Support for multiple identity separated by commas #140
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds support for multiple Google Service Account (GSA) emails in the googlecloud-service-account-email annotation by accepting comma-separated values. The controller now creates separate secrets for each GSA email, with the first secret keeping the original name and additional secrets getting numbered suffixes (-1, -2, etc.).
- Support for parsing comma-separated GSA emails from annotations
- Creation of multiple indexed secrets for each GSA email
- Cleanup logic to handle removal of GSA emails and their corresponding secrets
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
internal/controller/serviceaccount_controller.go |
Main logic for handling multiple GSA emails, creating indexed secrets, and managing cleanup |
internal/controller/config.go |
Added secretNameIndexed function to generate numbered secret names |
internal/controller/serviceaccount_controller_test.go |
Test cases for multiple GSA email scenarios and cleanup behavior |
Comments suppressed due to low confidence (1)
internal/controller/serviceaccount_controller.go:1
- The condition should be
idx == 0instead ofidx <= 0. Negative indices don't make sense in this context and would incorrectly return the base secret name.
/*
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
mist714
changed the title
|
|
Co-authored-by: Hidehito Yabuuchi <[email protected]>
Co-authored-by: Hidehito Yabuuchi <[email protected]>
…visioner into multi-gsa
| return newExp, nil | ||
| } | ||
|
|
||
| func (r *serviceAccountReconciler) shouldCreateOrRefreshImagePullSecret( |
There was a problem hiding this comment.
Note to self: When principals annotated in ServiceAccount change, we need to recreate image pull secrets for the new principals.
This issue is not directly related to this PR, so I will fix it in a separate PR.
Co-authored-by: Hidehito Yabuuchi <[email protected]>
Co-authored-by: Hidehito Yabuuchi <[email protected]>
Co-authored-by: Hidehito Yabuuchi <[email protected]>
| }, | ||
| } | ||
|
|
||
| It("Create and attach multiple Secrets (two emails)", func() { |
There was a problem hiding this comment.
Could you please add some tests for
- refreshing secrets
- cleaning up secrets
when SA has multiple principals annotation?
2 participants
Support for multiple principals separated by commas.