1package v1
  2
  3import "cue.dev/x/k8s.io/apimachinery/pkg/apis/meta/v1"
  4
  5// BoundObjectReference is a reference to an object that a token
  6// is bound to.
  7#BoundObjectReference: {
  8	// apiVersion is API version of the referent.
  9	"apiVersion"?: string
 10
 11	// kind of the referent. Valid kinds are 'Pod' and 'Secret'.
 12	"kind"?: string
 13
 14	// name of the referent.
 15	"name"?: string
 16
 17	// uid of the referent.
 18	"uid"?: string
 19}
 20
 21// SelfSubjectReview contains the user information that the
 22// kube-apiserver has about the user making this request. When
 23// using impersonation, users will receive the user info of the
 24// user being impersonated. If impersonation or request header
 25// authentication is used, any extra keys will have their case
 26// ignored and returned as lowercase.
 27#SelfSubjectReview: {
 28	// APIVersion defines the versioned schema of this representation
 29	// of an object. Servers should convert recognized schemas to the
 30	// latest internal value, and may reject unrecognized values.
 31	// More info:
 32	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
 33	"apiVersion": "authentication.k8s.io/v1"
 34
 35	// Kind is a string value representing the REST resource this
 36	// object represents. Servers may infer this from the endpoint
 37	// the client submits requests to. Cannot be updated. In
 38	// CamelCase. More info:
 39	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 40	"kind": "SelfSubjectReview"
 41
 42	// metadata is standard object's metadata. More info:
 43	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 44	"metadata"?: v1.#ObjectMeta
 45
 46	// status is filled in by the server with the user attributes.
 47	"status"?: #SelfSubjectReviewStatus
 48}
 49
 50// SelfSubjectReviewStatus is filled by the kube-apiserver and
 51// sent back to a user.
 52#SelfSubjectReviewStatus: {
 53	// userInfo is a set of attributes belonging to the user making
 54	// this request.
 55	"userInfo"?: #UserInfo
 56}
 57
 58// TokenRequest requests a token for a given service account.
 59#TokenRequest: {
 60	// APIVersion defines the versioned schema of this representation
 61	// of an object. Servers should convert recognized schemas to the
 62	// latest internal value, and may reject unrecognized values.
 63	// More info:
 64	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
 65	"apiVersion": "authentication.k8s.io/v1"
 66
 67	// Kind is a string value representing the REST resource this
 68	// object represents. Servers may infer this from the endpoint
 69	// the client submits requests to. Cannot be updated. In
 70	// CamelCase. More info:
 71	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
 72	"kind": "TokenRequest"
 73
 74	// metadata is the standard object's metadata. More info:
 75	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
 76	"metadata"?: v1.#ObjectMeta
 77
 78	// spec holds information about the request being evaluated
 79	"spec"?: #TokenRequestSpec
 80
 81	// status is filled in by the server and indicates whether the
 82	// token can be authenticated.
 83	"status"?: #TokenRequestStatus
 84}
 85
 86// TokenRequestSpec contains client provided parameters of a token
 87// request.
 88#TokenRequestSpec: {
 89	// audiences are the intendend audiences of the token. A recipient
 90	// of a token must identify themself with an identifier in the
 91	// list of audiences of the token, and otherwise should reject
 92	// the token. A token issued for multiple audiences may be used
 93	// to authenticate against any of the audiences listed but
 94	// implies a high degree of trust between the target audiences.
 95	"audiences"?: [...string]
 96
 97	// boundObjectRef is a reference to an object that the token will
 98	// be bound to. The token will only be valid for as long as the
 99	// bound object exists. NOTE: The API server's TokenReview
100	// endpoint will validate the BoundObjectRef, but other audiences
101	// may not. Keep ExpirationSeconds small if you want prompt
102	// revocation.
103	"boundObjectRef"?: #BoundObjectReference
104
105	// expirationSeconds is the requested duration of validity of the
106	// request. The token issuer may return a token with a different
107	// validity duration so a client needs to check the 'expiration'
108	// field in a response.
109	"expirationSeconds"?: int64 & int
110}
111
112// TokenRequestStatus is the result of a token request.
113#TokenRequestStatus: {
114	// expirationTimestamp is the time of expiration of the returned
115	// token.
116	"expirationTimestamp"?: v1.#Time
117
118	// token is the opaque bearer token.
119	"token"?: string
120}
121
122// TokenReview attempts to authenticate a token to a known user.
123// Note: TokenReview requests may be cached by the webhook token
124// authenticator plugin in the kube-apiserver.
125#TokenReview: {
126	// APIVersion defines the versioned schema of this representation
127	// of an object. Servers should convert recognized schemas to the
128	// latest internal value, and may reject unrecognized values.
129	// More info:
130	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
131	"apiVersion": "authentication.k8s.io/v1"
132
133	// Kind is a string value representing the REST resource this
134	// object represents. Servers may infer this from the endpoint
135	// the client submits requests to. Cannot be updated. In
136	// CamelCase. More info:
137	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
138	"kind": "TokenReview"
139
140	// metadata is the standard object's metadata. More info:
141	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
142	"metadata"?: v1.#ObjectMeta
143
144	// spec holds information about the request being evaluated
145	"spec"!: #TokenReviewSpec
146
147	// status is filled in by the server and indicates whether the
148	// request can be authenticated.
149	"status"?: #TokenReviewStatus
150}
151
152// TokenReviewSpec is a description of the token authentication
153// request.
154#TokenReviewSpec: {
155	// audiences is a list of the identifiers that the resource server
156	// presented with the token identifies as. Audience-aware token
157	// authenticators will verify that the token was intended for at
158	// least one of the audiences in this list. If no audiences are
159	// provided, the audience will default to the audience of the
160	// Kubernetes apiserver.
161	"audiences"?: [...string]
162
163	// token is the opaque bearer token.
164	"token"!: string
165}
166
167// TokenReviewStatus is the result of the token authentication
168// request.
169#TokenReviewStatus: {
170	// audiences are audience identifiers chosen by the authenticator
171	// that are compatible with both the TokenReview and token. An
172	// identifier is any identifier in the intersection of the
173	// TokenReviewSpec audiences and the token's audiences. A client
174	// of the TokenReview API that sets the spec.audiences field
175	// should validate that a compatible audience identifier is
176	// returned in the status.audiences field to ensure that the
177	// TokenReview server is audience aware. If a TokenReview returns
178	// an empty status.audience field where status.authenticated is
179	// "true", the token is valid against the audience of the
180	// Kubernetes API server.
181	"audiences"?: [...string]
182
183	// authenticated indicates that the token was associated with a
184	// known user.
185	"authenticated"?: bool
186
187	// error indicates that the token couldn't be checked
188	"error"?: string
189
190	// user is the UserInfo associated with the provided token.
191	"user"?: #UserInfo
192}
193
194// UserInfo holds the information about the user needed to
195// implement the user.Info interface.
196#UserInfo: {
197	// extra is any additional information provided by the
198	// authenticator.
199	"extra"?: [string]: [...string]
200
201	// groups is the names of groups this user is a part of.
202	"groups"?: [...string]
203
204	// uid is a unique value that identifies this user across time. If
205	// this user is deleted and another user by the same name is
206	// added, they will have different UIDs.
207	"uid"?: string
208
209	// username is the name that uniquely identifies this user among
210	// all active users.
211	"username"?: string
212}