Repository: prometheus/prometheus
File: storage/remote/azuread/azuread.go (Go)

Code before:
	DefaultWorkloadIdentityTokenPath = "/var/run/secrets/azure/tokens/azure-identity-token"
)

// ManagedIdentityConfig is used to store managed identity config values.
type ManagedIdentityConfig struct {
	// ClientID is the clientId of the managed identity that is being used to authenticate.
	ClientID string `yaml:"client_id,omitempty"`
}

// WorkloadIdentityConfig is used to store workload identity config values.
type WorkloadIdentityConfig struct {
	// ClientID is the clientId of the Microsoft Entra application or user-assigned managed identity.
	// This should match the azure.workload.identity/client-id annotation on the Kubernetes service account.
	ClientID string `yaml:"client_id,omitempty"`

	// TenantID is the tenantId of the Microsoft Entra application or user-assigned managed identity.
	// This should match the tenant ID where your application or managed identity is registered.
	TenantID string `yaml:"tenant_id,omitempty"`

	// TokenFilePath is the path to the token file provided by the Kubernetes service account projected volume.
	// If not specified, it defaults to DefaultWorkloadIdentityTokenPath.
	//
	// Note: The token file is automatically mounted by the Azure Workload Identity webhook.
	// when the pod has the label azure.workload.identity/use: "true". This field only needs.
	// to be specified if you have a non-standard setup or the webhook is mounting the token.
	// in a custom location.
	TokenFilePath string `yaml:"token_file_path,omitempty"`
}

// OAuthConfig is used to store azure oauth config values.
type OAuthConfig struct {
	// ClientID is the clientId of the azure active directory application that is being used to authenticate.
	ClientID string `yaml:"client_id,omitempty"`

	// ClientSecret is the clientSecret of the azure active directory application that is being used to authenticate.
	ClientSecret string `yaml:"client_secret,omitempty"`

	// TenantID is the tenantId of the azure active directory application that is being used to authenticate.
	TenantID string `yaml:"tenant_id,omitempty"`
}

// SDKConfig is used to store azure SDK config values.
type SDKConfig struct {
	// TenantID is the tenantId of the azure active directory application that is being used to authenticate.
	TenantID string `yaml:"tenant_id,omitempty"`
}

// AzureADConfig is used to store the config values.
type AzureADConfig struct { //nolint:revive // exported.
	// ManagedIdentity is the managed identity that is being used to authenticate.
	ManagedIdentity *ManagedIdentityConfig `yaml:"managed_identity,omitempty"`

Review comment (suggestion):
I wonder if `If not specified, it defaults to DefaultWorkloadIdentityTokenPath.` statement is not enough here.
```suggestion
```

Code after:

// ManagedIdentityConfig is used to store managed identity config values.
type ManagedIdentityConfig struct {
	// ClientID is the clientId of the managed identity that is being used to authenticate.
	ClientID string `yaml:"client_id,omitempty"`
}

// WorkloadIdentityConfig is used to store workload identity config values.
type WorkloadIdentityConfig struct {
	// ClientID is the clientId of the Microsoft Entra application or user-assigned managed identity.
	ClientID string `yaml:"client_id,omitempty"`

	// TenantID is the tenantId of the Microsoft Entra application or user-assigned managed identity.
	// This should match the tenant ID where your application or managed identity is registered.
	TenantID string `yaml:"tenant_id,omitempty"`

	// TokenFilePath is the path to the token file provided by the Kubernetes service account projected volume.
	// If not specified, it defaults to DefaultWorkloadIdentityTokenPath.
	TokenFilePath string `yaml:"token_file_path,omitempty"`
}

// OAuthConfig is used to store azure oauth config values.
type OAuthConfig struct {
	// ClientID is the clientId of the azure active directory application that is being used to authenticate.
	ClientID string `yaml:"client_id,omitempty"`

	// ClientSecret is the clientSecret of the azure active directory application that is being used to authenticate.
	ClientSecret string `yaml:"client_secret,omitempty"`

	// TenantID is the tenantId of the azure active directory application that is being used to authenticate.
	TenantID string `yaml:"tenant_id,omitempty"`
}

// SDKConfig is used to store azure SDK config values.
type SDKConfig struct {
	// TenantID is the tenantId of the azure active directory application that is being used to authenticate.
	TenantID string `yaml:"tenant_id,omitempty"`
}

// AzureADConfig is used to store the config values.
type AzureADConfig struct { //nolint:revive // exported.
	// ManagedIdentity is the managed identity that is being used to authenticate.
	ManagedIdentity *ManagedIdentityConfig `yaml:"managed_identity,omitempty"`

	// WorkloadIdentity is the workload identity that is being used to authenticate.
	WorkloadIdentity *WorkloadIdentityConfig `yaml:"workload_identity,omitempty"`

	// OAuth is the oauth config that is being used to authenticate.
	OAuth *OAuthConfig `yaml:"oauth,omitempty"`

	// SDK is the SDK config that is being used to authenticate.