apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: clusterlogdestinations.deckhouse.io
  labels:
    heritage: deckhouse
    module: log-shipper
spec:
  group: deckhouse.io
  scope: Cluster
  names:
    plural: clusterlogdestinations
    singular: clusterlogdestination
    kind: ClusterLogDestination
  preserveUnknownFields: false
  versions:
    - name: v1alpha1
      served: true
      storage: true
      schema:
        openAPIV3Schema:
          type: object
          required: ["spec"]
          description: |
            Describes setting for a log storage, which you can use in many log sources.

            `metadata.name` — is an upstream name, which you should use in CR [ClusterLoggingConfig](https://deckhouse.io/en/documentation/modules/460-log-shipper/cr.html#clusterloggingconfig).
          properties:
            spec:
              type: object
              oneOf:
                - properties:
                    loki: {}
                    type:
                      enum:
                        - Loki
                  required:
                    - loki
                    - type
                - properties:
                    elasticsearch: {}
                    type:
                      enum:
                        - Elasticsearch
                  required:
                    - elasticsearch
                    - type
                - properties:
                    logstash: {}
                    type:
                      enum:
                        - Logstash
                  required:
                    - type
                    - logstash
              properties:
                type:
                  type: string
                  enum: ["Loki", "Elasticsearch", "Logstash"]
                  description: Type of a log storage backend.
                loki:
                  type: object
                  required:
                    - endpoint
                  properties:
                    auth:
                      type: object
                      properties:
                        password:
                          type: string
                          format: password
                          description: Base64 encoded Basic authentication password.
                        strategy:
                          type: string
                          enum: ["Basic", "Bearer"]
                          default: "Basic"
                          description: The authentication strategy to use.
                        token:
                          type: string
                          description: The token to use for Bearer authentication.
                        user:
                          type: string
                          description: The Basic authentication user name.
                      oneOf:
                        - properties:
                            strategy:
                              enum: ["Basic"]
                          allOf:
                            - not:
                                anyOf:
                                  - required:
                                      - token
                            - required:
                                - user
                                - password
                        - properties:
                            strategy:
                              enum: ["Bearer"]
                          allOf:
                            - not:
                                anyOf:
                                  - required:
                                      - user
                                  - required:
                                      - password
                            - required:
                                - token
                    endpoint:
                      type: string
                      description: |
                        The base URL of the Loki instance.

                        > Vector automatically adds `/loki/api/v1/push` into URL during data transmission.
                    tls:
                      type: object
                      description: Configures the TLS options for outgoing connections.
                      properties:
                        caFile:
                          type: string
                          description: Base64 encoded CA certificate in PEM format.
                        clientCrt:
                          type: object
                          description: Configures client certificate for outgoing connections.
                          required:
                            - crtFile
                            - keyFile
                          properties:
                            crtFile:
                              type: string
                              description: |
                                Base64 encoded certificate in PEM format.

                                You must also set the `keyFile` parameter.
                            keyFile:
                              type: string
                              format: password
                              description: |
                                Base64 encoded private key in PEM format (PKCS#8).

                                You must also set the `crtFile` parameter.
                            keyPass:
                              type: string
                              format: string
                              description: Base64 encoded pass phrase used to unlock the encrypted key file.
                        verifyHostname:
                          type: boolean
                          default: true
                          description: Validate the configured remote host name against the remote host’s TLS certificate.
                elasticsearch:
                  type: object
                  required:
                    - endpoint
                  properties:
                    auth:
                      type: object
                      properties:
                        strategy:
                          enum: ["Basic", "AWS"]
                          type: string
                          default: "Basic"
                          description: The authentication strategy to use.
                        password:
                          type: string
                          format: password
                          description: Base64 encoded Basic authentication password.
                        awsAccessKey:
                          type: string
                          description: Base64 encoded AWS `ACCESS_KEY`.
                        awsSecretKey:
                          type: string
                          description: Base64 encoded AWS `SECRET_KEY`.
                        awsAssumeRole:
                          type: string
                          description: The ARN of an IAM role to assume at startup.
                        user:
                          type: string
                          description: The Basic authentication user name.
                        awsRegion:
                          type: string
                          description: AWS region for authentication.
                      oneOf:
                        - properties:
                            strategy:
                              enum: ["Basic"]
                          allOf:
                            - not:
                                anyOf:
                                  - required:
                                      - awsAccessKey
                                  - required:
                                      - awsSecretKey
                                  - required:
                                      - awsAssumeRole
                                  - required:
                                      - awsRegion
                            - required:
                                - user
                                - password
                        - properties:
                            strategy:
                              enum: ["AWS"]
                          allOf:
                            - not:
                                anyOf:
                                  - required:
                                      - user
                                  - required:
                                      - password
                            - required:
                                - awsAccessKey
                                - awsSecretKey
                    index:
                      type: string
                      description: Index name to write events to.
                    pipeline:
                      type: string
                      description: Name of the pipeline to apply.
                    endpoint:
                      type: string
                      description: The base URL of the Elasticsearch instance.
                    dataStreamEnabled:
                      type: boolean
                      default: false
                      description: |
                        Use for storage indexes or datastreams (https://www.elastic.co/guide/en/elasticsearch/reference/master/data-streams.html).

