v1beta2

type AcrConfiguration struct {

	// Server is the FQDN for the Azure Container Registry, e.g. example.azurecr.io
	Server string `json:"server"`

	// Scope defines the scope for the access token, e.g. pull/push access for a repository.
	// Note: you need to pin it down to the repository level, there is no wildcard available,
	// however a list of space-delimited scopes is acceptable.
	// See docs for details: https://distribution.github.io/distribution/spec/auth/scope/
	//
	// Examples:
	// repository:my-repository:pull,push
	// repository:my-repository:pull repository:other-repository:push,pull
	Scope string `json:"scope"`

	// Environment specifies the Azure Cloud environment in which the ACR is deployed.
	Environment AzureEnvironmentType `json:"environment"`

	// AirgappedCloudConfiguration configures a custom cloud to interact with when running air-gapped.
	CloudConfig *AirgappedCloudConfiguration `json:"cloudConfig,omitempty"`
}

type AcrPullBinding struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AcrPullBindingSpec   `json:"spec,omitempty"`
	Status AcrPullBindingStatus `json:"status,omitempty"`
}

type AcrPullBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AcrPullBinding `json:"items"`
}

type AcrPullBindingSpec struct {

	// ACR holds specifics of the Azure Container Registry for which credentials are projected.
	ACR AcrConfiguration `json:"acr,omitempty"`

	// Auth determines how we will authenticate to the Azure Container Registry. Only one method may be provided.
	Auth AuthenticationMethod `json:"auth,omitempty"`

	// The name of the service account to associate the image pull secret with.
	ServiceAccountName string `json:"serviceAccountName,omitempty"`
}

type AcrPullBindingStatus struct {

	// Information when was the last time the ACR token was refreshed.
	LastTokenRefreshTime *metav1.Time `json:"lastTokenRefreshTime,omitempty"`

	// The expiration date of the current ACR token.
	TokenExpirationTime *metav1.Time `json:"tokenExpirationTime,omitempty"`

	// Error message if there was an error updating the token.
	Error string `json:"error,omitempty"`
}

type AirgappedCloudConfiguration struct {

	// EntraAuthorityHost configures a custom Entra host endpoint.
	EntraAuthorityHost string `json:"entraAuthorityHost"`

	// ResourceManagerAudience configures the audience for which tokens will be requested from Entra.
	ResourceManagerAudience string `json:"resourceManagerAudience"`
}

type AuthenticationMethod struct {

	// ManagedIdentity uses Azure Managed Identity to authenticate with Azure.
	ManagedIdentity *ManagedIdentityAuth `json:"managedIdentity,omitempty"`

	// WorkloadIdentity uses Azure Workload Identity to authenticate with Azure.
	WorkloadIdentity *WorkloadIdentityAuth `json:"workloadIdentity,omitempty"`
}

type AzureEnvironmentType string

type ManagedIdentityAuth struct {

	// ClientID is the client identifier for the managed identity. Either provide the client ID or the resource ID.
	ClientID string `json:"clientID,omitempty"`

	// ResourceID is the resource identifier for the managed identity. Either provide the client ID or the resource ID.
	ResourceID string `json:"resourceID,omitempty"`
}

type WorkloadIdentityAuth struct {

	// ServiceAccountName specifies the name of the service account
	// that should be used when authenticating with WorkloadIdentity.
	ServiceAccountName string `json:"serviceAccountRef,omitempty"`

	// ClientID holds an optional client identifier of a federated identity.
	// Specify this identifier if multiple identities are federated with the
	// service account and the identity to use for image pulling is not the
	// default identity stored in the service account's annotations. The
	// client and tenant ID must be specified together.
	ClientID string `json:"clientID,omitempty"`

	// TenantID holds an optional tenant identifier of a federated identity.
	// Specify this identifier if multiple identities are federated with the
	// service account and the identity to use for image pulling is not the
	// default identity stored in the service account's annotations. The
	// client and tenant ID must be specified together.
	TenantID string `json:"tenantID,omitempty"`
}