1/* 2Copyright The Kubernetes Authors. 3 4Licensed under the Apache License, Version 2.0 (the "License"); 5you may not use this file except in compliance with the License. 6You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10Unless required by applicable law or agreed to in writing, software 11distributed under the License is distributed on an "AS IS" BASIS, 12WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13See the License for the specific language governing permissions and 14limitations under the License. 15*/ 16 17 18// This file was autogenerated by go-to-protobuf. Do not edit it manually! 19 20syntax = "proto2"; 21 22package k8s.io.api.authentication.v1; 23 24import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto"; 25import "k8s.io/apimachinery/pkg/runtime/generated.proto"; 26import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto"; 27 28// Package-wide variables from generator "generated". 29option go_package = "v1"; 30 31// BoundObjectReference is a reference to an object that a token is bound to. 32message BoundObjectReference { 33 // Kind of the referent. Valid kinds are 'Pod' and 'Secret'. 34 // +optional 35 optional string kind = 1; 36 37 // API version of the referent. 38 // +optional 39 optional string apiVersion = 2; 40 41 // Name of the referent. 42 // +optional 43 optional string name = 3; 44 45 // UID of the referent. 46 // +optional 47 optional string uID = 4; 48} 49 50// ExtraValue masks the value so protobuf can generate 51// +protobuf.nullable=true 52// +protobuf.options.(gogoproto.goproto_stringer)=false 53message ExtraValue { 54 // items, if empty, will result in an empty slice 55 56 repeated string items = 1; 57} 58 59// TokenRequest requests a token for a given service account. 60message TokenRequest { 61 // +optional 62 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; 63 64 optional TokenRequestSpec spec = 2; 65 66 // +optional 67 optional TokenRequestStatus status = 3; 68} 69 70// TokenRequestSpec contains client provided parameters of a token request. 71message TokenRequestSpec { 72 // Audiences are the intendend audiences of the token. A recipient of a 73 // token must identitfy themself with an identifier in the list of 74 // audiences of the token, and otherwise should reject the token. A 75 // token issued for multiple audiences may be used to authenticate 76 // against any of the audiences listed but implies a high degree of 77 // trust between the target audiences. 78 repeated string audiences = 1; 79 80 // ExpirationSeconds is the requested duration of validity of the request. The 81 // token issuer may return a token with a different validity duration so a 82 // client needs to check the 'expiration' field in a response. 83 // +optional 84 optional int64 expirationSeconds = 4; 85 86 // BoundObjectRef is a reference to an object that the token will be bound to. 87 // The token will only be valid for as long as the bound object exists. 88 // NOTE: The API server's TokenReview endpoint will validate the 89 // BoundObjectRef, but other audiences may not. Keep ExpirationSeconds 90 // small if you want prompt revocation. 91 // +optional 92 optional BoundObjectReference boundObjectRef = 3; 93} 94 95// TokenRequestStatus is the result of a token request. 96message TokenRequestStatus { 97 // Token is the opaque bearer token. 98 optional string token = 1; 99 100 // ExpirationTimestamp is the time of expiration of the returned token. 101 optional k8s.io.apimachinery.pkg.apis.meta.v1.Time expirationTimestamp = 2; 102} 103 104// TokenReview attempts to authenticate a token to a known user. 105// Note: TokenReview requests may be cached by the webhook token authenticator 106// plugin in the kube-apiserver. 107message TokenReview { 108 // +optional 109 optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1; 110 111 // Spec holds information about the request being evaluated 112 optional TokenReviewSpec spec = 2; 113 114 // Status is filled in by the server and indicates whether the request can be authenticated. 115 // +optional 116 optional TokenReviewStatus status = 3; 117} 118 119// TokenReviewSpec is a description of the token authentication request. 120message TokenReviewSpec { 121 // Token is the opaque bearer token. 122 // +optional 123 optional string token = 1; 124 125 // Audiences is a list of the identifiers that the resource server presented 126 // with the token identifies as. Audience-aware token authenticators will 127 // verify that the token was intended for at least one of the audiences in 128 // this list. If no audiences are provided, the audience will default to the 129 // audience of the Kubernetes apiserver. 130 // +optional 131 repeated string audiences = 2; 132} 133 134// TokenReviewStatus is the result of the token authentication request. 135message TokenReviewStatus { 136 // Authenticated indicates that the token was associated with a known user. 137 // +optional 138 optional bool authenticated = 1; 139 140 // User is the UserInfo associated with the provided token. 141 // +optional 142 optional UserInfo user = 2; 143 144 // Audiences are audience identifiers chosen by the authenticator that are 145 // compatible with both the TokenReview and token. An identifier is any 146 // identifier in the intersection of the TokenReviewSpec audiences and the 147 // token's audiences. A client of the TokenReview API that sets the 148 // spec.audiences field should validate that a compatible audience identifier 149 // is returned in the status.audiences field to ensure that the TokenReview 150 // server is audience aware. If a TokenReview returns an empty 151 // status.audience field where status.authenticated is "true", the token is 152 // valid against the audience of the Kubernetes API server. 153 // +optional 154 repeated string audiences = 4; 155 156 // Error indicates that the token couldn't be checked 157 // +optional 158 optional string error = 3; 159} 160 161// UserInfo holds the information about the user needed to implement the 162// user.Info interface. 163message UserInfo { 164 // The name that uniquely identifies this user among all active users. 165 // +optional 166 optional string username = 1; 167 168 // A unique value that identifies this user across time. If this user is 169 // deleted and another user by the same name is added, they will have 170 // different UIDs. 171 // +optional 172 optional string uid = 2; 173 174 // The names of groups this user is a part of. 175 // +optional 176 repeated string groups = 3; 177 178 // Any additional information provided by the authenticator. 179 // +optional 180 map<string, ExtraValue> extra = 4; 181} 182 183