                        Datastream usage is better for logs and metrics storage but they works only for Elasticsearch >= 7.16.X.
                    docType:
                      type: string
                      description: |
                        The doc_type for your index data. This is only relevant for Elasticsearch <= 6.X.

                        For ES >= 7.X - You do not need this option since this version has removed doc_type mapping
                        For ES >= 6.X - preferred value is a '_doc', this value will be easier to upgrade to 7.X
                        For ES < 6.X - you can't use a value starting with '_' or empty string. So use some other value like 'vector' or 'logs'.
                    tls:
                      type: object
                      description: Configures the TLS options for outgoing connections.
                      properties:
                        caFile:
                          type: string
                          description: Base64 encoded CA certificate in PEM format.
                        clientCrt:
                          type: object
                          description: Configures client certificate for outgoing connections.
                          required:
                            - crtFile
                            - keyFile
                          properties:
                            crtFile:
                              type: string
                              description: |
                                Base64 encoded certificate in PEM format.

                                You must also set the `keyFile` parameter.
                            keyFile:
                              type: string
                              format: password
                              description: |
                                Base64 encoded private key in PEM format (PKCS#8).

                                You must also set the `crtFile` parameter.
                            keyPass:
                              type: string
                              format: string
                              description: Base64 encoded pass phrase used to unlock the encrypted key file.
                        verifyHostname:
                          type: boolean
                          default: true
                          description: Validate the configured remote host name against the remote host's TLS certificate.
                logstash:
                  type: object
                  required:
                    - endpoint
                  properties:
                    endpoint:
                      type: string
                      description: The base URL of the Loki instance.
                    tls:
                      type: object
                      description: Configures the TLS options for outgoing connections.
                      properties:
                        caFile:
                          type: string
                          description: Base64 encoded CA certificate in PEM format.
                        clientCrt:
                          type: object
                          description: Configures client certificate for outgoing connections.
                          required:
                            - crtFile
                            - keyFile
                          properties:
                            crtFile:
                              type: string
                              description: |
                                Base64 encoded certificate in PEM format.

                                You must also set the `keyFile` parameter.
                            keyFile:
                              type: string
                              format: password
                              description: |
                                Base64 encoded private key in PEM format (PKCS#8).

                                You must also set the `crtFile` parameter.
                            keyPass:
                              type: string
                              format: string
                              description: Base64 encoded pass phrase used to unlock the encrypted key file.
                        verifyHostname:
                          type: boolean
                          default: true
                          description: Validate the configured remote host name against the remote host's TLS certificate.
                        verifyCertificate:
                          type: boolean
                          default: true
                          description: Validate the TLS certificate of the remote host.
                extraLabels:
                  type: object
                  description: |
                    A set of labels that will be attached to each batch of events.

                    You can use simple templating here: `{{ app }}`.

                    There are some reserved keys:
                    - parsed_data
                    - pod
                    - pod_labels
                    - pod_ip
                    - namespace
                    - image
                    - container
                    - node
                    - pod_owner

                    [More about field path notation...](https://vector.dev/docs/reference/configuration/field-path-notation/)
                  example: |
                    ```yaml
                    extraLabels:
                      forwarder: vector
                      key: value
                      app_info: "{{ app }}"
                      array_member: "{{ array[0] }}"
                      symbol_escating_value: "{{ pay\.day }}"
                    ```
                  additionalProperties:
                    type: string
                    anyOf:
                      - pattern: '^[a-zA-Z0-9_\-]+$'
                      - pattern: '^\{\{\ [a-zA-Z0-9\\\-][a-zA-Z0-9\[\]_\\\-\.]+\ \}\}$'
