(feat) Add workload identity support

api/v1beta1/sveltoscluster_type.go

@@ -17,6 +17,7 @@ limitations under the License.
 package v1beta1
 
 import (
+	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	runtime "k8s.io/apimachinery/pkg/runtime"
 )
@@ -105,7 +106,117 @@ type TokenRequestRenewalOption struct {
 	KubeconfigKeyName *string `json:"kubeconfigKeyName,omitempty"`
 }
 
+// WorkloadIdentityProvider identifies the cloud provider for workload identity.
+// +kubebuilder:validation:Enum=AWS;GCP;Azure
+type WorkloadIdentityProvider string
+
+const (
+	WorkloadIdentityProviderAWS   WorkloadIdentityProvider = "AWS"
+	WorkloadIdentityProviderGCP   WorkloadIdentityProvider = "GCP"
+	WorkloadIdentityProviderAzure WorkloadIdentityProvider = "Azure"
+)
+
+// AWSWorkloadIdentityConfig holds AWS-specific workload identity configuration.
+type AWSWorkloadIdentityConfig struct {
+	// ClusterName is the name of the EKS cluster. Required: it is embedded in
+	// the bearer token header (x-k8s-aws-id) sent to the EKS API server.
+	// +kubebuilder:validation:MinLength=1
+	ClusterName string `json:"clusterName"`
+
+	// RoleARN is the ARN of the IAM role Sveltos should assume before generating
+	// the EKS bearer token. If empty, the pod's own IRSA credentials are used directly.
+	// +optional
+	RoleARN string `json:"roleARN,omitempty"`
+
+	// Region is the AWS region of the EKS cluster. If empty, the AWS_REGION
+	// environment variable injected by IRSA is used.
+	// +optional
+	Region string `json:"region,omitempty"`
+}
+
+// GCPWorkloadIdentityConfig holds GCP-specific workload identity configuration.
+// Fields are kept for future auto-discovery support; the current implementation
+// obtains tokens via Application Default Credentials without calling the GKE API.
+type GCPWorkloadIdentityConfig struct {
+	// ProjectID is the GCP project ID that contains the GKE cluster.
+	// +kubebuilder:validation:MinLength=1
+	ProjectID string `json:"projectID"`
+
+	// ClusterName is the name of the GKE cluster.
+	// +kubebuilder:validation:MinLength=1
+	ClusterName string `json:"clusterName"`
+
+	// Location is the GCP region or zone of the GKE cluster (e.g. "us-central1").
+	// +kubebuilder:validation:MinLength=1
+	Location string `json:"location"`
+}
+
+// AzureWorkloadIdentityConfig holds Azure-specific workload identity configuration.
+type AzureWorkloadIdentityConfig struct {
+	// TenantID is the Azure Active Directory tenant ID.
+	// +kubebuilder:validation:MinLength=1
+	TenantID string `json:"tenantID"`
+
+	// ClientID is the client ID of the managed identity or app registration
+	// federated with the management cluster service account.
+	// +kubebuilder:validation:MinLength=1
+	ClientID string `json:"clientID"`
+
+	// SubscriptionID is the Azure subscription containing the AKS cluster.
+	// Kept for future auto-discovery support.
+	// +optional
+	SubscriptionID string `json:"subscriptionID,omitempty"`
+
+	// ResourceGroup is the Azure resource group containing the AKS cluster.
+	// Kept for future auto-discovery support.
+	// +optional
+	ResourceGroup string `json:"resourceGroup,omitempty"`
+
+	// ClusterName is the name of the AKS cluster.
+	// Kept for future auto-discovery support.
+	// +optional
+	ClusterName string `json:"clusterName,omitempty"`
+}
+
+// WorkloadIdentityConfig specifies how Sveltos authenticates to the managed
+// cluster using the cloud provider's workload identity mechanism instead of a
+// static kubeconfig Secret.
+// +kubebuilder:validation:XValidation:rule="(self.provider == 'AWS') == has(self.aws)",message="aws must be set if and only if provider is AWS"
+// +kubebuilder:validation:XValidation:rule="(self.provider == 'GCP') == has(self.gcp)",message="gcp must be set if and only if provider is GCP"
+// +kubebuilder:validation:XValidation:rule="(self.provider == 'Azure') == has(self.azure)",message="azure must be set if and only if provider is Azure"
+type WorkloadIdentityConfig struct {
+	// Provider is the cloud provider implementing the workload identity mechanism.
+	// +kubebuilder:validation:Required
+	Provider WorkloadIdentityProvider `json:"provider"`
+
+	// Endpoint is the API server endpoint of the managed cluster (e.g. https://…).
+	// +kubebuilder:validation:MinLength=1
+	Endpoint string `json:"endpoint"`
+
+	// CASecretRef references a Secret in the management cluster containing the
+	// CA certificate of the managed cluster's API server under the key "ca.crt".
+	// If not set, the system certificate pool is used.
+	// +optional
+	CASecretRef *corev1.LocalObjectReference `json:"caSecretRef,omitempty"`
+
+	// AWS contains configuration specific to AWS IRSA / EKS Pod Identity.
+	// Required when Provider is AWS.
+	// +optional
+	AWS *AWSWorkloadIdentityConfig `json:"aws,omitempty"`
+
+	// GCP contains configuration specific to GCP Workload Identity Federation.
+	// Required when Provider is GCP.
+	// +optional
+	GCP *GCPWorkloadIdentityConfig `json:"gcp,omitempty"`
+
+	// Azure contains configuration specific to Azure Workload Identity.
+	// Required when Provider is Azure.
+	// +optional
+	Azure *AzureWorkloadIdentityConfig `json:"azure,omitempty"`
+}
+
 // SveltosClusterSpec defines the desired state of SveltosCluster
+// +kubebuilder:validation:XValidation:rule="!has(self.workloadIdentity) || !has(self.kubeconfigName)",message="workloadIdentity, kubeconfigName: conflict"
 type SveltosClusterSpec struct {
 	// KubeconfigName allows overriding the default Sveltos convention which expected a valid kubeconfig
 	// to be hosted in a secret with the pattern ${sveltosClusterName}-sveltos-kubeconfig.
@@ -161,6 +272,14 @@ type SveltosClusterSpec struct {
 	// +kubebuilder:default:=false
 	// +optional
 	PullMode bool `json:"pullMode,omitempty"`
+
+	// WorkloadIdentity configures authentication to the managed cluster via the
+	// cloud provider's workload identity mechanism. When set, Sveltos does not
+	// read a kubeconfig Secret; instead it obtains short-lived credentials from
+	// the cloud provider at runtime.
+	// Mutually exclusive with KubeconfigName/KubeconfigKeyName.
+	// +optional
+	WorkloadIdentity *WorkloadIdentityConfig `json:"workloadIdentity,omitempty"`
 }
 
 // SveltosClusterStatus defines the status of SveltosCluster