add clusteraccess library #52
Conversation
Diaphteiros
force-pushed
the
clusteraccess
branch
from
cd41093 to
047f83c
Compare
Diaphteiros
force-pushed
the
clusteraccess
branch
from
047f83c to
fc4fb61
Compare
| } | ||
|
|
||
| // CreateTokenForServiceAccount generates a token for the given ServiceAccount. | ||
| func CreateTokenForServiceAccount(ctx context.Context, c client.Client, sa *corev1.ServiceAccount, desiredDuration *time.Duration) (*ServiceAccountToken, error) { |
There was a problem hiding this comment.
Can we also support audiences and boundObjectRef? https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.26/#tokenrequestspec-v1-authentication-k8s-io
I really would like to see that we are using boundObjectRef by default and create a Secret automatically.
When the bound secret is getting deleted, all tokens created for it, will be invalidated automatically. This gives us an easy way to forecefully rotate all tokens. We could could even think about deleting the Secret every time we create a new token which would mean that we automatically rotate.
There was a problem hiding this comment.
I wasn't aware of this, will have a look into it.
There was a problem hiding this comment.
As discussed, let's add this later on.
What this PR does / why we need it:
Adds a small library to help with creating kubeconfigs for clusters.