Merge pull request #117160 from liggitt/sa-describe
Clean up service account print and describe Kubernetes-commit: 6958161aa94617357d14fc9b24637f4587296ff1
This commit is contained in:
Kubernetes Publisher
commit
0889899212
4
go.mod
4
go.mod
|
|
@ -30,10 +30,10 @@ require (
|
|||
golang.org/x/sys v0.31.0
|
||||
gopkg.in/evanphx/json-patch.v4 v4.12.0
|
||||
k8s.io/api v0.0.0-20250816062245-fa01e40890d0
|
||||
k8s.io/apimachinery v0.0.0-20250816040907-f5dd29d6ada1
|
||||
k8s.io/apimachinery v0.0.0-20250827234502-7a24dae0db84
|
||||
k8s.io/cli-runtime v0.0.0-20250816070916-f536649dab67
|
||||
k8s.io/client-go v0.0.0-20250827235243-c40e1110fa64
|
||||
k8s.io/component-base v0.0.0-20250828000726-422881f698ae
|
||||
k8s.io/component-base v0.0.0-20250828000729-ee2825ba449c
|
||||
k8s.io/component-helpers v0.0.0-20250816064315-d154920f3a99
|
||||
k8s.io/klog/v2 v2.130.1
|
||||
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b
|
||||
|
|
|
|||
8
go.sum
8
go.sum
|
|
@ -200,14 +200,14 @@ gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
|||
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
|
||||
k8s.io/api v0.0.0-20250816062245-fa01e40890d0 h1:WddRlAJwdWiTmGknuGqNHLxJ7RaF3bqjd933VhVCUes=
|
||||
k8s.io/api v0.0.0-20250816062245-fa01e40890d0/go.mod h1:PyEssxRzobRLFX/lEYzx5NDkS4JYE20SOKUZjTH0nvI=
|
||||
k8s.io/apimachinery v0.0.0-20250816040907-f5dd29d6ada1 h1:CyDLPRX8n0wju2WX8Bukq22Ucjz/XiXuS9WQvm/JBBI=
|
||||
k8s.io/apimachinery v0.0.0-20250816040907-f5dd29d6ada1/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
|
||||
k8s.io/apimachinery v0.0.0-20250827234502-7a24dae0db84 h1:rMqDsUPA2nfIdTtHQT7BPacZ0SfH/oPG6zCKqy38wfQ=
|
||||
k8s.io/apimachinery v0.0.0-20250827234502-7a24dae0db84/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
|
||||
k8s.io/cli-runtime v0.0.0-20250816070916-f536649dab67 h1:p6C/SYa7jZ4HpdNRIU/xJbY4lkMwl95iS6WkYmL3jE8=
|
||||
k8s.io/cli-runtime v0.0.0-20250816070916-f536649dab67/go.mod h1:HIyOYCeQzm69fJySABxiMZ3Jw+tMJfIKesAiuPd+3No=
|
||||
k8s.io/client-go v0.0.0-20250827235243-c40e1110fa64 h1:b54AVeng0GqoVuN0+CoXvHwhoBmIY4IkfTNfOVXELpY=
|
||||
k8s.io/client-go v0.0.0-20250827235243-c40e1110fa64/go.mod h1:7VxAeZExKZSEiiIaKgN5fzCEcBAeEk7K42u7LqPTESo=
|
||||
k8s.io/component-base v0.0.0-20250828000726-422881f698ae h1:ob6TeKTWpfGU3v1hYi9decYahOOW8Mm1hW3T+fOfhbM=
|
||||
k8s.io/component-base v0.0.0-20250828000726-422881f698ae/go.mod h1:aohEoE0FHN6tCIIet4G5za7u5plNmkpkY/AuDDnUhH4=
|
||||
k8s.io/component-base v0.0.0-20250828000729-ee2825ba449c h1:FNLYAa5FW9WUcwMWWyi1eE9zU73X3buvsrAiAsJ7XMI=
|
||||
k8s.io/component-base v0.0.0-20250828000729-ee2825ba449c/go.mod h1:q5RKMm+VwuOM+tYS+fe3xrb+vsowL6MIE5peUlpLQPc=
|
||||
k8s.io/component-helpers v0.0.0-20250816064315-d154920f3a99 h1:RntyireBPwOrXJ89wKt6kNrB/yVT4eCWuv/il/czsoM=
|
||||
k8s.io/component-helpers v0.0.0-20250816064315-d154920f3a99/go.mod h1:2PiD4/9sXcLwnpwFutLSOdjunPFkRZZD8D6+rWb8amI=
|
||||
k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
|
||||
|
|
|
|||
|
|
@ -3445,61 +3445,15 @@ func (d *ServiceAccountDescriber) Describe(namespace, name string, describerSett
|
|||
return "", err
|
||||
}
|
||||
|
||||
tokens := []corev1.Secret{}
|
||||
|
||||
// missingSecrets is the set of all secrets present in the
|
||||
// serviceAccount but not present in the set of existing secrets.
|
||||
missingSecrets := sets.New[string]()
|
||||
secrets := corev1.SecretList{}
|
||||
err = runtimeresource.FollowContinue(&metav1.ListOptions{Limit: describerSettings.ChunkSize},
|
||||
func(options metav1.ListOptions) (runtime.Object, error) {
|
||||
newList, err := d.CoreV1().Secrets(namespace).List(context.TODO(), options)
|
||||
if err != nil {
|
||||
return nil, runtimeresource.EnhanceListError(err, options, corev1.ResourceSecrets.String())
|
||||
}
|
||||
secrets.Items = append(secrets.Items, newList.Items...)
