upd to secretstore type

hack/bicep-types-radius/generated/index.json

@@ -16,10 +16,10 @@
       "$ref": "applications/applications.core/2023-10-01-preview/types.json#/197"
     },
     "Applications.Core/secretStores@2023-10-01-preview": {
-      "$ref": "applications/applications.core/2023-10-01-preview/types.json#/226"
+      "$ref": "applications/applications.core/2023-10-01-preview/types.json#/232"
     },
     "Applications.Core/volumes@2023-10-01-preview": {
-      "$ref": "applications/applications.core/2023-10-01-preview/types.json#/263"
+      "$ref": "applications/applications.core/2023-10-01-preview/types.json#/269"
     },
     "Applications.Dapr/pubSubBrokers@2023-10-01-preview": {
       "$ref": "applications/applications.dapr/2023-10-01-preview/types.json#/44"

pkg/corerp/api/v20231001preview/secretstore_conversion.go

@@ -106,6 +106,12 @@ func toSecretStoreDataTypeDataModel(src *SecretStoreDataType) datamodel.SecretTy
 		return datamodel.SecretTypeGeneric
 	case SecretStoreDataTypeCertificate:
 		return datamodel.SecretTypeCert
+	case SecretStoreDataTypeBasicAuthentication:
+		return datamodel.SecretTypeBasicAuthentication
+	case SecretStoreDataTypeAzureWorkloadIdentity:
+		return datamodel.SecretTypeAzureWorkloadIdentity
+	case SecretStoreDataTypeAwsIRSA:
+		return datamodel.SecretTypeAWSIRSA
 	}
 
 	return datamodel.SecretTypeGeneric
@@ -117,6 +123,12 @@ func fromSecretStoreDataTypeDataModel(src datamodel.SecretType) *SecretStoreData
 		return to.Ptr(SecretStoreDataTypeGeneric)
 	case datamodel.SecretTypeCert:
 		return to.Ptr(SecretStoreDataTypeCertificate)
+	case datamodel.SecretTypeBasicAuthentication:
+		return to.Ptr(SecretStoreDataTypeBasicAuthentication)
+	case datamodel.SecretTypeAzureWorkloadIdentity:
+		return to.Ptr(SecretStoreDataTypeAzureWorkloadIdentity)
+	case datamodel.SecretTypeAWSIRSA:
+		return to.Ptr(SecretStoreDataTypeAwsIRSA)
 	}
 	return nil
 }

pkg/corerp/datamodel/secretstore.go

@@ -45,6 +45,12 @@ const (
 	SecretTypeGeneric SecretType = "generic"
 	// SecretTypeCert is the certificate secret type.
 	SecretTypeCert SecretType = "certificate"
+	// SecretTypeBasicAuthentication is the basicAuthentication secret type.
+	SecretTypeBasicAuthentication SecretType = "basicAuthentication"
+	// SecretTypeAzureWorkloadIdentity is the azureFederatedIdentity secret type.
+	SecretTypeAzureWorkloadIdentity SecretType = "azureWorkloadIdentity"
+	// SecretTypeAWSIRSA is the awsIRSA secret type.
+	SecretTypeAWSIRSA SecretType = "awsIRSA"
 )
 
 // SecretStore represents secret store resource.

pkg/corerp/frontend/controller/secretstores/kubernetes.go

@@ -46,6 +46,9 @@ func getOrDefaultType(t datamodel.SecretType) (datamodel.SecretType, error) {
 		t = datamodel.SecretTypeGeneric
 	case datamodel.SecretTypeCert:
 	case datamodel.SecretTypeGeneric:
+	case datamodel.SecretTypeBasicAuthentication:
+	case datamodel.SecretTypeAzureWorkloadIdentity:
+	case datamodel.SecretTypeAWSIRSA:
 	default:
 		err = fmt.Errorf("'%s' is invalid secret type", t)
 	}
@@ -75,8 +78,15 @@ func getOrDefaultEncoding(t datamodel.SecretType, e datamodel.SecretValueEncodin
 	return e, err
 }
 
