github.com/Azure/aad-pod-identity@v1.8.17/pkg/apis/aadpodidentity/v1/types.go (about)

     1  package v1
     2  
     3  import (
     4  	api "k8s.io/api/core/v1"
     5  	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
     6  )
     7  
     8  const (
     9  	// CRDLabelKey is the
    10  	CRDLabelKey = "aadpodidbinding"
    11  
    12  	// BehaviorKey is the key that describes the behavior of aad-pod-identity.
    13  	// Supported values:
    14  	// namespaced - used for running in namespaced mode. AzureIdentity,
    15  	//              AzureIdentityBinding and pod in the same namespace
    16  	//              will only be matched for this behavior.
    17  	BehaviorKey = "aadpodidentity.k8s.io/Behavior"
    18  
    19  	// BehaviorNamespaced indicates that aad-pod-identity is behaving in namespaced mode.
    20  	BehaviorNamespaced = "namespaced"
    21  
    22  	// AssignedIDCreated indicates that an AzureAssignedIdentity is created.
    23  	AssignedIDCreated = "Created"
    24  
    25  	// AssignedIDAssigned indicates that an identity has been assigned to the node.
    26  	AssignedIDAssigned = "Assigned"
    27  
    28  	// AssignedIDUnAssigned indicates that an identity has been unassigned from the node.
    29  	AssignedIDUnAssigned = "Unassigned"
    30  )
    31  
    32  // AzureIdentity is the specification of the identity data structure.
    33  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
    34  // +kubebuilder:printcolumn:name="Type",type="string",JSONPath=".spec.type",description="",priority=0
    35  // +kubebuilder:printcolumn:name="ClientID",type="string",JSONPath=".spec.clientID",description="",priority=0
    36  // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC."
    37  type AzureIdentity struct {
    38  	metav1.TypeMeta   `json:",inline"`
    39  	metav1.ObjectMeta `json:"metadata,omitempty"`
    40  
    41  	Spec   AzureIdentitySpec   `json:"spec,omitempty"`
    42  	Status AzureIdentityStatus `json:"status,omitempty"`
    43  }
    44  
    45  // AzureIdentityBinding brings together the spec of matching pods and the identity which they can use.
    46  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
    47  // +kubebuilder:printcolumn:name="AzureIdentity",type="string",JSONPath=".spec.azureIdentity",description="",priority=0
    48  // +kubebuilder:printcolumn:name="Selector",type="string",JSONPath=".spec.selector",description="",priority=0
    49  // +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp",description="CreationTimestamp is a timestamp representing the server time when this object was created. It is not guaranteed to be set in happens-before order across separate operations. Clients may not set this value. It is represented in RFC3339 form and is in UTC."
    50  type AzureIdentityBinding struct {
    51  	metav1.TypeMeta   `json:",inline"`
    52  	metav1.ObjectMeta `json:"metadata,omitempty"`
    53  
    54  	Spec   AzureIdentityBindingSpec   `json:"spec,omitempty"`
    55  	Status AzureIdentityBindingStatus `json:"status,omitempty"`
    56  }
    57  
    58  // AzureAssignedIdentity contains the identity <-> pod mapping which is matched.
    59  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
    60  type AzureAssignedIdentity struct {
    61  	metav1.TypeMeta   `json:",inline"`
    62  	metav1.ObjectMeta `json:"metadata,omitempty"`
    63  
    64  	Spec   AzureAssignedIdentitySpec   `json:"spec,omitempty"`
    65  	Status AzureAssignedIdentityStatus `json:"status,omitempty"`
    66  }
    67  
    68  // AzurePodIdentityException contains the pod selectors for all pods that don't require
    69  // NMI to process and request token on their behalf.
    70  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
    71  type AzurePodIdentityException struct {
    72  	metav1.TypeMeta   `json:",inline"`
    73  	metav1.ObjectMeta `json:"metadata,omitempty"`
    74  
    75  	Spec   AzurePodIdentityExceptionSpec   `json:"spec,omitempty"`
    76  	Status AzurePodIdentityExceptionStatus `json:"status,omitempty"`
    77  }
    78  
    79  // AzureIdentityList contains a list of AzureIdentities.
