in pkg/handler/handler.go [292:308]
func (m *Modifier) parsePodAnnotations(pod *corev1.Pod, serviceAccountTokenExpiration int64) (int64, map[string]bool) {
// override serviceaccount annotation/flag token expiration with pod
// annotation if present
tokenExpiration := serviceAccountTokenExpiration
expirationKey := m.AnnotationDomain + "/" + pkg.TokenExpirationAnnotation
if expirationStr, ok := pod.Annotations[expirationKey]; ok {
if expiration, err := strconv.ParseInt(expirationStr, 10, 64); err != nil {
klog.V(4).Infof("Found invalid value for token expiration, using %d seconds as default: %v", serviceAccountTokenExpiration, err)
} else {
tokenExpiration = pkg.ValidateMinTokenExpiration(expiration)
}
}
containersToSkip := getContainersToSkip(m.AnnotationDomain, pod)
return tokenExpiration, containersToSkip
}