IsServiceAccountToken returns true if the secret is a valid api token for the service account.

JWTTokenAuthenticator authenticates tokens as JWT tokens produced by JWTTokenGenerator Token signatures are verified using each of the given public keys until one works (allowing key rotation) If lookup is true, the service account and secret referenced as claims inside the token are retrieved and verified with the provided ServiceAccountTokenGetter.

JWTTokenGenerator returns a TokenGenerator that generates signed JWT tokens, using the given privateKey.

MakeGroupNames generates service account group names for the given namespace and ServiceAccount name.

MakeNamespaceGroupName returns the name of the group all service accounts in the namespace are included in.

MakeUsername generates a username from the given namespace and ServiceAccount name.

NewGetterFromClient returns a ServiceAccountTokenGetter that uses the specified client to retrieve service accounts and secrets.

NewGetterFromRegistries returns a ServiceAccountTokenGetter that uses the specified registries to retrieve service accounts and secrets.

NewGetterFromStorageInterface returns a ServiceAccountTokenGetter that uses the specified storage to retrieve service accounts and secrets.

NewServiceAccountsController returns a new *ServiceAccountsController.

NewTokensController returns a new *TokensController.

ReadPrivateKey is a helper function for reading an rsa.PrivateKey from a PEM-encoded file.

ReadPublicKey is a helper function for reading an rsa.PublicKey from a PEM-encoded file Reads public keys from both public and private key files.

SplitUsername returns the namespace and ServiceAccount name embedded in the given username, or an error if the username is not a valid name produced by MakeUsername.

UserInfo returns a user.Info interface for the given namespace, service account name and UID.

ServiceAccountsController manages ServiceAccount objects inside Namespaces.

ServiceAccountsControllerOptions contains options for running a ServiceAccountsController.

TokensController manages ServiceAccountToken secrets for ServiceAccount objects.

TokensControllerOptions contains options for the TokensController.

ServiceAccountTokenGetter defines functions to retrieve a named service account and secret.