# Custom Resource Definition (CRD) for OSM's config specification.
#
# Copyright Open Service Mesh authors.
#
#    Licensed under the Apache License, Version 2.0 (the "License");
#    you may not use this file except in compliance with the License.
#    You may obtain a copy of the License at
#
#        http://www.apache.org/licenses/LICENSE-2.0
#
#    Unless required by applicable law or agreed to in writing, software
#    distributed under the License is distributed on an "AS IS" BASIS,
#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
#    See the License for the specific language governing permissions and
#    limitations under the License.
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: meshrootcertificates.config.openservicemesh.io
  labels:
    app.kubernetes.io/name : "openservicemesh.io"
spec:
  group: config.openservicemesh.io
  scope: Namespaced
  names:
    kind: MeshRootCertificate
    listKind: MeshRootCertificateList
    shortNames:
      - mrc
    singular: meshrootcertificate
    plural: meshrootcertificates
  versions:
    - name: v1alpha2
      served: true
      storage: true
      additionalPrinterColumns:
      - description: Current state of the MeshRootCertificate config
        jsonPath: .status.currentState
        name: State
        type: string
      - description: Current rotationStage of the MeshRootCertificate config
        jsonPath: .status.currentRotationStage
        name: RotationStage
        type: string
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              type: object
              required:
                - provider
              properties:
                provider:
                  description: Certificate provider used by the mesh control plane
                  type: object
                  properties:
                    certManager:
                      description: Cert-manager provider configuration
                      type: object
                      required:
                        - secretName
                        - issuerName
                        - issuerKind
                        - issuerGroup
                      properties:
                        secretName:
                          description: The name of the kubernetes secret containing the root certificate
                          type: string
                        issuerName:
                          description: The name of the Issuer or ClusterIssuer resource
                          type: string
                        issuerKind:
                          description: The kind of issuer resource
                          type: string
                          enum:
                            - ClusterIssuer
                            - Issuer
                        issuerGroup:
                          description: The group that the issuer belongs to
                          type: string
                    vault:
                      description: Vault provider configuration
                      type: object
                      required:
                        - host
                        - port
                        - role
                        - protocol
                        - token
                      properties:
                        host:
                          description: Host name for the Vault server
                          type: string
                        port:
                          description: Port for the Vault server
                          type: integer
                          minimum: 1
                          maximum: 65535
                        role:
                          description: Role created on Vault server for the mesh control plane
                          type: string
                        protocol:
                          description: Protocol for the Vault connection
                          type: string
                        token:
                          description: Token used by the mesh control plane
                          type: string
                    tresor:
                      description: Tresor provider configuration
                      type: object
                      required:
                        - secretName
                      properties:
                        secretName:
                          description: Name of the kubernetes secret storing the root certificate
                          type: string
                  oneOf:
                    - required: ['certManager']
                    - required: ['vault']
                    - required: ['tresor']
            status:
              type: object
              x-kubernetes-preserve-unknown-fields: true
      subresources:
        # status enables the status subresource
        status: {}
