mirror of
https://github.com/k3s-io/k3s.git
synced 2024-06-07 19:41:36 +00:00
82 lines
2.3 KiB
Go
82 lines
2.3 KiB
Go
|
/*
|
||
|
|
Copyright 2014 The Kubernetes Authors.
|
||
|
|
|
||
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||
|
|
you may not use this file except in compliance with the License.
|
||
|
|
You may obtain a copy of the License at
|
||
|
|
|
||
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
|
|
||
|
|
Unless required by applicable law or agreed to in writing, software
|
||
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
|
|
See the License for the specific language governing permissions and
|
||
|
|
limitations under the License.
|
||
|
|
*/
|
||
|
|
|
||
|
|
package serviceaccount
|
||
|
|
|
||
|
|
import (
|
||
|
|
"k8s.io/api/core/v1"
|
||
|
|
apiserverserviceaccount "k8s.io/apiserver/pkg/authentication/serviceaccount"
|
||
|
|
"k8s.io/apiserver/pkg/authentication/user"
|
||
|
|
)
|
||
|
|
|
||
|
|
const (
|
||
|
|
// PodNameKey is the key used in a user's "extra" to specify the pod name of
|
||
|
|
// the authenticating request.
|
||
|
|
PodNameKey = "authentication.kubernetes.io/pod-name"
|
||
|
|
// PodUIDKey is the key used in a user's "extra" to specify the pod UID of
|
||
|
|
// the authenticating request.
|
||
|
|
PodUIDKey = "authentication.kubernetes.io/pod-uid"
|
||
|
|
)
|
||
|
|
|
||
|
|
// UserInfo returns a user.Info interface for the given namespace, service account name and UID
|
||
|
|
func UserInfo(namespace, name, uid string) user.Info {
|
||
|
|
return (&ServiceAccountInfo{
|
||
|
|
Name: name,
|
||
|
|
Namespace: namespace,
|
||
|
|
UID: uid,
|
||
|
|
}).UserInfo()
|
||
|
|
}
|
||
|
|
|
||
|
|
type ServiceAccountInfo struct {
|
||
|
|
Name, Namespace, UID string
|
||
|
|
PodName, PodUID string
|
||
|
|
}
|
||
|
|
|
||
|
|
func (sa *ServiceAccountInfo) UserInfo() user.Info {
|
||
|
|
info := &user.DefaultInfo{
|
||
|
|
Name: apiserverserviceaccount.MakeUsername(sa.Namespace, sa.Name),
|
||
|
|
UID: sa.UID,
|
||
|
|
Groups: apiserverserviceaccount.MakeGroupNames(sa.Namespace),
|
||
|
|
}
|
||
|
|
if sa.PodName != "" && sa.PodUID != "" {
|
||
|
|
info.Extra = map[string][]string{
|
||
|
|
PodNameKey: {sa.PodName},
|
||
|
|
PodUIDKey: {sa.PodUID},
|
||
|
|
}
|
||
|
|
}
|
||
|
|
return info
|
||
|
|
}
|
||
|
|
|
||
|
|
// IsServiceAccountToken returns true if the secret is a valid api token for the service account
|
||
|
|
func IsServiceAccountToken(secret *v1.Secret, sa *v1.ServiceAccount) bool {
|
||
|
|
if secret.Type != v1.SecretTypeServiceAccountToken {
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
|
||
|
|
name := secret.Annotations[v1.ServiceAccountNameKey]
|
||
|
|
uid := secret.Annotations[v1.ServiceAccountUIDKey]
|
||
|
|
if name != sa.Name {
|
||
|
|
// Name must match
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
if len(uid) > 0 && uid != string(sa.UID) {
|
||
|
|
// If UID is specified, it must match
|
||
|
|
return false
|
||
|
|
}
|
||
|
|
|
||
|
|
return true
|
||
|
|
}
|