Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Fetch ¶
Fetch returns a credential for cfg.
When cfg names an app registration with a secret or certificate, that is used — it is the only way to authenticate into a tenant this process has no identity in, which is what reaching a vendor's registry requires.
Otherwise it falls back to the ambient identity via NewDefaultAzureCredential: on an Azure VM that is the identity assigned to the VM, and locally it is whatever you are logged in as. A nil cfg selects the ambient path, so callers with no credential to offer can keep passing nil. For more information, see: https://learn.microsoft.com/en-us/azure/developer/go/sdk/authentication/authentication-overview
Types ¶
type Config ¶
type Config struct {
ServicePrincipal *ServicePrincipalCredentials `` /* 160-byte string literal not displayed */
UseDefault bool `` /* 136-byte string literal not displayed */
// ManagedIdentityClientID runs the operation as a specific user-assigned
// managed identity instead of the VM's system identity.
ManagedIdentityClientID string `` /* 211-byte string literal not displayed */
// The fields below authenticate as an app registration in someone else's
// tenant — a vendor's registry, reached from a control plane that holds no
// identity there. Managed identity cannot cross a tenant boundary, so this
// is the only path for that case.
//
// They are deliberately unserializable. A Config travels inside plans and
// Temporal history; ClientSecret and ClientCertificatePEM are long-lived
// vendor credentials that must not. Resolve them, mint a short-lived
// registry token, and send that instead (see EnsureACRAuth). The blank
// tags are what make an accidental send drop the material rather than
// leak it.
TenantID string `cty:"-" hcl:"-" mapstructure:"-" json:"-" temporaljson:"-"`
ClientID string `cty:"-" hcl:"-" mapstructure:"-" json:"-" temporaljson:"-"`
ClientSecret string `cty:"-" hcl:"-" mapstructure:"-" json:"-" temporaljson:"-"`
ClientCertificatePEM []byte `cty:"-" hcl:"-" mapstructure:"-" json:"-" temporaljson:"-"`
}
func (Config) HasAppRegistrationCredentials ¶ added in v0.19.1153
HasAppRegistrationCredentials reports whether this config carries material for a specific app registration, as opposed to relying on whatever ambient identity the process happens to have.
Source Files