Defaults.

The audience annotation.

Constants for injected fields.

Annotations for Pod The External Credentials JSON blob to be injected into the cluster, only used in 'direct' mode.

Annotations for ServiceAccount Set to 'direct' or 'gcloud' to determine credential injection mode.

Annotations for ServiceAccount UserID to be set in the container securityContext.runAsUser for the gcloud sdk.

The serviceaccount email annotation.

Annotations for Pod A comma-separated list of container names to skip adding environment variables and volumes to.

Annotations for both ServiceAccount and Pod TokenExpiration annotation in seconds.

Annotations for ServiceAccount The workloadIdentityProvider annotattion This must be the format of "projects/{PROJECT_NUMBER}/locations/{LOCATION}/workloadIdentityPools/{POOL_ID}/providers/{PROVIDER_ID}".

CredentialSource stores the information necessary to retrieve the credentials for the STS exchange.

Config stores the configuration for fetching tokens with external credentials.

GCPWorkloadIdentityMutator inject configurations for containers to acquire workload federated identity automatically.