identity

Documentation

Overview

Package identity contains the identity reconciler

Index

• Constants
• func NewGCPAuthStore(ctx context.Context, cmw configmap.Watcher) *gcpauth.Store
• type Identity
  • func NewIdentity(ctx context.Context, policyManager iam.IAMPolicyManager, ...) *Identity
  • func (i *Identity) DeleteWorkloadIdentity(ctx context.Context, projectID string, identifiable duck.Identifiable) error
  • func (i *Identity) ReconcileWorkloadIdentity(ctx context.Context, projectID string, identifiable duck.Identifiable) (*corev1.ServiceAccount, error)

Constants

const (
	Role = "roles/iam.workloadIdentityUser"
)

Functions

func NewGCPAuthStore

func NewGCPAuthStore(ctx context.Context, cmw configmap.Watcher) *gcpauth.Store

Types

type Identity

type Identity struct {
	// contains filtered or unexported fields
}

func NewIdentity

func NewIdentity(ctx context.Context, policyManager iam.IAMPolicyManager, gcpAuthStore *gcpauth.Store) *Identity

func (*Identity) DeleteWorkloadIdentity

func (i *Identity) DeleteWorkloadIdentity(ctx context.Context, projectID string, identifiable duck.Identifiable) error

DeleteWorkloadIdentity will remove iam policy binding between k8s service account and its corresponding GCP service account, if this k8s service account only has one ownerReference.

func (*Identity) ReconcileWorkloadIdentity

func (i *Identity) ReconcileWorkloadIdentity(ctx context.Context, projectID string, identifiable duck.Identifiable) (*corev1.ServiceAccount, error)

ReconcileWorkloadIdentity will create a k8s service account, add ownerReference to it, and add iam policy binding between this k8s service account and its corresponding GCP service account.