Repository: prometheus/prometheus
File: storage/remote/azuread/azuread.go (Go)

Code before:
	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/google/uuid"
	"github.com/grafana/regexp"
)

// Clouds.
const (
	AzureChina      = "AzureChina"
	AzureGovernment = "AzureGovernment"
	AzurePublic     = "AzurePublic"
)

// Audiences.
const (
	IngestionChinaAudience      = "https://monitor.azure.cn//.default"
	IngestionGovernmentAudience = "https://monitor.azure.us//.default"
	IngestionPublicAudience     = "https://monitor.azure.com//.default"
)

// Default paths.
const (
	// DefaultWorkloadIdentityTokenPath is the default path where the Azure Workload Identity.
	// webhook projects the service account token. This path is automatically configured.
	// by the webhook when a pod has the label azure.workload.identity/use: "true".
	DefaultWorkloadIdentityTokenPath = "/var/run/secrets/azure/tokens/azure-identity-token"
)

// ManagedIdentityConfig is used to store managed identity config values.
type ManagedIdentityConfig struct {
	// ClientID is the clientId of the managed identity that is being used to authenticate.
	ClientID string `yaml:"client_id,omitempty"`
}

// WorkloadIdentityConfig is used to store workload identity config values.
type WorkloadIdentityConfig struct {
	// ClientID is the clientId of the Microsoft Entra application or user-assigned managed identity.
	// This should match the azure.workload.identity/client-id annotation on the Kubernetes service account.
	ClientID string `yaml:"client_id,omitempty"`

	// TenantID is the tenantId of the Microsoft Entra application or user-assigned managed identity.
	// This should match the tenant ID where your application or managed identity is registered.
	TenantID string `yaml:"tenant_id,omitempty"`

	// TokenFilePath is the path to the token file provided by the Kubernetes service account projected volume.
	// If not specified, it defaults to DefaultWorkloadIdentityTokenPath.
	//
	// Note: The token file is automatically mounted by the Azure Workload Identity webhook.
	// when the pod has the label azure.workload.identity/use: "true". This field only needs.
	// to be specified if you have a non-standard setup or the webhook is mounting the token.
	// in a custom location.

Review comment (security):
I would recommend not explaining how Azure Workload Identity works exactly in Prometheus code; the moment it changes, no one will come back to fix the commentary (e.g. the fact that in Azure k8s some specific label behaviour is applicable). Can we make this as slim as possible and only document the things that code depends on (and link to Azure docs instead?)

```suggestion
	// DefaultWorkloadIdentityTokenPath is the default path where the Azure Workload Identity
	// webhook puts the service account token on Azure environments. See <azure docs link>.
	DefaultWorkloadIdentityTokenPath = "/var/run/secrets/azure/tokens/azure-identity-token"
```

Code after:
	"github.com/Azure/azure-sdk-for-go/sdk/azcore/policy"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/google/uuid"
	"github.com/grafana/regexp"
)

// Clouds.
const (
	AzureChina      = "AzureChina"
	AzureGovernment = "AzureGovernment"
	AzurePublic     = "AzurePublic"
)

// Audiences.
const (
	IngestionChinaAudience      = "https://monitor.azure.cn//.default"
	IngestionGovernmentAudience = "https://monitor.azure.us//.default"
	IngestionPublicAudience     = "https://monitor.azure.com//.default"
)

const (
	// DefaultWorkloadIdentityTokenPath is the default path where the Azure Workload Identity
	// webhook puts the service account token on Azure environments. See <azure docs link>.
	DefaultWorkloadIdentityTokenPath = "/var/run/secrets/azure/tokens/azure-identity-token"
)

// ManagedIdentityConfig is used to store managed identity config values.
type ManagedIdentityConfig struct {
	// ClientID is the clientId of the managed identity that is being used to authenticate.
	ClientID string `yaml:"client_id,omitempty"`
}

// WorkloadIdentityConfig is used to store workload identity config values.
type WorkloadIdentityConfig struct {
	// ClientID is the clientId of the Microsoft Entra application or user-assigned managed identity.
	ClientID string `yaml:"client_id,omitempty"`

	// TenantID is the tenantId of the Microsoft Entra application or user-assigned managed identity.
	// This should match the tenant ID where your application or managed identity is registered.
	TenantID string `yaml:"tenant_id,omitempty"`

	// TokenFilePath is the path to the token file provided by the Kubernetes service account projected volume.
	// If not specified, it defaults to DefaultWorkloadIdentityTokenPath.
	TokenFilePath string `yaml:"token_file_path,omitempty"`
}

// OAuthConfig is used to store azure oauth config values.
type OAuthConfig struct {
	// ClientID is the clientId of the azure active directory application that is being used to authenticate.
	ClientID string `yaml:"client_id,omitempty"`