serviceaccount

Documentation

Index

• Constants
• func IsServiceAccountToken(secret *v1.Secret, sa *v1.ServiceAccount) bool
• func MakeGroupNames(namespace string) []string
• func MakeNamespaceGroupName(namespace string) string
• func MakeUsername(namespace, name string) string
• func MatchesUsername(namespace, name string, username string) bool
• func SplitUsername(username string) (string, string, error)
• func UserInfo(namespace, name, uid string) user.Info
• type ServiceAccountInfo
  • func (sa *ServiceAccountInfo) UserInfo() user.Info

Constants

const (
	ServiceAccountUsernamePrefix    = "system:serviceaccount:"
	ServiceAccountUsernameSeparator = ":"
	ServiceAccountGroupPrefix       = "system:serviceaccounts:"
	AllServiceAccountsGroup         = "system:serviceaccounts"
	// IssuedCredentialIDAuditAnnotationKey is the annotation key used in the audit event that is persisted to the
	// '/token' endpoint for service accounts.
	// This annotation indicates the generated credential identifier for the service account token being issued.
	// This is useful when tracing back the origin of tokens that have gone on to make request that have persisted
	// their credential-identifier into the audit log via the user's extra info stored on subsequent audit events.
	IssuedCredentialIDAuditAnnotationKey = "authentication.kubernetes.io/issued-credential-id"
	// PodNameKey is the key used in a user's "extra" to specify the pod name of
	// the authenticating request.
	PodNameKey = "authentication.kubernetes.io/pod-name"
	// PodUIDKey is the key used in a user's "extra" to specify the pod UID of
	// the authenticating request.
	PodUIDKey = "authentication.kubernetes.io/pod-uid"
	// NodeNameKey is the key used in a user's "extra" to specify the node name of
	// the authenticating request.
	NodeNameKey = "authentication.kubernetes.io/node-name"
	// NodeUIDKey is the key used in a user's "extra" to specify the node UID of
	// the authenticating request.
	NodeUIDKey = "authentication.kubernetes.io/node-uid"
)

Functions

func IsServiceAccountToken

func IsServiceAccountToken(secret *v1.Secret, sa *v1.ServiceAccount) bool

IsServiceAccountToken returns true if the secret is a valid api token for the service account

func MakeGroupNames

func MakeGroupNames(namespace string) []string

MakeGroupNames generates service account group names for the given namespace

func MakeNamespaceGroupName

func MakeNamespaceGroupName(namespace string) string

MakeNamespaceGroupName returns the name of the group all service accounts in the namespace are included in

func MakeUsername

func MakeUsername(namespace, name string) string

MakeUsername generates a username from the given namespace and ServiceAccount name. The resulting username can be passed to SplitUsername to extract the original namespace and ServiceAccount name.

func MatchesUsername

func MatchesUsername(namespace, name string, username string) bool

MatchesUsername checks whether the provided username matches the namespace and name without allocating. Use this when checking a service account namespace and name against a known string.

func SplitUsername

func SplitUsername(username string) (string, string, error)

SplitUsername returns the namespace and ServiceAccount name embedded in the given username, or an error if the username is not a valid name produced by MakeUsername

func UserInfo

func UserInfo(namespace, name, uid string) user.Info

UserInfo returns a user.Info interface for the given namespace, service account name and UID

Types

type ServiceAccountInfo

type ServiceAccountInfo struct {
	Name, Namespace, UID string
	PodName, PodUID      string
	CredentialID         string
	NodeName, NodeUID    string
}

func (*ServiceAccountInfo) UserInfo

func (sa *ServiceAccountInfo) UserInfo() user.Info