+// Define a map of required keys for each SecretType
+var requiredKeys = map[datamodel.SecretType][]string{
+	datamodel.SecretTypeBasicAuthentication:   {RequiredUsername, RequiredPassword},
+	datamodel.SecretTypeAzureWorkloadIdentity: {RequiredClientId, RequiredTenantId},
+	datamodel.SecretTypeAWSIRSA:               {RequiredRoleARN},
+}
+
 // ValidateAndMutateRequest checks the type and encoding of the secret store, and ensures that the secret store data is
-// valid. If any of these checks fail, a BadRequestResponse is returned.
+// valid and required keys are present for the secret type. If any of these checks fail, a BadRequestResponse is returned.
 func ValidateAndMutateRequest(ctx context.Context, newResource *datamodel.SecretStore, oldResource *datamodel.SecretStore, options *controller.Options) (rest.Response, error) {
 	var err error
 	newResource.Properties.Type, err = getOrDefaultType(newResource.Properties.Type)
@@ -116,6 +126,15 @@ func ValidateAndMutateRequest(ctx context.Context, newResource *datamodel.Secret
 		}
 	}
 
+	// Validate that required keys for the secret type are present in the secret data
+	if keys, ok := requiredKeys[newResource.Properties.Type]; ok {
+		for _, key := range keys {
+			if _, ok := newResource.Properties.Data[key]; !ok {
+				return rest.NewBadRequestResponse(fmt.Sprintf("$.properties.data must contain '%s' key for %s type.", key, newResource.Properties.Type)), nil
+			}
+		}
+	}
+
 	return nil, nil
 }
 

pkg/corerp/frontend/controller/secretstores/kubernetes_test.go

@@ -51,6 +51,11 @@ const (
 	testFileGenericValueGlobalScope     = "secretstores_datamodel_global_scope.json"
 	testFileGenericValueInvalidResource = "secretstores_datamodel_global_scope_invalid_resource.json"
 	testFileGenericValueEmptyResource   = "secretstores_datamodel_global_scope_empty_resource.json"
+
+	testFileBasicAuthentication        = "secretstores_datamodel_basicAuthentication.json"
+	testFileBasicAuthenticationInvalid = "secretstores_datamodel_basicAuthentication_invalid.json"
+	testFileAWSIRSA                    = "secretstores_datamodel_AWSIRSA.json"
+	testFileAzureWorkloadIdentity      = "secretstores_datamodel_AZWorkloadIdentity.json"
 )
 
 func TestGetNamespace(t *testing.T) {
@@ -294,6 +299,46 @@ func TestValidateAndMutateRequest(t *testing.T) {
 		require.Nil(t, resp)
 		require.Equal(t, oldResource.Properties.Resource, newResource.Properties.Resource)
 	})
+
+	t.Run("new basicAuthentication resource", func(t *testing.T) {
+		newResource := testutil.MustGetTestData[datamodel.SecretStore](testFileBasicAuthentication)
+		resp, err := ValidateAndMutateRequest(context.TODO(), newResource, nil, nil)
+		require.NoError(t, err)
+
+		// assert
+		require.NoError(t, err)
+		require.Nil(t, resp)
+	})
+
+	t.Run("invalid basicAuthentication resource", func(t *testing.T) {
+		newResource := testutil.MustGetTestData[datamodel.SecretStore](testFileBasicAuthenticationInvalid)
+		resp, err := ValidateAndMutateRequest(context.TODO(), newResource, nil, nil)
+		require.NoError(t, err)
+
+		// assert
+		r := resp.(*rest.BadRequestResponse)
+		require.True(t, r.Body.Error.Message == "$.properties.data must contain 'password' key for basicAuthentication type.")
+	})
+
+	t.Run("new awsIRSA resource", func(t *testing.T) {
+		newResource := testutil.MustGetTestData[datamodel.SecretStore](testFileAWSIRSA)
+		resp, err := ValidateAndMutateRequest(context.TODO(), newResource, nil, nil)
+		require.NoError(t, err)
+
+		// assert
+		require.NoError(t, err)
+		require.Nil(t, resp)
+	})
+
+	t.Run("new azureWorkloadIdentity resource", func(t *testing.T) {
+		newResource := testutil.MustGetTestData[datamodel.SecretStore](testFileAzureWorkloadIdentity)
+		resp, err := ValidateAndMutateRequest(context.TODO(), newResource, nil, nil)
+		require.NoError(t, err)
+
+		// assert
+		require.NoError(t, err)
+		require.Nil(t, resp)
+	})
 }
 
 func TestUpsertSecret(t *testing.T) {

pkg/corerp/frontend/controller/secretstores/testdata/secretstores_datamodel_AWSIRSA.json

