webhook

package

v0.5.0 Latest Latest Go to latest Published: Sep 29, 2026 License: Apache-2.0 Imports: 14 Imported by: 0

Documentation ¶

Index ¶

Constants
type PodMutator
type ValidatedAnnotations

Constants ¶

const (
	// ServiceAccount annotations
	AnnotationServiceAccountEmail           = "workload-identity.stackit.cloud/service-account-email"
	AnnotationAudience                      = "workload-identity.stackit.cloud/audience"
	AnnotationServiceAccountTokenExpiration = "workload-identity.stackit.cloud/service-account-token-expiration-seconds"
	AnnotationIDPTokenExpiration            = "workload-identity.stackit.cloud/idp-token-expiration-seconds"
	AnnotationIDPTokenEndpoint              = "workload-identity.stackit.cloud/idp-token-endpoint"
	AnnotationFederatedTokenFile            = "workload-identity.stackit.cloud/federated-token-file"

	// Pod annotations
	AnnotationSkipWebhook = "workload-identity.stackit.cloud/skip-pod-identity-webhook"

	// Defaults
	DefaultAudience                      = "sts.accounts.stackit.cloud"
	DefaultServiceAccountTokenExpiration = "600"
	DefaultVolumeName                    = "stackit-workload-identity"
	DefaultMountPath                     = "/var/run/secrets/stackit.cloud/serviceaccount"
	DefaultTokenPath                     = "token"

	// Environment variables
	EnvFederatedTokenFile        = "STACKIT_FEDERATED_TOKEN_FILE"
	EnvServiceAccountEmail       = "STACKIT_SERVICE_ACCOUNT_EMAIL"
	EnvIDPTokenEndpoint          = "STACKIT_IDP_TOKEN_ENDPOINT"
	EnvIDPTokenExpirationSeconds = "STACKIT_IDP_TOKEN_EXPIRATION_SECONDS"
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type PodMutator ¶

type PodMutator struct {
	Client    client.Reader
	APIReader client.Reader
}

PodMutator mutates Pods

func (*PodMutator) Default ¶

func (m *PodMutator) Default(ctx context.Context, pod *corev1.Pod) error

Default implements admission.Defaulter so a webhook will be registered for the type

func (*PodMutator) HandleMutatePod ¶

func (m *PodMutator) HandleMutatePod(pod *corev1.Pod, sa *corev1.ServiceAccount, saEmail string) error

HandleMutatePod applies the mutation logic to the pod spec

func (*PodMutator) SetupWithManager ¶

func (m *PodMutator) SetupWithManager(mgr ctrl.Manager) error

SetupWithManager sets up the webhook with the Manager.

type ValidatedAnnotations ¶

type ValidatedAnnotations struct {
	ServiceAccountEmail           string
	Audience                      string
	ServiceAccountTokenExpiration int64
	IDPTokenExpiration            string
	IDPTokenEndpoint              string
	FederatedTokenFile            string
}

ValidatedAnnotations holds the parsed and validated values from the ServiceAccount annotations.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL