AllowedSubject interface
A subject authorized to use the identity binding for token exchange. The namespace selector is required and must be non-empty. The service account selector is optional; when omitted, all service accounts in matching namespaces are authorized. Selectors within a single AllowedSubject are AND'd; multiple AllowedSubjects on an IdentityBinding are OR'd.
Properties
| namespace |
Label selector matching the namespaces in which this identity may be
used. Must be non-empty: an empty selector would match every namespace
and is rejected to prevent overly permissive bindings. Use the built-in
|
| service |
Optional label selector matching the service accounts (within the
namespaces matched by |
Property Details
namespaceSelector
Label selector matching the namespaces in which this identity may be
used. Must be non-empty: an empty selector would match every namespace
and is rejected to prevent overly permissive bindings. Use the built-in
kubernetes.io/metadata.name label to target specific namespaces by
name.
namespaceSelector: LabelSelectorProperty Value
serviceAccountSelector
Optional label selector matching the service accounts (within the
namespaces matched by namespaceSelector) that may use this identity.
When omitted, all service accounts in matching namespaces are
authorized. When provided, it must be non-empty.
serviceAccountSelector?: LabelSelector