    80  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
    81  type AzureIdentityList struct {
    82  	metav1.TypeMeta `json:",inline"`
    83  	metav1.ListMeta `json:"metadata,omitempty"`
    84  
    85  	Items []AzureIdentity `json:"items"`
    86  }
    87  
    88  // AzureIdentityBindingList contains a list of AzureIdentityBindings.
    89  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
    90  type AzureIdentityBindingList struct {
    91  	metav1.TypeMeta `json:",inline"`
    92  	metav1.ListMeta `json:"metadata,omitempty"`
    93  
    94  	Items []AzureIdentityBinding `json:"items"`
    95  }
    96  
    97  // AzureAssignedIdentityList contains a list of AzureAssignedIdentities.
    98  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
    99  type AzureAssignedIdentityList struct {
   100  	metav1.TypeMeta `json:",inline"`
   101  	metav1.ListMeta `json:"metadata,omitempty"`
   102  
   103  	Items []AzureAssignedIdentity `json:"items"`
   104  }
   105  
   106  // AzurePodIdentityExceptionList contains a list of AzurePodIdentityExceptions.
   107  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
   108  type AzurePodIdentityExceptionList struct {
   109  	metav1.TypeMeta `json:",inline"`
   110  	metav1.ListMeta `json:"metadata,omitempty"`
   111  
   112  	Items []AzurePodIdentityException `json:"items"`
   113  }
   114  
   115  // IdentityType represents different types of identities.
   116  // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
   117  type IdentityType int
   118  
   119  const (
   120  	// UserAssignedMSI represents a user-assigned identity.
   121  	UserAssignedMSI IdentityType = 0
   122  
   123  	// ServicePrincipal represents a service principal.
   124  	ServicePrincipal IdentityType = 1
   125  )
   126  
   127  // AzureIdentitySpec describes the credential specifications of an identity on Azure.
   128  type AzureIdentitySpec struct {
   129  	metav1.ObjectMeta `json:"metadata,omitempty"`
   130  	// UserAssignedMSI or Service Principal
   131  	Type IdentityType `json:"type,omitempty"`
   132  
   133  	// User assigned MSI resource id.
   134  	ResourceID string `json:"resourceID,omitempty"`
   135  	// Both User Assigned MSI and SP can use this field.
   136  	ClientID string `json:"clientID,omitempty"`
   137  
   138  	// Used for service principal
   139  	ClientPassword api.SecretReference `json:"clientPassword,omitempty"`
   140  	// Service principal primary tenant id.
   141  	TenantID string `json:"tenantID,omitempty"`
   142  	// Service principal auxiliary tenant ids
   143  	// +nullable
   144  	AuxiliaryTenantIDs []string `json:"auxiliaryTenantIDs,omitempty"`
   145  	// For service principal. Option param for specifying the  AD details.
   146  	ADResourceID string `json:"adResourceID,omitempty"`
   147  	ADEndpoint   string `json:"adEndpoint,omitempty"`
   148  
   149  	// +nullable
   150  	Replicas *int32 `json:"replicas,omitempty"`
   151  }
   152  
   153  // AzureIdentityStatus contains the replica status of the resource.
   154  type AzureIdentityStatus struct {
   155  	metav1.ObjectMeta `json:"metadata,omitempty"`
   156  	AvailableReplicas int32 `json:"availableReplicas,omitempty"`
   157  }
   158  
   159  // AssignedIDState represents the state of an AzureAssignedIdentity
   160  type AssignedIDState int
   161  
   162  const (
   163  	// Created - Default state of the assigned identity
   164  	Created AssignedIDState = 0
   165  
   166  	// Assigned - When the underlying platform assignment of
   167  	// managed identity is complete, the state moves to assigned
   168  	Assigned AssignedIDState = 1
   169  )
   170  
   171  const (
   172  	// AzureIDResource is the name of AzureIdentity.
