JWTTokenAuthenticator authenticates tokens as JWT tokens produced by JWTTokenGenerator Token signatures are verified using each of the given public keys until one works (allowing key rotation) If lookup is true, the service account and secret referenced as claims inside the token are retrieved and verified with the provided ServiceAccountTokenGetter.

JWTTokenGenerator returns a TokenGenerator that generates signed JWT tokens, using the given privateKey.

MakeUsername generates a username from the given namespace and ServiceAccount name.

NewGetterFromClient returns a ServiceAccountTokenGetter that uses the specified client to retrieve service accounts and secrets.

NewGetterFromEtcdHelper returns a ServiceAccountTokenGetter that uses the specified helper to retrieve service accounts and secrets.

NewGetterFromRegistries returns a ServiceAccountTokenGetter that uses the specified registries to retrieve service accounts and secrets.

NewServiceAccountsController returns a new *ServiceAccountsController.

NewTokensController returns a new *TokensController.

ReadPrivateKey is a helper function for reading an rsa.PrivateKey from a PEM-encoded file.

ReadPublicKey is a helper function for reading an rsa.PublicKey from a PEM-encoded file Reads public keys from both public and private key files.

SplitUsername returns the namespace and ServiceAccount name embedded in the given username, or an error if the username is not a valid name produced by MakeUsername.

ServiceAccountsController manages ServiceAccount objects inside Namespaces.

ServiceAccountsControllerOptions contains options for running a ServiceAccountsController.

TokensController manages ServiceAccountToken secrets for ServiceAccount objects.

TokensControllerOptions contains options for the TokensController.

ServiceAccountTokenGetter defines functions to retrieve a named service account and secret.