@@ -0,0 +1,29 @@
+{
+  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/secretStores/secret0",
+  "name": "secret0",
+  "type": "applications.core/secretstores",
+  "location": "global",
+  "systemData": {
+    "createdAt": "2022-03-22T18:54:52.6857175Z",
+    "createdBy": "[email protected]",
+    "createdByType": "User",
+    "lastModifiedAt": "2022-03-22T18:57:52.6857175Z",
+    "lastModifiedBy": "[email protected]",
+    "lastModifiedByType": "User"
+  },
+  "provisioningState": "Succeeded",
+  "properties": {
+    "application": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/applications/app0",
+    "type": "awsIRSA",
+    "data": {
+      "roleARN": {
+        "value": "test-role-arn"
+      }
+    }
+  },
+  "tenantId": "00000000-0000-0000-0000-000000000000",
+  "subscriptionId": "00000000-0000-0000-0000-000000000000",
+  "resourceGroup": "testGroup",
+  "createdApiVersion": "2023-10-01-preview",
+  "updatedApiVersion": "2023-10-01-preview"
+}

pkg/corerp/frontend/controller/secretstores/testdata/secretstores_datamodel_AZWorkloadIdentity.json

@@ -0,0 +1,32 @@
+{
+  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/secretStores/secret0",
+  "name": "secret0",
+  "type": "applications.core/secretstores",
+  "location": "global",
+  "systemData": {
+    "createdAt": "2022-03-22T18:54:52.6857175Z",
+    "createdBy": "[email protected]",
+    "createdByType": "User",
+    "lastModifiedAt": "2022-03-22T18:57:52.6857175Z",
+    "lastModifiedBy": "[email protected]",
+    "lastModifiedByType": "User"
+  },
+  "provisioningState": "Succeeded",
+  "properties": {
+    "application": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/applications/app0",
+    "type": "azureWorkloadIdentity",
+    "data": {
+      "clientId": {
+        "value": "test-client-Id"
+      },
+      "tenantId": {
+        "value": "test-tenant-Id"
+      }
+    }
+  },
+  "tenantId": "00000000-0000-0000-0000-000000000000",
+  "subscriptionId": "00000000-0000-0000-0000-000000000000",
+  "resourceGroup": "testGroup",
+  "createdApiVersion": "2023-10-01-preview",
+  "updatedApiVersion": "2023-10-01-preview"
+}

pkg/corerp/frontend/controller/secretstores/testdata/secretstores_datamodel_basicAuthentication.json

@@ -0,0 +1,32 @@
+{
+  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/secretStores/secret0",
+  "name": "secret0",
+  "type": "applications.core/secretstores",
+  "location": "global",
+  "systemData": {
+    "createdAt": "2022-03-22T18:54:52.6857175Z",
+    "createdBy": "[email protected]",
+    "createdByType": "User",
+    "lastModifiedAt": "2022-03-22T18:57:52.6857175Z",
+    "lastModifiedBy": "[email protected]",
+    "lastModifiedByType": "User"
+  },
+  "provisioningState": "Succeeded",
+  "properties": {
+    "application": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/applications/app0",
+    "type": "basicAuthentication",
+    "data": {
+      "username": {
+        "value": "uname123"
+      },
+      "password": {
+        "value": "testpwd-dGxzLmNlcnQK"
+      }
+    }
+  },
+  "tenantId": "00000000-0000-0000-0000-000000000000",
+  "subscriptionId": "00000000-0000-0000-0000-000000000000",
+  "resourceGroup": "testGroup",
+  "createdApiVersion": "2023-10-01-preview",
+  "updatedApiVersion": "2023-10-01-preview"
+}

pkg/corerp/frontend/controller/secretstores/testdata/secretstores_datamodel_basicAuthentication_invalid.json

