apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: authentications.operator.tigera.io
spec:
  group: operator.tigera.io
  names:
    kind: Authentication
    listKind: AuthenticationList
    plural: authentications
    singular: authentication
  scope: Cluster
  versions:
    - name: v1
      schema:
        openAPIV3Schema:
          description: Authentication is the Schema for the authentications API
          properties:
            apiVersion:
              description:
                "APIVersion defines the versioned schema of this representation
                of an object. Servers should convert recognized schemas to the latest
                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
              type: string
            kind:
              description:
                "Kind is a string value representing the REST resource this
                object represents. Servers may infer this from the endpoint the client
                submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
              type: string
            metadata:
              type: object
            spec:
              description: AuthenticationSpec defines the desired state of Authentication
              properties:
                groupsPrefix:
                  description:
                    If specified, GroupsPrefix is prepended to each group
                    obtained from the identity provider. Note that Kibana does not support
                    a groups prefix, so this prefix is removed from Kubernetes Groups
                    when translating log access ClusterRoleBindings into Elastic.
                  type: string
                ldap:
                  description:
                    LDAP contains the configuration needed to setup LDAP
                    authentication.
                  properties:
                    groupSearch:
                      description:
                        Group search configuration to find the groups that
                        a user is in.
                      properties:
                        baseDN:
                          description:
                            BaseDN to start the search from. For example
                            "cn=groups,dc=example,dc=com"
                          type: string
                        filter:
                          description:
                            Optional filter to apply when searching the directory.
                            For example "(objectClass=posixGroup)"
                          type: string
                        nameAttribute:
                          description:
                            The attribute of the group that represents its
                            name. This attribute can be used to apply RBAC to a user
                            group.
                          type: string
                        userMatchers:
                          description:
                            Following list contains field pairs that are
                            used to match a user to a group. It adds an additional requirement
                            to the filter that an attribute in the group must match
                            the user's attribute value.
                          items:
                            description:
                              UserMatch when the value of a UserAttribute
                              and a GroupAttribute match, a user belongs to the group.
                            properties:
                              groupAttribute:
                                description:
                                  The attribute of a group that links it
                                  to a user.
                                type: string
                              userAttribute:
                                description:
                                  The attribute of a user that links it to
                                  a group.
                                type: string
                            required:
                              - groupAttribute
                              - userAttribute
                            type: object
                          type: array
                      required:
                        - baseDN
                        - nameAttribute
                        - userMatchers
                      type: object
                    host:
                      description: "The host and port of the LDAP server. Example: ad.example.com:636"
                      type: string
                    startTLS:
                      description:
                        StartTLS whether to enable the startTLS feature for
                        establishing TLS on an existing LDAP session. If true, the ldap://
                        protocol is used and then issues a StartTLS command, otherwise,
                        connections will use the ldaps:// protocol.
                      type: boolean
                    userSearch:
                      description:
                        User entry search configuration to match the credentials
                        with a user.
                      properties:
                        baseDN:
                          description:
                            BaseDN to start the search from. For example
                            "cn=users,dc=example,dc=com"
                          type: string
                        filter:
                          description:
                            Optional filter to apply when searching the directory.
                            For example "(objectClass=person)"
                          type: string
                        nameAttribute:
                          description:
                            "A mapping of the attribute that is used as the
                            username. This attribute can be used to apply RBAC to a
                            user. Default: uid"
                          type: string
                      required:
                        - baseDN
                      type: object
                  required:
                    - host
                    - userSearch
                  type: object
                managerDomain:
                  description: ManagerDomain is the domain name of the Manager
                  type: string
                oidc:
                  description:
                    OIDC contains the configuration needed to setup OIDC
                    authentication.
                  properties:
                    emailVerification:
                      description:
                        'Some providers do not include the claim "email_verified"
                        when there is no verification in the user enrollment process
                        or if they are acting as a proxy for another identity provider.
                        By default those tokens are deemed invalid. To skip this check,
                        set the value to "InsecureSkip". Default: Verify'
                      enum:
                        - Verify
                        - InsecureSkip
                      type: string
                    groupsClaim:
                      description:
                        GroupsClaim specifies which claim to use from the
                        OIDC provider as the group.
                      type: string
                    groupsPrefix:
                      description:
                        Deprecated. Please use Authentication.Spec.GroupsPrefix
                        instead.
                      type: string
                    issuerURL:
                      description: IssuerURL is the URL to the OIDC provider.
                      type: string
                    promptTypes:
                      description:
                        'PromptTypes is an optional list of string values
                        that specifies whether the identity provider prompts the end
                        user for re-authentication and consent. See the RFC for more
                        information on prompt types: https://openid.net/specs/openid-connect-core-1_0.html.
                        Default: "Consent"'
                      items:
                        description:
                          "PromptType is a value that specifies whether the
                          identity provider prompts the end user for re-authentication
                          and consent. One of: None, Login, Consent, SelectAccount."
                        enum:
                          - None
                          - Login
                          - Consent
                          - SelectAccount
                        type: string
                      type: array
                    requestedScopes:
                      description:
                        'RequestedScopes is a list of scopes to request from
                        the OIDC provider. If not provided, the following scopes are
                        requested: ["openid", "email", "profile", "groups", "offline_access"].'
                      items:
                        type: string
                      type: array
                    type:
                      description: 'Default: "Dex"'
                      enum:
                        - Dex
                        - Tigera
                      type: string
                    usernameClaim:
                      description:
                        UsernameClaim specifies which claim to use from the
                        OIDC provider as the username.
                      type: string
                    usernamePrefix:
                      description:
                        Deprecated. Please use Authentication.Spec.UsernamePrefix
                        instead.
                      type: string
                  required:
                    - issuerURL
                    - usernameClaim
                  type: object
                openshift:
                  description:
                    Openshift contains the configuration needed to setup
                    Openshift OAuth authentication.
                  properties:
                    issuerURL:
                      description:
                        "IssuerURL is the URL to the Openshift OAuth provider.
                        Ex.: https://api.my-ocp-domain.com:6443"
                      type: string
                  required:
                    - issuerURL
                  type: object
                usernamePrefix:
                  description:
                    If specified, UsernamePrefix is prepended to each user
                    obtained from the identity provider. Note that Kibana does not support
                    a user prefix, so this prefix is removed from Kubernetes User when
                    translating log access ClusterRoleBindings into Elastic.
                  type: string
              type: object
            status:
              description: AuthenticationStatus defines the observed state of Authentication
              properties:
                state:
                  description: State provides user-readable status.
                  type: string
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}
