From f7e82d8059d29a279740a03ca2d9a76615632d5d Mon Sep 17 00:00:00 2001 From: Anish Ramasekar Date: Tue, 25 Mar 2025 17:30:42 -0700 Subject: [PATCH] clarify mutual exclusivity of service account annotation keys in godoc Signed-off-by: Anish Ramasekar --- pkg/generated/openapi/zz_generated.openapi.go | 4 ++-- pkg/kubelet/apis/config/types.go | 3 +++ staging/src/k8s.io/kubelet/config/v1/types.go | 3 +++ 3 files changed, 8 insertions(+), 2 deletions(-) diff --git a/pkg/generated/openapi/zz_generated.openapi.go b/pkg/generated/openapi/zz_generated.openapi.go index 9d174c584f9..18a212a8c92 100644 --- a/pkg/generated/openapi/zz_generated.openapi.go +++ b/pkg/generated/openapi/zz_generated.openapi.go @@ -65528,7 +65528,7 @@ func schema_k8sio_kubelet_config_v1_ServiceAccountTokenAttributes(ref common.Ref }, }, SchemaProps: spec.SchemaProps{ - Description: "requiredServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are required to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. If any of the keys defined in this list are not present in the service account, kubelet will not invoke the plugin and will return an error. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials or allow workloads to opt in to using service account tokens for image pull. If non-empty, requireServiceAccount must be set to true.", + Description: "requiredServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are required to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. If any of the keys defined in this list are not present in the service account, kubelet will not invoke the plugin and will return an error. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials or allow workloads to opt in to using service account tokens for image pull. If non-empty, requireServiceAccount must be set to true. Keys in this list must be unique. This list needs to be mutually exclusive with optionalServiceAccountAnnotationKeys.", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ @@ -65548,7 +65548,7 @@ func schema_k8sio_kubelet_config_v1_ServiceAccountTokenAttributes(ref common.Ref }, }, SchemaProps: spec.SchemaProps{ - Description: "optionalServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are optional to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. The plugin is responsible for validating the existence of annotations and their values. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials.", + Description: "optionalServiceAccountAnnotationKeys is the list of annotation keys that the plugin is interested in and that are optional to be present in the service account. The keys defined in this list will be extracted from the corresponding service account and passed to the plugin as part of the CredentialProviderRequest. The plugin is responsible for validating the existence of annotations and their values. This field is optional and may be empty. Plugins may use this field to extract additional information required to fetch credentials. Keys in this list must be unique.", Type: []string{"array"}, Items: &spec.SchemaOrArray{ Schema: &spec.Schema{ diff --git a/pkg/kubelet/apis/config/types.go b/pkg/kubelet/apis/config/types.go index 3a3da8db5ed..a53c36f13ce 100644 --- a/pkg/kubelet/apis/config/types.go +++ b/pkg/kubelet/apis/config/types.go @@ -737,6 +737,8 @@ type ServiceAccountTokenAttributes struct { // additional information required to fetch credentials or allow workloads to opt in to // using service account tokens for image pull. // If non-empty, requireServiceAccount must be set to true. + // Keys in this list must be unique. + // This list needs to be mutually exclusive with optionalServiceAccountAnnotationKeys. // +optional RequiredServiceAccountAnnotationKeys []string @@ -747,6 +749,7 @@ type ServiceAccountTokenAttributes struct { // the existence of annotations and their values. // This field is optional and may be empty. Plugins may use this field to extract // additional information required to fetch credentials. + // Keys in this list must be unique. // +optional OptionalServiceAccountAnnotationKeys []string } diff --git a/staging/src/k8s.io/kubelet/config/v1/types.go b/staging/src/k8s.io/kubelet/config/v1/types.go index 4999765957c..ffcf1f69495 100644 --- a/staging/src/k8s.io/kubelet/config/v1/types.go +++ b/staging/src/k8s.io/kubelet/config/v1/types.go @@ -134,6 +134,8 @@ type ServiceAccountTokenAttributes struct { // additional information required to fetch credentials or allow workloads to opt in to // using service account tokens for image pull. // If non-empty, requireServiceAccount must be set to true. + // Keys in this list must be unique. + // This list needs to be mutually exclusive with optionalServiceAccountAnnotationKeys. // +optional // +listType=set RequiredServiceAccountAnnotationKeys []string `json:"requiredServiceAccountAnnotationKeys,omitempty"` @@ -145,6 +147,7 @@ type ServiceAccountTokenAttributes struct { // the existence of annotations and their values. // This field is optional and may be empty. Plugins may use this field to extract // additional information required to fetch credentials. + // Keys in this list must be unique. // +optional // +listType=set OptionalServiceAccountAnnotationKeys []string `json:"optionalServiceAccountAnnotationKeys,omitempty"`