github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2026-07-17 20:00:07 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #131061 from aramase/aramase/c/kep_4412_add_unique_req

Browse Source 
clarify mutual exclusivity of service account annotation keys in godoc
This commit is contained in:
Kubernetes Prow Robot
2025-04-23 15:59:06 -07:00
committed by GitHub
parent a63fd40447 f7e82d8059
commit ea04d665da
3 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
pkg/generated/openapi/zz_generated.openapi.go generated
View File

@@ -67490,7 +67490,7 @@ func schema_k8sio_kubelet_config_v1_ServiceAccountTokenAttributes(ref common.Ref
},
},
SchemaProps: spec.SchemaProps{
Description: "requiredServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are required to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. If any of the keys defined in this list are not present in the service account, kubelet will not invoke the plugin and will return an error. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials or allow workloads to opt in to using service account tokens for image pull. If non-empty, requireServiceAccount must be set to true.",
Description: "requiredServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are required to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. If any of the keys defined in this list are not present in the service account, kubelet will not invoke the plugin and will return an error. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials or allow workloads to opt in to using service account tokens for image pull. If non-empty, requireServiceAccount must be set to true. Keys in this list must be unique. This list needs to be mutually exclusive with optionalServiceAccountAnnotationKeys.",
Type: []string{"array"},
Items: &spec.SchemaOrArray{
Schema: &spec.Schema{
@@ -67510,7 +67510,7 @@ func schema_k8sio_kubelet_config_v1_ServiceAccountTokenAttributes(ref common.Ref
},
},
SchemaProps: spec.SchemaProps{
Description: "optionalServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are optional to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. The plugin is responsible for validating the existence of annotations and their values. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials.",
Description: "optionalServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are optional to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. The plugin is responsible for validating the existence of annotations and their values. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials. Keys in this list must be unique.",
Type: []string{"array"},
Items: &spec.SchemaOrArray{
Schema: &spec.Schema{

3
pkg/kubelet/apis/config/types.go
View File

@@ -737,6 +737,8 @@ type ServiceAccountTokenAttributes struct {
// additional information required to fetch credentials or allow workloads to opt in to
// using service account tokens for image pull.
// If non-empty, requireServiceAccount must be set to true.
// Keys in this list must be unique.
// This list needs to be mutually exclusive with optionalServiceAccountAnnotationKeys.
// +optional
RequiredServiceAccountAnnotationKeys []string
@@ -747,6 +749,7 @@ type ServiceAccountTokenAttributes struct {
// the existence of annotations and their values.
// This field is optional and may be empty. Plugins may use this field to extract
// additional information required to fetch credentials.
// Keys in this list must be unique.
// +optional
OptionalServiceAccountAnnotationKeys []string
}

3
staging/src/k8s.io/kubelet/config/v1/types.go
View File

@@ -134,6 +134,8 @@ type ServiceAccountTokenAttributes struct {
// additional information required to fetch credentials or allow workloads to opt in to
// using service account tokens for image pull.
// If non-empty, requireServiceAccount must be set to true.
// Keys in this list must be unique.
// This list needs to be mutually exclusive with optionalServiceAccountAnnotationKeys.
// +optional
// +listType=set
RequiredServiceAccountAnnotationKeys []string `json:"requiredServiceAccountAnnotationKeys,omitempty"`
@@ -145,6 +147,7 @@ type ServiceAccountTokenAttributes struct {
// the existence of annotations and their values.
// This field is optional and may be empty. Plugins may use this field to extract
// additional information required to fetch credentials.
// Keys in this list must be unique.
// +optional
// +listType=set
OptionalServiceAccountAnnotationKeys []string `json:"optionalServiceAccountAnnotationKeys,omitempty"`