
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.3.0
  name: authentications.operator.tigera.io
spec:
  group: operator.tigera.io
  names:
    kind: Authentication
    listKind: AuthenticationList
    plural: authentications
    singular: authentication
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: Authentication is the Schema for the authentications API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: AuthenticationSpec defines the desired state of Authentication
            properties:
              groupsPrefix:
                description: If specified, GroupsPrefix is prepended to each group
                  obtained from the identity provider. Note that Kibana does not support
                  a groups prefix, so this prefix is removed from Kubernetes Groups
                  when translating log access ClusterRoleBindings into Elastic.
                type: string
              ldap:
                description: LDAP contains the configuration needed to setup LDAP
                  authentication.
                properties:
                  groupSearch:
                    description: Group search configuration to find the groups that
                      a user is in.
                    properties:
                      baseDN:
                        description: BaseDN to start the search from. For example
                          "cn=groups,dc=example,dc=com"
                        type: string
                      filter:
                        description: Optional filter to apply when searching the directory.
                          For example "(objectClass=posixGroup)"
                        type: string
                      nameAttribute:
                        description: The attribute of the group that represents its
                          name. This attribute can be used to apply RBAC to a user
                          group.
                        type: string
                      userMatchers:
                        description: Following list contains field pairs that are
                          used to match a user to a group. It adds an additional requirement
                          to the filter that an attribute in the group must match
                          the user's attribute value.
                        items:
                          description: UserMatch when the value of a UserAttribute
                            and a GroupAttribute match, a user belongs to the group.
                          properties:
                            groupAttribute:
                              description: The attribute of a group that links it
                                to a user.
                              type: string
                            userAttribute:
                              description: The attribute of a user that links it to
                                a group.
                              type: string
                          required:
                          - groupAttribute
                          - userAttribute
                          type: object
                        type: array
                    required:
                    - baseDN
                    - nameAttribute
                    - userMatchers
                    type: object
                  host:
                    description: 'The host and port of the LDAP server. Example: ad.example.com:636'
                    type: string
                  startTLS:
                    description: StartTLS whether to enable the startTLS feature for
                      establishing TLS on an existing LDAP session. If true, the ldap://
                      protocol is used and then issues a StartTLS command, otherwise,
                      connections will use the ldaps:// protocol.
                    type: boolean
                  userSearch:
                    description: User entry search configuration to match the credentials
                      with a user.
                    properties:
                      baseDN:
                        description: BaseDN to start the search from. For example
                          "cn=users,dc=example,dc=com"
                        type: string
                      filter:
                        description: Optional filter to apply when searching the directory.
                          For example "(objectClass=person)"
                        type: string
                      nameAttribute:
                        description: 'A mapping of the attribute that is used as the
                          username. This attribute can be used to apply RBAC to a
                          user. Default: uid'
                        type: string
                    required:
                    - baseDN
                    type: object
                required:
                - host
                - userSearch
                type: object
              managerDomain:
                description: ManagerDomain is the domain name of the Manager
                type: string
              oidc:
                description: OIDC contains the configuration needed to setup OIDC
                  authentication.
                properties:
                  emailVerification:
                    description: 'Some providers do not include the claim "email_verified"
                      when there is no verification in the user enrollment process
                      or if they are acting as a proxy for another identity provider.
                      By default those tokens are deemed invalid. To skip this check,
                      set the value to "InsecureSkip". Default: Verify'
                    enum:
                    - Verify
                    - InsecureSkip
                    type: string
                  groupsClaim:
                    description: GroupsClaim specifies which claim to use from the
                      OIDC provider as the group.
                    type: string
                  groupsPrefix:
                    description: Deprecated. Please use Authentication.Spec.GroupsPrefix
                      instead.
                    type: string
                  issuerURL:
                    description: IssuerURL is the URL to the OIDC provider.
                    type: string
                  promptTypes:
                    description: 'PromptTypes is an optional list of string values
                      that specifies whether the identity provider prompts the end
                      user for re-authentication and consent. See the RFC for more
                      information on prompt types: https://openid.net/specs/openid-connect-core-1_0.html.
                      Default: "Consent"'
                    items:
                      description: 'PromptType is a value that specifies whether the
                        identity provider prompts the end user for re-authentication
                        and consent. One of: None, Login, Consent, SelectAccount.'
                      enum:
                      - None
                      - Login
                      - Consent
                      - SelectAccount
                      type: string
                    type: array
                  requestedScopes:
                    description: 'RequestedScopes is a list of scopes to request from
                      the OIDC provider. If not provided, the following scopes are
                      requested: ["openid", "email", "profile", "groups", "offline_access"].'
                    items:
                      type: string
                    type: array
                  type:
                    description: 'Default: "Dex"'
                    enum:
                    - Dex
                    - Tigera
                    type: string
                  usernameClaim:
                    description: UsernameClaim specifies which claim to use from the
                      OIDC provider as the username.
                    type: string
                  usernamePrefix:
                    description: Deprecated. Please use Authentication.Spec.UsernamePrefix
                      instead.
                    type: string
                required:
                - issuerURL
                - usernameClaim
                type: object
              openshift:
                description: Openshift contains the configuration needed to setup
                  Openshift OAuth authentication.
                properties:
                  issuerURL:
                    description: 'IssuerURL is the URL to the Openshift OAuth provider.
                      Ex.: https://api.my-ocp-domain.com:6443'
                    type: string
                required:
                - issuerURL
                type: object
              usernamePrefix:
                description: If specified, UsernamePrefix is prepended to each user
                  obtained from the identity provider. Note that Kibana does not support
                  a user prefix, so this prefix is removed from Kubernetes User when
                  translating log access ClusterRoleBindings into Elastic.
                type: string
            type: object
          status:
            description: AuthenticationStatus defines the observed state of Authentication
            properties:
              state:
                description: State provides user-readable status.
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
