serviceaccounts

Documentation

Index

• func GoogleEmail(sa *corev1.ServiceAccount) (string, error)
• func IsGoogleEmail(s string) bool
• type Provider
• type Reference
  • func ReferenceFromNode(node *corev1.Node, defaultRef *Reference) *Reference
  • func ReferenceFromObject(sa *corev1.ServiceAccount) *Reference
  • func ReferenceFromPod(pod *corev1.Pod) *Reference

Functions

func GoogleEmail

func GoogleEmail(sa *corev1.ServiceAccount) (string, error)

GoogleEmail returns the Google service account email from the same annotation used in native GKE Workload Identity. The annotation is:

iam.gke.io/gcp-service-account

func IsGoogleEmail

func IsGoogleEmail(s string) bool

IsGoogleEmail returns true if the string is a valid Google service account email. The email must match the following pattern:

^[a-zA-Z0-9-]+@[a-zA-Z0-9-]+\.iam\.gserviceaccount\.com$

Types

type Provider

type Provider interface {
	Get(ctx context.Context, ref *Reference) (*corev1.ServiceAccount, error)
}

type Reference

type Reference struct {
	Name      string `json:"name"`
	Namespace string `json:"namespace"`
}

func ReferenceFromNode

func ReferenceFromNode(node *corev1.Node, defaultRef *Reference) *Reference

ReferenceFromNode returns a ServiceAccount reference from the Node object annotations or labels. Annotations take precedence over labels because we encourage users to use annotations instead of labels in this case since. Labels are more impactful to etcd since they are indexed, and we don't need indexing here so we prefer annotations.

The ServiceAccount reference is retrieved from the following pair of annotations or labels:

gke-metadata-server.matheuscscp.io/serviceAccountName

gke-metadata-server.matheuscscp.io/serviceAccountNamespace

If the annotations or labels are not found, defaultRef is returned.

func ReferenceFromObject

func ReferenceFromObject(sa *corev1.ServiceAccount) *Reference

ReferenceFromObject returns a ServiceAccount reference from a ServiceAccount object.

func ReferenceFromPod

func ReferenceFromPod(pod *corev1.Pod) *Reference

ReferenceFromPod returns a ServiceAccount reference from a Pod object.