Matt Moyer b80cbb8cc5 Run kube-cert-agent pod as Concierge ServiceAccount. ... Since 0dfb3e95c5, we no longer directly create the kube-cert-agent Pod, so our "use" permission on PodSecurityPolicies no longer has the intended effect. Since the deployments controller is now the one creating pods for us, we need to get the permission on the PodSpec of the target pod instead, which we do somewhat simply by using the same service account as the main Concierge pods. We still set `automountServiceAccountToken: false`, so this should not actually give any useful permissions to the agent pod when running. Signed-off-by: Matt Moyer <moyerm@vmware.com>		2021-05-03 16:20:13 -05:00
..
mocks	Add generated mocks for kubecertagent.	2021-04-26 08:19:45 -06:00
testdata	WIP: start replacing the kubecertauthority pkg with a new controller	2020-09-22 17:45:20 -07:00
kubecertagent.go	Run kube-cert-agent pod as Concierge ServiceAccount.	2021-05-03 16:20:13 -05:00
kubecertagent_test.go	Run kube-cert-agent pod as Concierge ServiceAccount.	2021-05-03 16:20:13 -05:00
legacypodcleaner.go	Add a new "legacy pod cleaner" controller.	2021-04-26 08:19:45 -06:00
legacypodcleaner_test.go	Add a new "legacy pod cleaner" controller.	2021-04-26 08:19:45 -06:00
pod_command_executor.go	Refactor kube-cert-agent controllers to use a Deployment.	2021-04-26 08:19:45 -06:00