---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: estissuers.est.mitre.org
spec:
  group: est.mitre.org
  names:
    kind: EstIssuer
    listKind: EstIssuerList
    plural: estissuers
    singular: estissuer
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: EstIssuer is the Schema for the estissuers API
        properties:
          apiVersion:
            description: >-
              APIVersion defines the versioned schema of this representation of
              an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info:
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: >-
              Kind is a string value representing the REST resource this object
              represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info:
              https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec defines the desired state of EstIssuer
            type: object
            x-kubernetes-preserve-unknown-fields: true
            properties:
              host:
                description: EST portal hostname
                type: string
              port:
                description: EST portal port
                type: integer
                minimum: 1
                maximum: 65535
                default: 443
              label:
                description: >-
                  EST portal path under the well-known EST endpoint. See RFC
                  7030 Sec 3.2.2. Multiple labels can be specified with a '/'
                  separator, forming a URL path.
                type: string
                default: ""
              cacert:
                description: >-
                  EST portal root certificate, PEM encoded, and base64 encoded.
                  This certificate is used to authenticate the portal, and is
                  the Explicit Trust Anchor as defined in RFC 7030 Sec 1.1.
                type: string
                pattern: '^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$'
              secretName:
                description: >-
                  Name of a Secret with the EST portal credential. Secret must
                  be type kubernetes.io/basic-auth.
                type: string
            required:
              - host
              - cacert
          status:
            description: Status defines the observed state of EstIssuer
            type: object
            x-kubernetes-preserve-unknown-fields: true
        type: object
    served: true
    storage: true
    subresources:
      status: {}
