func (k KubernetesIdentity) Username() string {
	return k.KubernetesUsername
}
Username returns the Kubernetes username
package aws
import (
	"context"
	"fmt"
	"strings"
	"github.com/kris-nova/logger"
	"github.com/pkg/errors"
	"k8s.io/client-go/kubernetes"
	"sigs.k8s.io/yaml"
	corev1 "k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	v1 "k8s.io/client-go/kubernetes/typed/core/v1"
	"github.com/aws/aws-sdk-go/aws/arn"
	"github.com/aws/aws-sdk-go/aws/awsutil"
)
const (
	ObjectName = "aws-auth"
	ObjectNamespace = metav1.NamespaceSystem
	rolesData = "mapRoles"
	usersData = "mapUsers"
	accountsData = "mapAccounts"
	GroupMasters = "system:masters"
	RoleNodeGroupUsername = "system:node:{{EC2PrivateDNSName}}"
)
type AuthConfigMap struct {
	client v1.ConfigMapInterface
	cm     *corev1.ConfigMap
}
func New(client v1.ConfigMapInterface, cm *corev1.ConfigMap) *AuthConfigMap {
	if cm == nil {
		cm = &corev1.ConfigMap{
			ObjectMeta: ObjectMeta(),
			Data:       map[string]string{},
		}
	}
	if cm.Data == nil {
		cm.ObjectMeta = ObjectMeta()
		cm.Data = map[string]string{}
	}
	return &AuthConfigMap{client: client, cm: cm}
}
func ObjectMeta() metav1.ObjectMeta {
	return metav1.ObjectMeta{
		Name:      ObjectName,
		Namespace: ObjectNamespace,
	}
}
func NewFromClientSet(clientSet kubernetes.Interface) (*AuthConfigMap, error) {
	client := clientSet.CoreV1().ConfigMaps(ObjectNamespace)
	cm, err := client.Get(context.TODO(), ObjectName, metav1.GetOptions{})
	if err != nil && !apierrors.IsNotFound(err) {
		return nil, errors.Wrapf(err, "getting auth ConfigMap")
	}
	logger.Debug("aws-auth = %s", awsutil.Prettify(cm))
	return New(client, cm), nil
}
func (a *AuthConfigMap) AddIdentity(identity Identity) error {
	identities, err := a.Identities()
	if err != nil {
		return err
	}
	identities = append(identities, identity)
	logger.Info("adding identity %q to auth ConfigMap", identity.ARN())
	return a.setIdentities(identities)
}
func (a *AuthConfigMap) Identities() ([]Identity, error) {
	var roles []RoleIdentity
	if err := yaml.Unmarshal([]byte(a.cm.Data[rolesData]), &roles); err != nil {
		return nil, errors.Wrapf(err, "unmarshalling %q", rolesData)
	}
	var users []UserIdentity
	if err := yaml.Unmarshal([]byte(a.cm.Data[usersData]), &users); err != nil {
		return nil, errors.Wrapf(err, "unmarshalling %q", usersData)
	}
	all := make([]Identity, len(users)+len(roles))
	for i, r := range roles {
		all[i] = r
	}
	for i, u := range users {
		all[i+len(roles)] = u
	}
	return all, nil
}
func (a *AuthConfigMap) setIdentities(identities []Identity) error {
	users, roles := []Identity{}, []Identity{}
	for _, identity := range identities {
		switch identity.Type() {
		case ResourceTypeRole:
			roles = append(roles, identity)
		case ResourceTypeUser:
			users = append(users, identity)
		default:
			return errors.Errorf("cannot determine if %q refers to a user or role during setIdentities preprocessing", identity.ARN())
		}
	}
	_roles, err := yaml.Marshal(roles)
	if err != nil {
		return errors.Wrapf(err, "marshalling %q", rolesData)
	}
	a.cm.Data[rolesData] = string(_roles)
	_users, err := yaml.Marshal(users)
	if err != nil {
		return errors.Wrapf(err, "marshalling %q", usersData)
	}
	a.cm.Data[usersData] = string(_users)
	return nil
}
func (a *AuthConfigMap) Save() (err error) {
	if a.cm.UID == "" {
		a.cm, err = a.client.Create(context.TODO(), a.cm, metav1.CreateOptions{})
		return err
	}
	a.cm, err = a.client.Update(context.TODO(), a.cm, metav1.UpdateOptions{})
	return err
}
var (
	ErrNeitherUserNorRole = errors.New("arn is neither user nor role")
	ErrNoKubernetesIdentity = errors.New("neither username nor group are set for iam identity")
)
type Identity interface {
	ARN() string
	Type() string
	Username() string
	Groups() []string
}
type KubernetesIdentity struct {
	KubernetesUsername string   `json:"username,omitempty"`
	KubernetesGroups   []string `json:"groups,omitempty"`
}
type UserIdentity struct {
	UserARN string `json:"userarn,omitempty"`
	KubernetesIdentity
}
type RoleIdentity struct {
	RoleARN string `json:"rolearn,omitempty"`
	KubernetesIdentity
}