Documentation
¶
Overview ¶
Package serviceaccount provides a builder and resource for managing Kubernetes ServiceAccounts.
Index ¶
- type Builder
- type Mutation
- type Mutator
- func (m *Mutator) Apply() error
- func (m *Mutator) EditObjectMetadata(edit func(*editors.ObjectMetaEditor) error)
- func (m *Mutator) EnsureImagePullSecret(name string)
- func (m *Mutator) NextFeature()
- func (m *Mutator) RemoveImagePullSecret(name string)
- func (m *Mutator) SetAutomountServiceAccountToken(v *bool)
- type Resource
- func (r *Resource) ExtractData() error
- func (r *Resource) GuardStatus() (concepts.GuardStatusWithReason, error)
- func (r *Resource) Identity() string
- func (r *Resource) Mutate(current client.Object) error
- func (r *Resource) Object() (client.Object, error)
- func (r *Resource) PreviewObject() (*corev1.ServiceAccount, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Builder ¶
type Builder struct {
// contains filtered or unexported fields
}
Builder is a configuration helper for creating and customizing a ServiceAccount Resource.
It provides a fluent API for registering mutations and data extractors. Build() validates the configuration and returns an initialized Resource ready for use in a reconciliation loop.
func NewBuilder ¶
func NewBuilder(sa *corev1.ServiceAccount) *Builder
NewBuilder initializes a new Builder with the provided ServiceAccount object.
The ServiceAccount object serves as the desired base state. During reconciliation the Resource will make the cluster's state match this base, modified by any registered mutations.
The provided ServiceAccount must have both Name and Namespace set, which is validated during the Build() call.
func (*Builder) Build ¶
Build validates the configuration and returns the initialized Resource.
It returns an error if:
- No ServiceAccount object was provided.
- The ServiceAccount is missing a Name or Namespace.
func (*Builder) WithDataExtractor ¶
func (b *Builder) WithDataExtractor(extractor func(corev1.ServiceAccount) error) *Builder
WithDataExtractor registers a function to read values from the ServiceAccount after it has been successfully reconciled.
The extractor receives a value copy of the reconciled ServiceAccount. This is useful for surfacing generated or updated entries to other components or resources.
A nil extractor is ignored.
func (*Builder) WithGuard ¶ added in v0.4.0
func (b *Builder) WithGuard(guard func(corev1.ServiceAccount) (concepts.GuardStatusWithReason, error)) *Builder
WithGuard registers a guard precondition that is evaluated before the ServiceAccount is applied during reconciliation. If the guard returns Blocked, the ServiceAccount and all resources registered after it are skipped until the guard clears. Passing nil clears any previously registered guard.
func (*Builder) WithMutation ¶
WithMutation registers a mutation for the ServiceAccount.
Mutations are applied sequentially during the Mutate() phase of reconciliation. A mutation with a nil Feature is applied unconditionally; one with a non-nil Feature is applied only when that feature is enabled.
type Mutation ¶
Mutation defines a mutation that is applied to a serviceaccount Mutator only if its associated feature gate is enabled.
type Mutator ¶
type Mutator struct {
// contains filtered or unexported fields
}
Mutator is a high-level helper for modifying a Kubernetes ServiceAccount.
It uses a "plan-and-apply" pattern: mutations are recorded first, then applied to the ServiceAccount in a single controlled pass when Apply() is called.
The Mutator maintains feature boundaries: each feature's mutations are planned together and applied in the order the features were registered.
Mutator implements editors.ObjectMutator.
func NewMutator ¶
func NewMutator(sa *corev1.ServiceAccount) *Mutator
NewMutator creates a new Mutator for the given ServiceAccount. The constructor creates the initial feature scope, so mutations can be registered immediately without an explicit call to NextFeature.
func (*Mutator) Apply ¶
Apply executes all recorded mutation intents on the underlying ServiceAccount.
Execution order across all registered features:
- Metadata edits (in registration order within each feature)
- Image pull secret edits — EnsureImagePullSecret, RemoveImagePullSecret (in registration order within each feature)
- Automount edits — SetAutomountServiceAccountToken (in registration order within each feature)
Features are applied in the order they were registered. Later features observe the ServiceAccount as modified by all previous features.
func (*Mutator) EditObjectMetadata ¶
func (m *Mutator) EditObjectMetadata(edit func(*editors.ObjectMetaEditor) error)
EditObjectMetadata records a mutation for the ServiceAccount's own metadata.
Metadata edits are applied before image pull secret and automount edits within the same feature. A nil edit function is ignored.
func (*Mutator) EnsureImagePullSecret ¶
EnsureImagePullSecret records that the named image pull secret should be present in .imagePullSecrets. If a secret with the same name already exists, it is a no-op.
func (*Mutator) NextFeature ¶
func (m *Mutator) NextFeature()
NextFeature advances to a new feature planning scope. All subsequent mutation registrations will be grouped into this scope until NextFeature is called again.
The first scope is created automatically by NewMutator. This method is called by the framework between mutations to maintain per-feature ordering semantics.
func (*Mutator) RemoveImagePullSecret ¶
RemoveImagePullSecret records that the named image pull secret should be removed from .imagePullSecrets. It is a no-op if the secret is not present.
func (*Mutator) SetAutomountServiceAccountToken ¶
SetAutomountServiceAccountToken records that .automountServiceAccountToken should be set to the provided value. Pass nil to unset the field.
The pointed-to value is snapshotted at registration time so that Apply() is deterministic regardless of later caller-side mutations.
type Resource ¶
type Resource struct {
// contains filtered or unexported fields
}
Resource is a high-level abstraction for managing a Kubernetes ServiceAccount within a controller's reconciliation loop.
It implements the following component interfaces:
- component.Resource: for basic identity and mutation behaviour.
- concepts.Guardable: for conditional reconciliation based on a guard precondition.
- concepts.DataExtractable: for exporting values after successful reconciliation.
ServiceAccount resources are static: they do not model convergence health, grace periods, or suspension. Use a workload or task primitive for resources that require those concepts.
func (*Resource) ExtractData ¶
ExtractData executes all registered data extractor functions against a deep copy of the reconciled ServiceAccount.
This is called by the framework after successful reconciliation, allowing the component to read generated or updated values from the ServiceAccount.
func (*Resource) GuardStatus ¶ added in v0.4.0
func (r *Resource) GuardStatus() (concepts.GuardStatusWithReason, error)
GuardStatus evaluates the resource's guard precondition. If no guard was registered, the resource is unconditionally unblocked.
func (*Resource) Identity ¶
Identity returns a unique identifier for the ServiceAccount in the format "v1/ServiceAccount/<namespace>/<name>".
func (*Resource) Mutate ¶
Mutate transforms the current state of a Kubernetes ServiceAccount into the desired state.
The mutation process follows this order:
- The desired base state is applied to the current object.
- Feature mutations: all registered feature-gated mutations are applied in order.
This method is invoked by the framework during the Update phase of reconciliation.
func (*Resource) Object ¶
Object returns a deep copy of the underlying Kubernetes ServiceAccount object.
The returned object implements client.Object, making it compatible with controller-runtime's Client for Create, Update, and Patch operations.
func (*Resource) PreviewObject ¶ added in v0.6.0
func (r *Resource) PreviewObject() (*corev1.ServiceAccount, error)
PreviewObject returns the ServiceAccount as it would appear after feature mutations have been applied, without modifying the resource's internal state.
Suspension mutations are not applied; the preview reflects content state only.
Source Files