Skip to content

Commit 8f8edca

Browse files
gndrmnngndrmnn
committed
WIP: Type declarations
1 parent 71347ba commit 8f8edca

1 file changed

Lines changed: 149 additions & 17 deletions

File tree

‎api/v1alpha1/applicationcredential_types.go‎

Lines changed: 149 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,54 @@ limitations under the License.
1616

1717
package v1alpha1
1818

19+
import metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
20+
21+
// +kubebuilder:validation:Enum:=CONNECT,DELETE,GET,HEAD,OPTIONS,PATCH,POST,PUT,TRACE
22+
type HTTPMethod string
23+
24+
const (
25+
HTTPMethodCONNECT HTTPMethod = "CONNECT"
26+
HTTPMethodDELETE HTTPMethod = "DELETE"
27+
HTTPMethodGET HTTPMethod = "GET"
28+
HTTPMethodHEAD HTTPMethod = "HEAD"
29+
HTTPMethodOPTIONS HTTPMethod = "OPTIONS"
30+
HTTPMethodPATCH HTTPMethod = "PATCH"
31+
HTTPMethodPOST HTTPMethod = "POST"
32+
HTTPMethodPUT HTTPMethod = "PUT"
33+
HTTPMethodTRACE HTTPMethod = "TRACE"
34+
)
35+
36+
// +kubebuilder:validation:MinProperties:=1
37+
// +kubebuilder:validation:MaxProperties:=1
38+
type ApplicationCredentialAccessRole struct {
39+
// name of an existing role
40+
// +optional
41+
Name *OpenStackName `json:"name,omitempty"`
42+
43+
// id is the ID of an role
44+
// +kubebuilder:validation:MaxLength=1024
45+
// +optional
46+
ID *string `json:"id,omitempty"`
47+
}
48+
49+
// ApplicationCredentialAccessRule defines an access rule
50+
// +kubebuilder:validation:MinProperties:=1
51+
type ApplicationCredentialAccessRule struct {
52+
// API path that the application credential is permitted to access
53+
// +kubebuilder:validation:MaxLength=1024
54+
// +optional
55+
Path *string `json:"path,omitempty"`
56+
57+
// request method that the application credential is permitted to use for a given API endpoint
58+
// +optional
59+
Method *HTTPMethod `json:"method,omitempty"`
60+
61+
// service type identifier for the service that the application credential is permitted to access
62+
// +kubebuilder:validation:MaxLength=1024
63+
// +optional
64+
Service *string `json:"service,omitempty"`
65+
}
66+
1967
// ApplicationCredentialResourceSpec contains the desired state of the resource.
2068
type ApplicationCredentialResourceSpec struct {
2169
// name will be the name of the created resource. If not specified, the
@@ -29,13 +77,41 @@ type ApplicationCredentialResourceSpec struct {
2977
// +optional
3078
Description *string `json:"description,omitempty"`
3179

32-
// TODO(scaffolding): Add more types.
33-
// To see what is supported, you can take inspiration from the CreateOpts structure from
34-
// github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials
35-
//
36-
// Until you have implemented mutability for the field, you must add a CEL validation
37-
// preventing the field being modified:
38-
// `// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="<fieldname> is immutable"`
80+
// ID of the user the application credential belongs to
81+
// TODO: Replace with UserRef when ORC has support for User objects
82+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="UserID is immutable"
83+
// +kubebuilder:validation:MaxLength=1024
84+
// +required
85+
UserID string `json:"userID"`
86+
87+
// flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts
88+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Unrestricted is immutable"
89+
// +optional
90+
Unrestricted *bool `json:"unrestricted,omitempty"`
91+
92+
// TODO: Add description
93+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Secret is immutable"
94+
// +optional
95+
Secret *string `json:"secret,omitempty"`
96+
97+
// list of role objects may only contain roles that the user has assigned on the project. If not provided, the roles assigned to the application credential will be the same as the roles in the current token.
98+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Roles is immutable"
99+
// +kubebuilder:validation:MaxItems:=256
100+
// +listType=atomic
101+
// +optional
102+
Roles []ApplicationCredentialAccessRole `json:"roles,omitempty"`
103+
104+
// list of fine grained access control rules
105+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Rules is immutable"
106+
// +kubebuilder:validation:MaxItems:=256
107+
// +listType=atomic
108+
// +optional
109+
Rules []ApplicationCredentialAccessRule `json:"access_rules,omitempty"`
110+
111+
// expiry time for the application credential. If unset, the application credential does not expire.
112+
// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ExpiresAt is immutable"
113+
// +optional
114+
ExpiresAt *metav1.Time `json:"expires_at,omitempty"`
39115
}
40116

