serviceaccounts

Documentation

Index

• Variables
• func GoogleEmail(sa *corev1.ServiceAccount) (string, error)
• type Provider
• type Reference
  • func ReferenceFromNode(node *corev1.Node, defaultRef *Reference) *Reference
  • func ReferenceFromObject(sa *corev1.ServiceAccount) *Reference
  • func ReferenceFromPod(pod *corev1.Pod) *Reference
  • func ReferenceFromToken(token string) *Reference

Variables

var (
	ErrGKEAnnotationMissing = fmt.Errorf("gke annotation %q missing", gkeAnnotation)
	ErrGKEAnnotationInvalid = fmt.Errorf("gke annotation %q has invalid google service account email", gkeAnnotation)
)

Functions

func GoogleEmail

func GoogleEmail(sa *corev1.ServiceAccount) (string, error)

GoogleEmail returns the Google service account email from the same annotation used in native GKE Workload Identity. The annotation is:

iam.gke.io/gcp-service-account

Types

type Provider

type Provider interface {
	Get(ctx context.Context, ref *Reference) (*corev1.ServiceAccount, error)
}

type Reference

type Reference struct {
	Name      string `json:"name"`
	Namespace string `json:"namespace"`
}

func ReferenceFromNode

func ReferenceFromNode(node *corev1.Node, defaultRef *Reference) *Reference

ReferenceFromNode returns a ServiceAccount reference from the Node object annotations or labels. Annotations take precedence over labels because we encourage users to use annotations instead of labels in this case since. Labels are more impactful to etcd since they are indexed, and we don't need indexing here so we prefer annotations.

The ServiceAccount reference is retrieved from the following pair of annotations or labels:

gke-metadata-server.matheuscscp.io/serviceAccountName

gke-metadata-server.matheuscscp.io/serviceAccountNamespace

If the annotations or labels are not found, defaultRef is returned.

func ReferenceFromObject

func ReferenceFromObject(sa *corev1.ServiceAccount) *Reference

ReferenceFromObject returns a ServiceAccount reference from a ServiceAccount object.

func ReferenceFromPod

func ReferenceFromPod(pod *corev1.Pod) *Reference

ReferenceFromPod returns a ServiceAccount reference from a Pod object.

func ReferenceFromToken

func ReferenceFromToken(token string) *Reference

ReferenceFromToken returns a ServiceAccount reference from a ServiceAccount Token.