Skip to content

Commit 5829389

Browse files
gndrmnngndrmnn
committed
ApplicationCredential Type Declaration
On-behalf-of: SAP [email protected]
1 parent 2d5c9cd commit 5829389

1 file changed

Lines changed: 129 additions & 21 deletions

File tree

‎api/v1alpha1/applicationcredential_types.go‎

Lines changed: 129 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,42 @@ limitations under the License.
1616

1717
package v1alpha1
1818

19+
import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
20+
21+
// +kubebuilder:validation:Enum:=CONNECT;DELETE;GET;HEAD;OPTIONS;PATCH;POST;PUT;TRACE
22+
type HTTPMethod string
23+
24+
const (
25+
HTTPMethodCONNECT HTTPMethod = "CONNECT"
26+
HTTPMethodDELETE HTTPMethod = "DELETE"
27+
HTTPMethodGET HTTPMethod = "GET"
28+
HTTPMethodHEAD HTTPMethod = "HEAD"
29+
HTTPMethodOPTIONS HTTPMethod = "OPTIONS"
30+
HTTPMethodPATCH HTTPMethod = "PATCH"
31+
HTTPMethodPOST HTTPMethod = "POST"
32+
HTTPMethodPUT HTTPMethod = "PUT"
33+
HTTPMethodTRACE HTTPMethod = "TRACE"
34+
)
35+
36+
// ApplicationCredentialAccessRule defines an access rule
37+
// +kubebuilder:validation:MinProperties:=1
38+
type ApplicationCredentialAccessRule struct {
39+
// path that the application credential is permitted to access
40+
// +kubebuilder:validation:MaxLength=1024
41+
// +optional
42+
Path *string `json:"path,omitempty"`
43+
44+
// method that the application credential is permitted to use for a given API endpoint
45+
// +optional
46+
Method *HTTPMethod `json:"method,omitempty"`
47+
48+
// serviceRef identifier for the service that the application credential is permitted to access
49+
// +optional
50+
ServiceRef *KubernetesNameRef `json:"serviceRef,omitempty"`
51+
}
52+
1953
// ApplicationCredentialResourceSpec contains the desired state of the resource.
54+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ApplicationCredentialResourceSpec is immutable"
2055
type ApplicationCredentialResourceSpec struct {
2156
// name will be the name of the created resource. If not specified, the
2257
// name of the ORC object will be used.
@@ -31,38 +66,95 @@ type ApplicationCredentialResourceSpec struct {
3166

3267
// userRef is a reference to the ORC User which this resource is associated with.
3368
// +required
34-
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="userRef is immutable"
3569
UserRef KubernetesNameRef `json:"userRef,omitempty"`
3670

37-
// TODO(scaffolding): Add more types.
38-
// To see what is supported, you can take inspiration from the CreateOpts structure from
39-
// github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials
40-
//
41-
// Until you have implemented mutability for the field, you must add a CEL validation
42-
// preventing the field being modified:
43-
// `// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="<fieldname> is immutable"`
71+
// unrestricted is a flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts
72+
// +optional
73+
Unrestricted *bool `json:"unrestricted,omitempty"`
74+
75+
// secret used to authenticate against the API
76+
// +required
77+
Secret ApplicationCredentialSecretSpec `json:"secret,omitempty,omitzero"`
78+
79+
// roleRefs may only contain roles that the user has assigned on the project. If not provided, the roles assigned to the application credential will be the same as the roles in the current token.
80+
// +kubebuilder:validation:MaxItems:=256
81+
// +listType=atomic
82+
// +optional
83+
RoleRefs []KubernetesNameRef `json:"roleRefs,omitempty"`
84+
85+
// accessRules is a list of fine grained access control rules
86+
// +kubebuilder:validation:MaxItems:=256
87+
// +listType=atomic
88+
// +optional
89+
AccessRules []ApplicationCredentialAccessRule `json:"accessRules,omitempty"`
90+
91+
// expiresAt is the time of expiration for the application credential. If unset, the application credential does not expire.
92+
// +optional
93+
ExpiresAt *metav1.Time `json:"expiresAt,omitempty"`
4494
}
4595

