apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: "azurekeyvaults.btungut.io"
spec:
  group: "btungut.io"
  scope: Cluster
  names:
    plural: "azurekeyvaults"
    singular: "azurekeyvault"
    kind: "AzureKeyVault"
    shortNames:
      - "akv"
      - "azurekv"
  versions:
    - name: v1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          description: "An Azure KeyVault reference which is responsible to sync its contents"
          properties:
            spec:
              type: object
              required: ["azureKeyVaultRef", "servicePrincipalRef", "managedSecrets"]
              properties:
                syncVersion:
                  type: integer
                  description: "Optional version value which is being tracked by operator to identify that whether secrets need to be updated or not"
                  minimum: 1
                  default: 1
                azureKeyVaultRef:
                  type: object
                  description: "Reference of Azure KeyVault resource"
                  required: ["name", "resourceGroup"]
                  properties:
                    name:
                      type: string
                      description: "Azure KeyVault resource name"
                    resourceGroup:
                      type: string
                      description: "Resource group which includes Azure KeyVault"
                servicePrincipalRef:
                  type: object
                  description: "Authorized service principal which is used against Azure APIs"
                  required: ["secretName", "secretNamespace","tenantIdField", "clientIdField", "clientSecretField"]
                  properties:
                    secretName:
                      type: string
                      description: "Secret name which includes service principal credentials"
                    secretNamespace:
                      type: string
                      description: "Secret namespace which includes service principal credentials."
                    tenantIdField:
                      type: string
                      description: "The data/field name that correspond to Tenant Id of Azure"
                    clientIdField:
                      type: string
                      description: "The data/field name that correspond to Client Id (app id) of service principal"
                    clientSecretField:
                      type: string
                      description: "The data/field name that correspond to Client Secret (password) of service principal"

                managedSecrets:
                  type: array
                  description:  "List of the secrets which is created and managed secrets by operator"
                  items:
                    type: object
                    required: ["name", "namespaces", "data"]
                    properties:
                      name:
                        type: string
                        description: "Name of the secret which is created"
                      namespaces:
                        type: array
                        description: "Namespaces regex pattern list of the secret which is created in"
                        items:
                          type: string
                          minimum: 1
                      type:
                        type: string
                        description: "Type of to secret (default : Opaque)"
                        pattern: "(^[Oo]paque$)|(^kubernetes.io/(service-account-token|dockercfg|dockerconfigjson|basic-auth|ssh-auth|tls)$)|(^bootstrap.kubernetes.io/token$)"
                        default: "Opaque"
                      data:
                        type: object
                        minimum: 1
                        additionalProperties:
                          type: string
                      labels:
                        type: object
                        additionalProperties:
                          type: string
                       
      additionalPrinterColumns:
        - name: "syncVersion"
          jsonPath: .spec.syncVersion
          type: integer
        - name: "serviceprincipal-secret-namespace"
          jsonPath: .spec.servicePrincipalRef.secretNamespace
          type: string
        - name: "serviceprincipal-secret-name"
          jsonPath: .spec.servicePrincipalRef.secretName
          type: string

