounts informers.ServiceAccountInformer, ...) (*TokensController, error)
  • func (e *TokensController) Run(workers int, stopCh <-chan struct{})
• type TokensControllerOptions

Variables

var RemoveTokenBackoff = wait.Backoff{
	Steps:    10,
	Duration: 100 * time.Millisecond,
	Jitter:   1.0,
}

RemoveTokenBackoff is the recommended (empirical) retry interval for removing a secret reference from a service account when the secret is deleted. It is exported for use by custom secret controllers.

Functions

func NewGetterFromClient

func NewGetterFromClient(c clientset.Interface, secretLister v1listers.SecretLister, serviceAccountLister v1listers.ServiceAccountLister, podLister v1listers.PodLister) serviceaccount.ServiceAccountTokenGetter

NewGetterFromClient returns a ServiceAccountTokenGetter that uses the specified client to retrieve service accounts and secrets. The client should NOT authenticate using a service account token the returned getter will be used to retrieve, or recursion will result.

Types

type ServiceAccountsController

type ServiceAccountsController struct {
	// contains filtered or unexported fields
}

ServiceAccountsController manages ServiceAccount objects inside Namespaces

func NewServiceAccountsController

func NewServiceAccountsController(saInformer coreinformers.ServiceAccountInformer, nsInformer coreinformers.NamespaceInformer, cl clientset.Interface, options ServiceAccountsControllerOptions) (*ServiceAccountsController, error)

NewServiceAccountsController returns a new *ServiceAccountsController.

func (*ServiceAccountsController) Run

func (c *ServiceAccountsController) Run(ctx context.Context, workers int)

Run runs the ServiceAccountsController blocks until receiving signal from stopCh.

type ServiceAccountsControllerOptions

type ServiceAccountsControllerOptions struct {
	// ServiceAccounts is the list of service accounts to ensure exist in every namespace
	ServiceAccounts []v1.ServiceAccount

	// ServiceAccountResync is the interval between full resyncs of ServiceAccounts.
	// If non-zero, all service accounts will be re-listed this often.
	// Otherwise, re-list will be delayed as long as possible (until the watch is closed or times out).
	ServiceAccountResync time.Duration

	// NamespaceResync is the interval between full resyncs of Namespaces.
	// If non-zero, all namespaces will be re-listed this often.
	// Otherwise, re-list will be delayed as long as possible (until the watch is closed or times out).
	NamespaceResync time.Duration
}

ServiceAccountsControllerOptions contains options for running a ServiceAccountsController

func DefaultServiceAccountsControllerOptions

func DefaultServiceAccountsControllerOptions() ServiceAccountsControllerOptions

DefaultServiceAccountsControllerOptions returns the default options for creating a ServiceAccountsController.

type TokensController

type TokensController struct {
	// contains filtered or unexported fields
}

TokensController manages ServiceAccountToken secrets for ServiceAccount objects

func NewTokensController

func NewTokensController(serviceAccounts informers.ServiceAccountInformer, secrets informers.SecretInformer, cl clientset.Interface, options TokensControllerOptions) (*TokensController, error)

NewTokensController returns a new *TokensController.

func (*TokensController) Run

func (e *TokensController) Run(workers int, stopCh <-chan struct{})

Run runs controller blocks until stopCh is closed

type TokensControllerOptions

type TokensControllerOptions struct {
	// TokenGenerator is the generator to use to create new tokens
	TokenGenerator serviceaccount.TokenGenerator
	// ServiceAccountResync is the time.Duration at which to fully re-list service accounts.
	// If zero, re-list will be delayed as long as possible
	ServiceAccountResync time.Duration
	// SecretResync is the time.Duration at which to fully re-list secrets.
	// If zero, re-list will be delayed as long as possible
	SecretResync time.Duration
	// This CA will be added in the secrets of service accounts
	RootCA []byte

	// MaxRetries controls the maximum number of times a particular key is retried before giving up
	// If zero, a default max is used
	MaxRetries int

	// AutoGenerate decides the auto-generation of secret-based token for service accounts.
	AutoGenerate bool
}

TokensControllerOptions contains options for the TokensController