@@ -0,0 +1,29 @@
+{
+  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/secretStores/secret0",
+  "name": "secret0",
+  "type": "applications.core/secretstores",
+  "location": "global",
+  "systemData": {
+    "createdAt": "2022-03-22T18:54:52.6857175Z",
+    "createdBy": "[email protected]",
+    "createdByType": "User",
+    "lastModifiedAt": "2022-03-22T18:57:52.6857175Z",
+    "lastModifiedBy": "[email protected]",
+    "lastModifiedByType": "User"
+  },
+  "provisioningState": "Succeeded",
+  "properties": {
+    "application": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/testGroup/providers/Applications.Core/applications/app0",
+    "type": "basicAuthentication",
+    "data": {
+      "username": {
+        "value": "uname123"
+      }
+    }
+  },
+  "tenantId": "00000000-0000-0000-0000-000000000000",
+  "subscriptionId": "00000000-0000-0000-0000-000000000000",
+  "resourceGroup": "testGroup",
+  "createdApiVersion": "2023-10-01-preview",
+  "updatedApiVersion": "2023-10-01-preview"
+}

pkg/corerp/frontend/controller/secretstores/types.go

@@ -19,4 +19,11 @@ package secretstores
 const (
 	// ResourceTypeName is the resource type name for secret stores.
 	ResourceTypeName = "Applications.Core/secretStores"
+
+	// The following are possible required keys in a SecretStore depending on it's SecretType
+	RequiredUsername = "username"
+	RequiredPassword = "password"
+	RequiredClientId = "clientId"
+	RequiredTenantId = "tenantId"
+	RequiredRoleARN  = "roleARN"
 )

swagger/specification/applications/resource-manager/Applications.Core/preview/2023-10-01-preview/openapi.json

@@ -4660,7 +4660,10 @@
       "description": "The type of SecretStore data",
       "enum": [
         "generic",
-        "certificate"
+        "certificate",
+        "basicAuthentication",
+        "azureWorkloadIdentity",
+        "awsIRSA"
       ],
       "x-ms-enum": {
         "name": "SecretStoreDataType",
@@ -4675,6 +4678,21 @@
             "name": "certificate",
             "value": "certificate",
             "description": "Certificate secret data type"
+          },
+          {
+            "name": "basicAuthentication",
+            "value": "basicAuthentication",
+            "description": "basicAuthentication type is used to represent username and password based authentication and the secretstore resource is expected to have the keys 'username' and 'password'."
+          },
+          {
+            "name": "azureWorkloadIdentity",
+            "value": "azureWorkloadIdentity",
+            "description": "azureWorkloadIdentity type is used to represent registry authentication using azure federated identity and the secretstore resource is expected to have the keys 'clientId' and 'tenantId'."
+          },
+          {
+            "name": "awsIRSA",
+            "value": "awsIRSA",
+            "description": "awsIRSA type is used to represent registry authentication using AWS IRSA(IAM Roles for Service accounts) and the secretstore resource is expected to have the keys 'roleARN'."
           }
         ]
       }

typespec/Applications.Core/secretstores.tsp

@@ -68,6 +68,15 @@ enum SecretStoreDataType {
 
   @doc("Certificate secret data type")
   certificate,
+
+  @doc("basicAuthentication type is used to represent username and password based authentication and the secretstore resource is expected to have the keys 'username' and 'password'.")
+   basicAuthentication,
+
+  @doc("azureWorkloadIdentity type is used to represent registry authentication using azure federated identity and the secretstore resource is expected to have the keys 'clientId' and 'tenantId'.")
+  azureWorkloadIdentity,
+
+  @doc("awsIRSA type is used to represent registry authentication using AWS IRSA(IAM Roles for Service accounts) and the secretstore resource is expected to have the keys 'roleARN'.")
+  awsIRSA,
 }
 
 @doc("The type of SecretValue Encoding")