# Copyright 2022 TriggerMesh Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: awss3sources.sources.triggermesh.io
  labels:
    eventing.knative.dev/source: 'true'
    duck.knative.dev/source: 'true'
    knative.dev/crd-install: 'true'
    triggermesh.io/crd-install: 'true'
  annotations:
    registry.knative.dev/eventTypes: |
      [
        { "type": "com.amazon.s3.objectcreated" },
        { "type": "com.amazon.s3.objectremoved" },
        { "type": "com.amazon.s3.objectrestore" },
        { "type": "com.amazon.s3.reducedredundancylostobject" },
        { "type": "com.amazon.s3.replication" },
        { "type": "com.amazon.s3.testevent" }
      ]
spec:
  group: sources.triggermesh.io
  scope: Namespaced
  names:
    kind: AWSS3Source
    plural: awss3sources
    categories:
    - all
    - knative
    - eventing
    - sources
  versions:
  - name: v1alpha1
    served: true
    storage: true
    subresources:
      status: {}
    schema:
      openAPIV3Schema:
        description: TriggerMesh event source for Amazon S3.
        type: object
        properties:
          spec:
            description: Desired state of the event source.
            type: object
            properties:
              adapterOverrides:
                description: Kubernetes object parameters to apply on top of default adapter values.
                type: object
                properties:
                  resources:
                    description: 'Compute Resources required by the adapter. More info:
                      https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                    type: object
                    properties:
                      limits:
                        additionalProperties:
                          anyOf:
                          - type: integer
                          - type: string
                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                          x-kubernetes-int-or-string: true
                        description: 'Limits describes the maximum amount of compute resources allowed. More info:
                          https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                        type: object
                      requests:
                        additionalProperties:
                          anyOf:
                          - type: integer
                          - type: string
                          pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                          x-kubernetes-int-or-string: true
                        description: 'Requests describes the minimum amount of compute resources required.
                          If Requests is omitted for a container, it defaults to Limits if that is explicitly
                          specified, otherwise to an implementation-defined value. More info:
                          https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/'
                        type: object
                  tolerations:
                    description: Pod tolerations, as documented at
                      https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
                    type: array
                    items:
                      type: object
                      properties:
                        key:
                          description: Taint key that the toleration applies to.
                          type: string
                        operator:
                          description: Key's relationship to the value.
                          type: string
                          enum: [Exists, Equal]
                        value:
                          description: Taint value the toleration matches to.
                          type: string
                        effect:
                          description: Taint effect to match.
                          type: string
                          enum: [NoSchedule, PreferNoSchedule, NoExecute]
                        tolerationSeconds:
                          description: Period of time a toleration of effect NoExecute tolerates the taint.
                          type: integer
                          format: int64
              arn:
                description: |-
                  ARN of the Amazon S3 bucket to receive notifications from. The expected format is documented at
                  https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html#amazons3-resources-for-iam-policies.

                  Although not technically supported by S3, the ARN provided via this attribute may include a region and
                  an account ID. When this information is provided, it is used to set an accurate identity-based access
                  policy between the S3 bucket and the reconciled SQS queue, unless an existing queue is provided via
                  the 'destination.sqs.queueARN' attribute.
                type: string
                # Bucket naming rules
                # https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucketnamingrules.html
                pattern: ^arn:aws(-cn|-us-gov)?:s3:([a-z]{2}(-gov)?-[a-z]+-\d)?:(\d{12})?:[0-9a-z][0-9a-z.-]{2,62}$
              eventTypes:
                description: List of event types that the source should subscribe to. Accepted values are listed at
                  https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html.
                type: array
                items:
                  type: string
                  enum:
                  - s3:ObjectCreated:*
                  - s3:ObjectCreated:Put
                  - s3:ObjectCreated:Post
                  - s3:ObjectCreated:Copy
                  - s3:ObjectCreated:CompleteMultipartUpload
                  - s3:ObjectRemoved:*
                  - s3:ObjectRemoved:Delete
                  - s3:ObjectRemoved:DeleteMarkerCreated
                  - s3:ObjectRestore:*
                  - s3:ObjectRestore:Post
                  - s3:ObjectRestore:Completed
                  - s3:ReducedRedundancyLostObject
                  - s3:Replication:*
                  - s3:Replication:OperationFailedReplication
                  - s3:Replication:OperationNotTracked
                  - s3:Replication:OperationMissedThreshold
                  - s3:Replication:OperationReplicatedAfterThreshold
              destination:
                description: The destination of notifications originating from the Amazon S3 bucket. If omitted, an
                  Amazon SQS queue is automatically created and associated with the bucket.
                type: object
                properties:
                  sqs:
                    description: Properties of an Amazon SQS queue to use as destination for bucket notifications.
                    type: object
                    properties:
                      queueARN:
                        description: ARN of the Amazon SQS queue that should be receiving bucket notifications. The
                          expected format is documented at
                          https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonsqs.html#amazonsqs-resources-for-iam-policies.