|
||||
return newList, nil
|
||||
})
|
||||
|
||||
// errors are tolerated here in order to describe the serviceAccount with all
|
||||
// of the secrets that it references, even if those secrets cannot be fetched.
|
||||
if err == nil {
|
||||
// existingSecrets is the set of all secrets remaining on a
|
||||
// service account that are not present in the "tokens" slice.
|
||||
existingSecrets := sets.New[string]()
|
||||
|
||||
for _, s := range secrets.Items {
|
||||
if s.Type == corev1.SecretTypeServiceAccountToken {
|
||||
name := s.Annotations[corev1.ServiceAccountNameKey]
|
||||
uid := s.Annotations[corev1.ServiceAccountUIDKey]
|
||||
if name == serviceAccount.Name && uid == string(serviceAccount.UID) {
|
||||
tokens = append(tokens, s)
|
||||
}
|
||||
}
|
||||
existingSecrets.Insert(s.Name)
|
||||
}
|
||||
|
||||
for _, s := range serviceAccount.Secrets {
|
||||
if !existingSecrets.Has(s.Name) {
|
||||
missingSecrets.Insert(s.Name)
|
||||
}
|
||||
}
|
||||
for _, s := range serviceAccount.ImagePullSecrets {
|
||||
if !existingSecrets.Has(s.Name) {
|
||||
missingSecrets.Insert(s.Name)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
var events *corev1.EventList
|
||||
if describerSettings.ShowEvents {
|
||||
events, _ = searchEvents(d.CoreV1(), serviceAccount, describerSettings.ChunkSize)
|
||||
}
|
||||
|
||||
return describeServiceAccount(serviceAccount, tokens, missingSecrets, events)
|
||||
return describeServiceAccount(serviceAccount, events)
|
||||
}
|
||||
|
||||
func describeServiceAccount(serviceAccount *corev1.ServiceAccount, tokens []corev1.Secret, missingSecrets sets.Set[string], events *corev1.EventList) (string, error) {
|
||||
func describeServiceAccount(serviceAccount *corev1.ServiceAccount, events *corev1.EventList) (string, error) {
|
||||
return tabbedString(func(out io.Writer) error {
|
||||
w := NewPrefixWriter(out)
|
||||
w.Write(LEVEL_0, "Name:\t%s\n", serviceAccount.Name)
|
||||
|
|
@ -3510,28 +3464,16 @@ func describeServiceAccount(serviceAccount *corev1.ServiceAccount, tokens []core
|
|||
var (
|
||||
emptyHeader = " "
|
||||
pullHeader = "Image pull secrets:"
|
||||
mountHeader = "Mountable secrets: "
|
||||
tokenHeader = "Tokens: "
|
||||
|
||||
pullSecretNames = []string{}
|
||||
mountSecretNames = []string{}
|
||||
tokenSecretNames = []string{}
|
||||
pullSecretNames = []string{}
|
||||
)
|
||||
|
||||
for _, s := range serviceAccount.ImagePullSecrets {
|
||||
pullSecretNames = append(pullSecretNames, s.Name)
|
||||
}
|
||||
for _, s := range serviceAccount.Secrets {
|
||||
mountSecretNames = append(mountSecretNames, s.Name)
|
||||
}
|
||||
for _, s := range tokens {
|
||||
tokenSecretNames = append(tokenSecretNames, s.Name)
|
||||
}
|
||||
|
||||
types := map[string][]string{
|
||||
pullHeader: pullSecretNames,
|
||||
mountHeader: mountSecretNames,
|
||||
tokenHeader: tokenSecretNames,
|
||||
pullHeader: pullSecretNames,
|
||||
}
|
||||
for _, header := range sets.List(sets.KeySet(types)) {
|
||||
names := types[header]
|
||||
|
|
@ -3540,11 +3482,7 @@ func describeServiceAccount(serviceAccount *corev1.ServiceAccount, tokens []core
|
|||
} else {
|
||||
prefix := header
|
||||
for _, name := range names {
|
||||
if missingSecrets.Has(name) {
|
||||
w.Write(LEVEL_0, "%s\t%s (not found)\n", prefix, name)
|
||||
} else {
|
||||
w.Write(LEVEL_0, "%s\t%s\n", prefix, name)
|
||||
}
|
||||
w.Write(LEVEL_0, "%s\t%s\n", prefix, name)
|
||||
prefix = emptyHeader
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -6238,9 +6238,7 @@ func TestDescribeServiceAccount(t *testing.T) {
|
|||
Namespace: foo
|
||||
Labels: <none>
|
||||
Annotations: <none>
|
||||
Image pull secrets: test-local-ref (not found)
|
||||
Mountable secrets: test-objectref (not found)
|
||||
Tokens: <none>
|
||||
Image pull secrets: test-local-ref
|
||||
Events: <none>` + "\n"
|
||||
if out != expectedOut {
|
||||
t.Errorf("expected : %q\n but got output:\n %q", expectedOut, out)
|
||||
|
|
|
|||
Loading…
Reference in New Issue