serviceaccounttokencleanup

Documentation

Index

• func NewLegacyServiceAccountTokenCleanupController(namespace string, legacySecretName string, k8sClient kubernetes.Interface, ...) controllerlib.Controller

Functions

func NewLegacyServiceAccountTokenCleanupController

func NewLegacyServiceAccountTokenCleanupController(
	namespace string,
	legacySecretName string,
	k8sClient kubernetes.Interface,
	secretInformer corev1informers.SecretInformer,
	withInformer pinnipedcontroller.WithInformerOptionFunc,
	logger plog.Logger,
) controllerlib.Controller

NewLegacyServiceAccountTokenCleanupController creates a controller whose purpose is to delete a legacy Secret that was created by installation of older versions of the Pinniped Concierge which is no longer needed. This Secret was used to request and to hold a long-lived service account token which was used by the Concierge impersonation proxy. It has been replaced by a goroutine which requests short-lived service account tokens by making calls to the Kubernetes API server, without any need to read or write the tokens to a Secret. Since the old Secret contains a long-lived token, we try to delete it here. That Secret may not exist if the user never installed an old version of the Concierge, in which case this controller should do pretty much nothing.