Documentation
¶
Overview ¶
Package serviceaccountcmd provides the "service-account" cobra command a host CLI mounts to manage service accounts: create, list, show, disable, enable and delete accounts; add, list and revoke their keys; and grant and remove their application roles. It opens the identity database directly, so it works whether or not the server is running, and never changes the schema.
Access changes the commands make (disabling an account, removing a role, revoking a key) are recorded in the database, where applications read them; announcing them to a running server's in-process sinks is the server's job.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func DefaultService ¶
func DefaultService(registry *authz.VocabularyRegistry, opts ...approle.Option) func(*ent.Client) (*serviceaccount.Service, error)
DefaultService builds the service with the host's application role vocabularies, so role commands accept the host's applications. With a nil registry no application is known: roles cannot be granted, but accounts can still be deleted with any roles they hold.
Types ¶
type Open ¶
Open opens the identity database for one command, returning its client and the function that closes it.
type Options ¶
type Options struct {
// Service builds the service-account service over an open client.
// Default: DefaultService(nil), which cannot grant or remove roles.
Service func(client *ent.Client) (*serviceaccount.Service, error)
// Issuer returns SystemAuth's issuer URL, printed with a new key so the
// workload has everything it needs. Nil leaves it out.
Issuer func() string
}
Options configure the command.
Source Files