# A specification to declare needed OAuth credentials (tokens, clients) for the
# Zalando Platform IAM system
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: platformcredentialssets.zalando.org
spec:
  scope: Namespaced
  group: zalando.org
  names:
    kind: PlatformCredentialsSet
    plural: platformcredentialssets
    singular: platformcredentialsset
    shortNames:
      - pcs
    categories:
      - all
  versions:
  - name: v1
    served: true
    storage: true
    additionalPrinterColumns:
    - jsonPath: .spec.application
      description: ID of application registered in application registry
      name: Application
      type: string
    - jsonPath: .status.processingStatus
      description: Processing status reported by Credentials Provider
      name: Status
      type: string
    - jsonPath: .metadata.creationTimestamp
      description: Age of the PlatformCredentialsSet
      name: Age
      type: date
    schema:
      openAPIV3Schema:
        type: object
        required:
        - spec
        properties:
          spec:
            type: object
            required:
              - application
            properties:
              application:
                type: string
                pattern: "^[a-z][a-z0-9-]*[a-z0-9]$"
              clients:
                type: object
                additionalProperties:
                  type: object
                  properties:
                    realm:
                      type: string
                      enum:
                        - customers
                        - users
                        - services
                    grant:
                      type: string
                      enum:
                        - authorization-code
                        - implicit
                        - resource-owner-password-credentials
                        - client-credentials
                    redirectUri:
                      type: string
              tokens:
                type: object
                additionalProperties:
                  type: object
                  nullable: true
                  properties:
                    privileges:
                      type: array
                      nullable: true
                      items:
                        type: string
              token_version:
                type: string
                enum:
                  - v1
                  - v2
          status:
            type: object
            properties:
              observedGeneration:
                type: integer
              clients:
                type: object
                additionalProperties:
                  type: object
              errors:
                type: array
                items:
                  type: string
              problems:
                type: array
                items:
                  type: string
              processingStatus:
                type: string
                enum:
                - Succeeded
                - Failed
              tokens:
                type: object
                additionalProperties:
                  type: object
                  properties:
                    expiration:
                      type: string
    subresources:
      status: {}
