github/steve
1
0
Fork 0
mirror of https://github.com/niusmallnan/steve.git synced 2025-07-15 23:25:53 +00:00
Code Issues Projects Releases Wiki Activity

generate a service account token to make it work in 1.24

Browse Source
This commit is contained in:
Jiaqi Luo 2022-05-26 20:03:42 -07:00
parent d26d34631a
commit 485ebe48a9
1 changed files with 16 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
pkg/podimpersonation/podimpersonation.go
View File

@ -334,12 +334,22 @@ func (s *PodImpersonation) createPod(ctx context.Context, user user.Info, role *
return nil, err return nil, err
} }
sa, err = s.waitForServiceAccount(ctx, client, sa) sc := v1.Secret{
ObjectMeta: metav1.ObjectMeta{
Name: sa.Name + "-token",
OwnerReferences: ref(role),
Annotations: map[string]string{
"kubernetes.io/service-account.name": sa.Name,
},
},
Type: v1.SecretTypeServiceAccountToken,
}
tokenSecret, err := client.CoreV1().Secrets(sa.Namespace).Create(ctx, &sc, metav1.CreateOptions{})
if err != nil { if err != nil {
return nil, err return nil, err
} }
pod = s.augmentPod(pod, sa, podOptions.ImageOverride) pod = s.augmentPod(pod, sa, tokenSecret, podOptions.ImageOverride)
if err := s.createConfigMaps(ctx, user, role, pod, podOptions, client); err != nil { if err := s.createConfigMaps(ctx, user, role, pod, podOptions, client); err != nil {
return nil, err return nil, err
@ -489,7 +499,7 @@ func (s *PodImpersonation) adminKubeConfig(user user.Info, role *rbacv1.ClusterR
}, nil }, nil
} }
func (s *PodImpersonation) augmentPod(pod *v1.Pod, sa *v1.ServiceAccount, imageOverride string) *v1.Pod { func (s *PodImpersonation) augmentPod(pod *v1.Pod, sa *v1.ServiceAccount, secret *v1.Secret, imageOverride string) *v1.Pod {
var ( var (
zero = int64(0) zero = int64(0)
t = true t = true
@ -523,10 +533,10 @@ func (s *PodImpersonation) augmentPod(pod *v1.Pod, sa *v1.ServiceAccount, imageO
}, },
}, },
v1.Volume{ v1.Volume{
Name: sa.Secrets[0].Name, Name: secret.Name,
VolumeSource: v1.VolumeSource{ VolumeSource: v1.VolumeSource{
Secret: &v1.SecretVolumeSource{ Secret: &v1.SecretVolumeSource{
SecretName: sa.Secrets[0].Name, SecretName: secret.Name,
DefaultMode: &m, DefaultMode: &m,
}, },
}, },
@ -577,7 +587,7 @@ func (s *PodImpersonation) augmentPod(pod *v1.Pod, sa *v1.ServiceAccount, imageO
SubPath: "config", SubPath: "config",
}, },
{ {
Name: sa.Secrets[0].Name, Name: secret.Name,
MountPath: "/var/run/secrets/kubernetes.io/serviceaccount", MountPath: "/var/run/secrets/kubernetes.io/serviceaccount",
ReadOnly: true, ReadOnly: true,
}, },