41117
// ApplicationCredentialFilter defines an existing resource by its properties
@@ -45,19 +121,50 @@ type ApplicationCredentialFilter struct {
45121
// +optional
46122
Name *OpenStackName `json:"name,omitempty"`
47123

48-
// description of the existing resource
49-
// +kubebuilder:validation:MinLength:=1
50-
// +kubebuilder:validation:MaxLength:=255
124+
// ID of the user the application credential belongs to
125+
// +required
126+
UserID string `json:"userID"`
127+
}
128+
129+
type ApplicationCredentialAccessRoleStatus struct {
130+
// name of an existing role
51131
// +optional
52-
Description *string `json:"description,omitempty"`
132+
Name *string `json:"name,omitempty"`
53133

54-
// TODO(scaffolding): Add more types.
55-
// To see what is supported, you can take inspiration from the ListOpts structure from
56-
// github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials
134+
// id is the ID of an role
135+
// +optional
136+
ID *string `json:"id,omitempty"`
137+
138+
// id of the domain of this role
139+
// +optional
140+
DomainID *string `json:"domain_id,omitempty"`
141+
}
142+
143+
type ApplicationCredentialAccessRuleStatus struct {
144+
// id is the ID of this access rule
145+
// +optional
146+
ID *string `json:"id,omitempty"`
147+
148+
// API path that the application credential is permitted to access
149+
// +optional
150+
Path *string `json:"path,omitempty"`
151+
152+
// request method that the application credential is permitted to use for a given API endpoint
153+
// +optional
154+
Method *string `json:"method,omitempty"`
155+
156+
// service type identifier for the service that the application credential is permitted to access
157+
// +optional
158+
Service *string `json:"service,omitempty"`
57159
}
58160

59161
// ApplicationCredentialResourceStatus represents the observed state of the resource.
60162
type ApplicationCredentialResourceStatus struct {
163+
// id is the ID of the application credential.
164+
// +kubebuilder:validation:MaxLength=1024
165+
// +optional
166+
ID string `json:"id,omitempty"`
167+
61168
// name is a Human-readable name for the resource. Might not be unique.
62169
// +kubebuilder:validation:MaxLength=1024
63170
// +optional
@@ -68,7 +175,32 @@ type ApplicationCredentialResourceStatus struct {
68175
// +optional
69176
Description string `json:"description,omitempty"`
70177

71-
// TODO(scaffolding): Add more types.
72-
// To see what is supported, you can take inspiration from the ApplicationCredential structure from
73-
// github.com/gophercloud/gophercloud/v2/openstack/identity/v3/applicationcredentials
178+
// flag indicating whether the application credential may be used for creation or destruction of other application credentials or trusts
179+
// +optional
180+
Unrestricted bool `json:"unrestricted,omitempty"`
181+
182+
// TODO: Add description
183+
// +optional
184+
Secret string `json:"secret,omitempty"`
185+
186+
// ID of the project the application credential was created for and that authentication requests using this application credential will be scoped to.
187+
// +kubebuilder:validation:MaxLength=1024
188+
// +optional
189+
ProjectID string `json:"projectID,omitempty"`
190+
191+
// list of role objects may only contain roles that the user has assigned on the project
192+
// +optional
193+
Roles []ApplicationCredentialAccessRoleStatus `json:"roles"`
194+
195+
// expiry time for the application credential
196+
// +optional
197+
ExpiresAt *metav1.Time `json:"expires_at"`
198+
199+
// list of fine grained access control rules
200+
// +optional
201+
AccessRules []ApplicationCredentialAccessRuleStatus `json:"access_rules,omitempty"`
202+
203+
// Links contains referencing links to the application credential
204+
// +optional
205+
Links map[string]string `json:"links"`
74206
}

0 commit comments

Comments
 (0)