blob: db7be173ddfe8a07f0b8aec87de622838db1e3f3 [file] [log] [blame]
Matteo Scandoloa4285862020-12-01 18:10:10 -08001/*
2Copyright The Kubernetes Authors.
3
4Licensed under the Apache License, Version 2.0 (the "License");
5you may not use this file except in compliance with the License.
6You may obtain a copy of the License at
7
8 http://www.apache.org/licenses/LICENSE-2.0
9
10Unless required by applicable law or agreed to in writing, software
11distributed under the License is distributed on an "AS IS" BASIS,
12WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13See the License for the specific language governing permissions and
14limitations under the License.
15*/
16
17
18// This file was autogenerated by go-to-protobuf. Do not edit it manually!
19
20syntax = 'proto2';
21
22package k8s.io.api.authentication.v1;
23
24import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
25import "k8s.io/apimachinery/pkg/runtime/generated.proto";
26import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";
27
28// Package-wide variables from generator "generated".
29option go_package = "v1";
30
31// BoundObjectReference is a reference to an object that a token is bound to.
32message BoundObjectReference {
33 // Kind of the referent. Valid kinds are 'Pod' and 'Secret'.
34 // +optional
35 optional string kind = 1;
36
37 // API version of the referent.
38 // +optional
39 optional string aPIVersion = 2;
40
41 // Name of the referent.
42 // +optional
43 optional string name = 3;
44
45 // UID of the referent.
46 // +optional
47 optional string uID = 4;
48}
49
50// ExtraValue masks the value so protobuf can generate
51// +protobuf.nullable=true
52// +protobuf.options.(gogoproto.goproto_stringer)=false
53message ExtraValue {
54 // items, if empty, will result in an empty slice
55
56 repeated string items = 1;
57}
58
59// TokenRequest requests a token for a given service account.
60message TokenRequest {
61 // +optional
62 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
63
64 optional TokenRequestSpec spec = 2;
65
66 // +optional
67 optional TokenRequestStatus status = 3;
68}
69
70// TokenRequestSpec contains client provided parameters of a token request.
71message TokenRequestSpec {
72 // Audiences are the intendend audiences of the token. A recipient of a
73 // token must identitfy themself with an identifier in the list of
74 // audiences of the token, and otherwise should reject the token. A
75 // token issued for multiple audiences may be used to authenticate
76 // against any of the audiences listed but implies a high degree of
77 // trust between the target audiences.
78 repeated string audiences = 1;
79
80 // ExpirationSeconds is the requested duration of validity of the request. The
81 // token issuer may return a token with a different validity duration so a
82 // client needs to check the 'expiration' field in a response.
83 // +optional
84 optional int64 expirationSeconds = 4;
85
86 // BoundObjectRef is a reference to an object that the token will be bound to.
87 // The token will only be valid for as long as the bound object exists.
88 // NOTE: The API server's TokenReview endpoint will validate the
89 // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds
90 // small if you want prompt revocation.
91 // +optional
92 optional BoundObjectReference boundObjectRef = 3;
93}
94
95// TokenRequestStatus is the result of a token request.
96message TokenRequestStatus {
97 // Token is the opaque bearer token.
98 optional string token = 1;
99
100 // ExpirationTimestamp is the time of expiration of the returned token.
101 optional k8s.io.apimachinery.pkg.apis.meta.v1.Time expirationTimestamp = 2;
102}
103
104// TokenReview attempts to authenticate a token to a known user.
105// Note: TokenReview requests may be cached by the webhook token authenticator
106// plugin in the kube-apiserver.
107message TokenReview {
108 // +optional
109 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
110
111 // Spec holds information about the request being evaluated
112 optional TokenReviewSpec spec = 2;
113
114 // Status is filled in by the server and indicates whether the request can be authenticated.
115 // +optional
116 optional TokenReviewStatus status = 3;
117}
118
119// TokenReviewSpec is a description of the token authentication request.
120message TokenReviewSpec {
121 // Token is the opaque bearer token.
122 // +optional
123 optional string token = 1;
124
125 // Audiences is a list of the identifiers that the resource server presented
126 // with the token identifies as. Audience-aware token authenticators will
127 // verify that the token was intended for at least one of the audiences in
128 // this list. If no audiences are provided, the audience will default to the
129 // audience of the Kubernetes apiserver.
130 // +optional
131 repeated string audiences = 2;
132}
133
134// TokenReviewStatus is the result of the token authentication request.
135message TokenReviewStatus {
136 // Authenticated indicates that the token was associated with a known user.
137 // +optional
138 optional bool authenticated = 1;
139
140 // User is the UserInfo associated with the provided token.
141 // +optional
142 optional UserInfo user = 2;
143
144 // Audiences are audience identifiers chosen by the authenticator that are
145 // compatible with both the TokenReview and token. An identifier is any
146 // identifier in the intersection of the TokenReviewSpec audiences and the
147 // token's audiences. A client of the TokenReview API that sets the
148 // spec.audiences field should validate that a compatible audience identifier
149 // is returned in the status.audiences field to ensure that the TokenReview
150 // server is audience aware. If a TokenReview returns an empty
151 // status.audience field where status.authenticated is "true", the token is
152 // valid against the audience of the Kubernetes API server.
153 // +optional
154 repeated string audiences = 4;
155
156 // Error indicates that the token couldn't be checked
157 // +optional
158 optional string error = 3;
159}
160
161// UserInfo holds the information about the user needed to implement the
162// user.Info interface.
163message UserInfo {
164 // The name that uniquely identifies this user among all active users.
165 // +optional
166 optional string username = 1;
167
168 // A unique value that identifies this user across time. If this user is
169 // deleted and another user by the same name is added, they will have
170 // different UIDs.
171 // +optional
172 optional string uid = 2;
173
174 // The names of groups this user is a part of.
175 // +optional
176 repeated string groups = 3;
177
178 // Any additional information provided by the authenticator.
179 // +optional
180 map<string, ExtraValue> extra = 4;
181}
182