func verifyWorkloadIdentityParameters()

in internal/controller/utils.go [248:289]
34 lines of code
11 McCabe index (conditional complexity)

func verifyWorkloadIdentityParameters(workloadIdentity *acpv1.WorkloadIdentityParameters) error {
	if !strings.EqualFold(os.Getenv(WorkloadIdentityEnabled), "true") {
		return loader.NewArgumentError("auth.workloadIdentity", fmt.Errorf("workloadIdentity is not enabled"))
	}

	var authCount int = 0

	if workloadIdentity.ManagedIdentityClientId != nil {
		if strings.EqualFold(os.Getenv(WorkloadIdentityGlobalServiceAccountEnabled), "false") {
			return loader.NewArgumentError("auth.workloadIdentity.managedIdentityClientId", fmt.Errorf("using a global service account is no longer permitted with workload identity. See https://aka.ms/appconfig/k8sglobalserviceaccount for more information"))
		}
		authCount++
	}

	if workloadIdentity.ManagedIdentityClientIdReference != nil {
		if strings.EqualFold(os.Getenv(WorkloadIdentityGlobalServiceAccountEnabled), "false") {
			return loader.NewArgumentError("auth.workloadIdentity.managedIdentityClientIdReference", fmt.Errorf("using a global service account is no longer permitted with workload identity. See https://aka.ms/appconfig/k8sglobalserviceaccount for more information"))
		}
		authCount++
	}

	if workloadIdentity.ServiceAccountName != nil {
		authCount++
	}

	if authCount == 0 {
		return loader.NewArgumentError("auth.workloadIdentity", fmt.Errorf("setting one of 'managedIdentityClientId', 'managedIdentityClientIdReference' or 'serviceAccountName' field is required"))
	}

	if authCount > 1 {
		return loader.NewArgumentError("auth.workloadIdentity", fmt.Errorf("setting only one of 'managedIdentityClientId', 'managedIdentityClientIdReference' or 'serviceAccountName' field is allowed"))
	}

	if workloadIdentity.ManagedIdentityClientId != nil {
		_, err := uuid.Parse(*workloadIdentity.ManagedIdentityClientId)
		if err != nil {
			return loader.NewArgumentError("auth.workloadIdentity.managedIdentityClientId", fmt.Errorf("managedIdentityClientId %q in auth.workloadIdentity is not a valid uuid", *workloadIdentity.ManagedIdentityClientId))
		}
	}

	return nil
}