   173  	AzureIDResource = "azureidentities"
   174  
   175  	// AzureIDBindingResource is the name of AzureIdentityBinding.
   176  	AzureIDBindingResource = "azureidentitybindings"
   177  
   178  	// AzureAssignedIDResource is the name of AzureAssignedIdentity.
   179  	AzureAssignedIDResource = "azureassignedidentities"
   180  
   181  	// AzurePodIdentityExceptionResource is the name of AzureIdentityException.
   182  	AzurePodIdentityExceptionResource = "azurepodidentityexceptions"
   183  )
   184  
   185  // AzureIdentityBindingSpec matches the pod with the Identity.
   186  // Used to indicate the potential matches to look for between the pod/deployment
   187  // and the identities present.
   188  type AzureIdentityBindingSpec struct {
   189  	metav1.ObjectMeta `json:"metadata,omitempty"`
   190  	AzureIdentity     string `json:"azureIdentity,omitempty"`
   191  	Selector          string `json:"selector,omitempty"`
   192  	// Weight is used to figure out which of the matching identities would be selected.
   193  	Weight int `json:"weight,omitempty"`
   194  }
   195  
   196  // AzureIdentityBindingStatus contains the status of an AzureIdentityBinding.
   197  type AzureIdentityBindingStatus struct {
   198  	metav1.ObjectMeta `json:"metadata,omitempty"`
   199  	AvailableReplicas int32 `json:"availableReplicas,omitempty"`
   200  }
   201  
   202  // AzureAssignedIdentitySpec contains the relationship
   203  // between an AzureIdentity and an AzureIdentityBinding.
   204  type AzureAssignedIdentitySpec struct {
   205  	metav1.ObjectMeta `json:"metadata,omitempty"`
   206  	// AzureIdentityRef is an embedded resource referencing the AzureIdentity used by the
   207  	// AzureAssignedIdentity, which requires x-kubernetes-embedded-resource fields to be true
   208  	// +kubebuilder:validation:XEmbeddedResource
   209  	AzureIdentityRef *AzureIdentity `json:"azureIdentityRef,omitempty"`
   210  
   211  	// AzureBindingRef is an embedded resource referencing the AzureIdentityBinding used by the
   212  	// AzureAssignedIdentity, which requires x-kubernetes-embedded-resource fields to be true
   213  	// +kubebuilder:validation:XEmbeddedResource
   214  	AzureBindingRef *AzureIdentityBinding `json:"azureBindingRef,omitempty"`
   215  	Pod             string                `json:"pod,omitempty"`
   216  	PodNamespace    string                `json:"podNamespace,omitempty"`
   217  	NodeName        string                `json:"nodename,omitempty"`
   218  
   219  	// +nullable
   220  	Replicas *int32 `json:"replicas,omitempty"`
   221  }
   222  
   223  // AzureAssignedIdentityStatus contains the replica status of the resource.
   224  type AzureAssignedIdentityStatus struct {
   225  	metav1.ObjectMeta `json:"metadata,omitempty"`
   226  	Status            string `json:"status,omitempty"`
   227  	AvailableReplicas int32  `json:"availableReplicas,omitempty"`
   228  }
   229  
   230  // AzurePodIdentityExceptionSpec matches pods with the selector defined.
   231  // If request originates from a pod that matches the selector, nmi will
   232  // proxy the request and send response back without any validation.
   233  type AzurePodIdentityExceptionSpec struct {
   234  	metav1.ObjectMeta `json:"metadata,omitempty"`
   235  	PodLabels         map[string]string `json:"podLabels,omitempty"`
   236  }
   237  
   238  // AzurePodIdentityExceptionStatus contains the status of an AzurePodIdentityException.
   239  type AzurePodIdentityExceptionStatus struct {
   240  	metav1.ObjectMeta `json:"metadata,omitempty"`
   241  	Status            string `json:"status,omitempty"`
   242  }