46-
// ApplicationCredentialFilter defines an existing resource by its properties
4796
// +kubebuilder:validation:MinProperties:=1
97+
// +kubebuilder:validation:MaxProperties:=1
98+
type ApplicationCredentialSecretSpec struct {
99+
// secretRef is a reference to a Secret containing the application credential secret
100+
// +required
101+
SecretRef KubernetesNameRef `json:"secretRef,omitempty"`
102+
}
103+
104+
// ApplicationCredentialFilter defines an existing resource by its properties
105+
// +kubebuilder:validation:MinProperties:=2
48106
type ApplicationCredentialFilter struct {
107+
// userRef is a reference to the ORC User which this resource is associated with.
108+
// +required
109+
UserRef KubernetesNameRef `json:"userRef,omitempty"`
110+
49111
// name of the existing resource
50112
// +optional
51113
Name *OpenStackName `json:"name,omitempty"`
52114

53115
// description of the existing resource
54-
// +kubebuilder:validation:MinLength:=1
55-
// +kubebuilder:validation:MaxLength:=255
116+
// +kubebuilder:validation:MaxLength:=1024
56117
// +optional
57118
Description *string `json:"description,omitempty"`
119+
}
58120

59-
// userRef is a reference to the ORC User which this resource is associated with.
121+
type ApplicationCredentialRoleStatus struct {
122+
// name of an existing role
123+
// +kubebuilder:validation:MaxLength:=1024
60124
// +optional
61-
UserRef *KubernetesNameRef `json:"userRef,omitempty"`
125+
Name *string `json:"name,omitempty"`
62126

63-
// TODO(scaffolding): Add more types.
64-
// To see what is supported, you can take inspiration from the ListOpts structure from
65-
// github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials
127+
// id is the ID of a role
128+
// +kubebuilder:validation:MaxLength:=1024
129+
// +optional
130+
ID *string `json:"id,omitempty"`
131+
132+
// domainID of the domain of this role
133+
// +kubebuilder:validation:MaxLength:=1024
134+
// +optional
135+
DomainID *string `json:"domainID,omitempty"`
136+
}
137+
138+
type ApplicationCredentialAccessRuleStatus struct {
139+
// id is the ID of this access rule
140+
// +kubebuilder:validation:MaxLength:=1024
141+
// +optional
142+
ID *string `json:"id,omitempty"`
143+
144+
// path that the application credential is permitted to access
145+
// +kubebuilder:validation:MaxLength:=1024
146+
// +optional
147+
Path *string `json:"path,omitempty"`
148+
149+
// method that the application credential is permitted to use for a given API endpoint
150+
// +kubebuilder:validation:MaxLength=32
151+
// +optional
152+
Method *string `json:"method,omitempty"`
153+
154+
// service type identifier for the service that the application credential is permitted to access
155+
// +kubebuilder:validation:MaxLength:=1024
156+
// +optional
157+
Service *string `json:"service,omitempty"`
66158
}
67159

68160
// ApplicationCredentialResourceStatus represents the observed state of the resource.
@@ -77,12 +169,28 @@ type ApplicationCredentialResourceStatus struct {
77169
// +optional
78170
Description string `json:"description,omitempty"`
79171

80-
// userID is the ID of the User to which the resource is associated.
172+
// unrestricted is a flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts
173+
// +optional
174+
Unrestricted bool `json:"unrestricted,omitempty"`
175+
176+
// projectID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.
81177
// +kubebuilder:validation:MaxLength=1024
82178
// +optional
83-
UserID string `json:"userID,omitempty"`
179+
ProjectID string `json:"projectID,omitempty"`
180+
181+
// roles is a list of role objects may only contain roles that the user has assigned on the project
182+
// +kubebuilder:validation:MaxItems:=64
183+
// +listType=atomic
184+
// +optional
185+
Roles []ApplicationCredentialRoleStatus `json:"roles"`
84186

85-
// TODO(scaffolding): Add more types.
86-
// To see what is supported, you can take inspiration from the ApplicationCredential structure from
87-
// github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials
187+
// expiresAt is the time of expiration for the application credential. If unset, the application credential does not expire.
188+
// +optional
189+
ExpiresAt *metav1.Time `json:"expiresAt"`
190+
191+
// accessRules is a list of fine grained access control rules
192+
// +kubebuilder:validation:MaxItems:=64
193+
// +listType=atomic
194+
// +optional
195+
AccessRules []ApplicationCredentialAccessRuleStatus `json:"accessRules,omitempty"`
88196
}

0 commit comments

Comments
 (0)