apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: awsiamroles.zalando.org
spec:
  group: zalando.org
  scope: Namespaced
  names:
    kind: AWSIAMRole
    singular: awsiamrole
    plural: awsiamroles
    categories:
    - all
  versions:
  - name: v1
    served: true
    storage: true
    additionalPrinterColumns:
      - jsonPath: .status.roleARN
        name: RoleARN
        type: string
        description: Full RoleARN
      - name: Expiration
        type: string
        description: Expiration time of the current credentials provisioned for the role
        jsonPath: .status.expiration
    subresources:
      # status enables the status subresource.
      status: {}
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              roleReference:
                description: |
                  Reference to an AWS IAM role which can either be a role name
                  or a full IAM role ARN.
                type: string
                minLength: 3
              roleSessionDuration:
                description: |
                  Specify the role session duration in seconds. Defaults to 3600
                  seconds (1 hour). This value must be less than or equal to the
                  `MaxSessionDuration` value of the IAM role.
                type: integer
                minimum: 900   # 15 minutes
                maximum: 43200 # 12 hours
              roleDefinition:
                properties:
                  AssumeRolePolicyDocument:
                    properties:
                      Statement:
                        type: array
                        items:
                          properties:
                            Action:
                              type: string
                            Effect:
                              type: string
                            Principal:
                              properties:
                                Service:
                                  type: string
                  ManagedPolicyArns:
                    type: array
                    items:
                      type: string
                  # https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-iam-role.html#cfn-iam-role-maxsessionduration
                  MaxSessionDuration:
                    type: integer
                    minimum: 3600  # 1 hour
                    maximum: 43200 # 12 hours
                  Path:
                    type: string
                  PermissionsBoundary:
                    type: string
                  Policies:
                    properties:
                      PolicyName:
                        type: string
                      PolicyDocument:
                        properties:
                          Version:
                            type: string
                            enum: ["2012-10-17"]
                          Statement:
                            type: array
                            items:
                              properties:
                                Effect:
                                  type: string
                                  enum: ["Allow", "Deny"]
                                Action:
                                  type: array
                                  items:
                                    type: string
                                Resource:
                                  type: string
                    required:
                    - PolicyName
                    - PolicyDocument
          status:
            properties:
              observedGeneration:
                type: integer
              roleARN:
                type: string
              expiration:
                type: string
        required:
        - spec