                        type: string
                        pattern: ^arn:aws(-cn|-us-gov)?:sqs:[a-z]{2}(-gov)?-[a-z]+-\d:\d{12}:.+$
                    required:
                    - queueARN
              auth:
                description: Authentication method to interact with the Amazon S3 and SQS APIs.
                type: object
                properties:
                  credentials:
                    description: Security credentials authentication. For more information about AWS security
                      credentials, please refer to the AWS General Reference at
                      https://docs.aws.amazon.com/general/latest/gr/aws-security-credentials.html.
                    type: object
                    properties:
                      accessKeyID:
                        description: Access key ID.
                        type: object
                        properties:
                          value:
                            description: Literal value of the access key ID.
                            type: string
                          valueFromSecret:
                            description: A reference to a Kubernetes Secret object containing the access key ID.
                            type: object
                            properties:
                              name:
                                type: string
                              key:
                                type: string
                            required:
                            - name
                            - key
                        oneOf:
                        - required: [value]
                        - required: [valueFromSecret]
                      secretAccessKey:
                        description: Secret access key.
                        type: object
                        properties:
                          value:
                            description: Literal value of the secret access key.
                            type: string
                            format: password
                          valueFromSecret:
                            description: A reference to a Kubernetes Secret object containing the secret access key.
                            type: object
                            properties:
                              name:
                                type: string
                              key:
                                type: string
                            required:
                            - name
                            - key
                        oneOf:
                        - required: [value]
                        - required: [valueFromSecret]
                  iamRole:
                    description: |-
                      (Amazon EKS only) The ARN of an IAM role which can be impersonated to obtain AWS permissions. For
                      more information about IAM roles for service accounts, please refer to the Amazon EKS User Guide
                      at https://docs.aws.amazon.com/eks/latest/userguide/iam-roles-for-service-accounts.html

                      Beware that this IAM role only applies to the receive adapter, for retrieving S3 notifications
                      from the intermediate Amazon SQS queue. The TriggerMesh controller requires its own set of IAM
                      permissions for interacting with the Amazon S3 and (optionally) Amazon SQS management APIs. These
                      can be granted via a separate IAM role, through the 'triggermesh-controller' serviceAccount that
                      is located inside the 'triggermesh' namespace.
                    type: string
                    pattern: ^arn:aws(-cn|-us-gov)?:iam::\d{12}:role\/.+$
                oneOf:
                - required: [credentials]
                - required: [iamRole]
              sink:
                description: The destination of events sourced from Amazon S3.
                type: object
                properties:
                  ref:
                    description: Reference to an addressable Kubernetes object to be used as the destination of events.
                    type: object
                    properties:
                      apiVersion:
                        type: string
                      kind:
                        type: string
                      namespace:
                        type: string
                      name:
                        type: string
                    required:
                    - apiVersion
                    - kind
                    - name
                  uri:
                    description: URI to use as the destination of events.
                    type: string
                    format: uri
                oneOf:
                - required: [ref]
                - required: [uri]
            required:
            - arn
            - eventTypes
            - sink
          status:
            description: Reported status of the event source.
            type: object
            properties:
              queueARN:
                description: ARN of the Amazon SQS queue that is currently receiving notifications from the Amazon S3
                  bucket.
                type: string
              sinkUri:
                description: URI of the sink where events are currently sent to.
                type: string
                format: uri
              ceAttributes:
                type: array
                items:
                  type: object
                  properties:
                    type:
                      type: string
                    source:
                      type: string
                  required:
                  - type
                  - source
              observedGeneration:
                type: integer
                format: int64
              conditions:
                type: array
                items:
                  type: object
                  properties:
                    type:
                      type: string
                    status:
                      type: string
                      enum: ['True', 'False', Unknown]
                    severity:
                      type: string
                      enum: [Error, Warning, Info]
                    reason:
                      type: string
                    message:
                      type: string
                    lastTransitionTime:
                      type: string
                      format: date-time
                  required:
                  - type
                  - status
    additionalPrinterColumns:
    - name: Ready
      type: string
      jsonPath: .status.conditions[?(@.type=='Ready')].status
    - name: Reason
      type: string
      jsonPath: .status.conditions[?(@.type=='Ready')].reason
    - name: Queue
      type: string
      jsonPath: .status.queueARN
    - name: Sink
      type: string
      jsonPath: .status.sinkUri
    - name: Age
      type: date
      jsonPath: .metadata.creationTimestamp
