apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  # name must match the spec fields below, and be in the form: <plural>.<group>
  name: cloudserviceaccounts.k8s.groundstate.io
spec:
  # group name to use for REST API: /apis/<group>/<version>
  group: k8s.groundstate.io
  # list of versions supported by this CustomResourceDefinition
  versions:
    - name: v1alpha1
      # Each version can be enabled/disabled by Served flag.
      served: true
      # One and only one version must be marked as the storage version.
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          properties:
            spec:
              description: CloudServiceAccount is the Schema for the CloudSAP Operator
              type: object
              properties:
                cloudProvider:
                  description: Only "AWS" or "aws" is currently supported
                  type: string
                  pattern: '^(aws|AWS)$'
                  default: aws
                rolePolicyTemplate:
                  description: IAM Role policy as string; values may be templated
                  type: string
                policyTemplateValues:
                  x-kubernetes-preserve-unknown-fields: true
                  description: Object containing key/value substitutions for the policy template
                  type: object
                rolePolicyAttachments:
                  type: array
                  items:
                    type: string
                serviceAccountOptions:
                  description: Object containing extra ServiceAccount attributes
                  type: object
                  properties:
                    automountServiceAccountToken:
                      description: Indicates whether pods running as this service account should have an API token automatically mounted
                      type: boolean
                      default: true
                    imagePullSecrets:
                      description: List of references to secrets in the same namespace to use for pulling any images in pods that reference this ServiceAccount
                      type: array
                      items:
                        type: object
                        properties:
                          name:
                            type: string
            status:
              type: object
              properties:
                observed:
                  description: Last resourceVersion and generation observed by CloudSAP Operator. Retained for spec change comparisons.
                  type: object
                  properties:
                    resourceVersion:
                      type: string
                    generation:
                      type: integer
                serviceAccount:
                  description: Details of the ServiceAccount component resource being managed by CloudSAP Operator.
                  type: object
                  properties:
                    name:
                      type: string
                    creationTimestamp:
                      type: string
                    resourceVersion:
                      type: string
                    uid:
                      type: string
                iamRole:
                  description: Details of the IAM Role component resource being managed by CloudSAP Operator.
                  type: object
                  properties:
                    name:
                      type: string
                    digest:
                      type: string
      additionalPrinterColumns:
      - name: ServiceAccount
        type: string
        description: Name of the created ServiceAccount
        jsonPath: .status.serviceAccount.name
      - name: IAMRole
        type: string
        description: Name of the created IAM Role
        jsonPath: .status.iamRole.name
      - name: Age
        type: date
        jsonPath: .metadata.creationTimestamp
      # subresources describes the subresources for custom resources.
      subresources:
        # status enables the status subresource.
        status: {}
  scope: Namespaced
  names:
    # plural name to be used in the URL: /apis/<group>/<version>/<plural>
    plural: cloudserviceaccounts
    # singular name to be used as an alias on the CLI and for display
    singular: cloudserviceaccount
    # kind is normally the CamelCased singular type. Your resource manifests use this.
    kind: CloudServiceAccount
    # shortNames allow shorter string to match your resource on the CLI
    shortNames:
    - csa
