{ "description": "Auto-generated derived type for KanidmBackupRepositorySpec via `CustomResource`", "properties": { "spec": { "additionalProperties": false, "properties": { "authentication": { "additionalProperties": false, "description": "Authentication configuration for writer, reader, and deleter roles. These fields are mutable and can be updated to rotate credentials.", "properties": { "deleter": { "additionalProperties": false, "properties": { "secretRef": { "additionalProperties": false, "nullable": true, "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": [ "object", "null" ] }, "workloadIdentity": { "additionalProperties": false, "nullable": true, "properties": { "audience": { "nullable": true, "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": "object", "x-kubernetes-validations": [ { "message": "exactly one of workloadIdentity or secretRef must be set", "rule": "(has(self.workloadIdentity) ? 1 : 0) + (has(self.secretRef) ? 1 : 0) == 1" } ] }, "reader": { "additionalProperties": false, "properties": { "secretRef": { "additionalProperties": false, "nullable": true, "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": [ "object", "null" ] }, "workloadIdentity": { "additionalProperties": false, "nullable": true, "properties": { "audience": { "nullable": true, "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": "object", "x-kubernetes-validations": [ { "message": "exactly one of workloadIdentity or secretRef must be set", "rule": "(has(self.workloadIdentity) ? 1 : 0) + (has(self.secretRef) ? 1 : 0) == 1" } ] }, "writer": { "additionalProperties": false, "properties": { "secretRef": { "additionalProperties": false, "nullable": true, "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": [ "object", "null" ] }, "workloadIdentity": { "additionalProperties": false, "nullable": true, "properties": { "audience": { "nullable": true, "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "type": "object", "x-kubernetes-validations": [ { "message": "exactly one of workloadIdentity or secretRef must be set", "rule": "(has(self.workloadIdentity) ? 1 : 0) + (has(self.secretRef) ? 1 : 0) == 1" } ] } }, "required": [ "deleter", "reader", "writer" ], "type": "object" }, "encryption": { "additionalProperties": false, "description": "Encryption configuration for backup payloads. Supports provider-managed SSE (providerManaged),\nprovider KMS SSE (providerKms), and client-side envelope encryption (clientSide). When absent, no encryption is applied.\nThis field is mutable, but once a backup has been created with a given encryption configuration, the mode, keyId, and keyRef sub-fields become immutable.", "nullable": true, "properties": { "keyId": { "nullable": true, "type": [ "string", "null" ] }, "keyRef": { "additionalProperties": false, "nullable": true, "properties": { "name": { "type": "string" } }, "required": [ "name" ], "type": [ "object", "null" ] }, "mode": { "enum": [ "providerManaged", "providerKms", "clientSide" ], "type": "string" } }, "required": [ "mode" ], "type": [ "object", "null" ], "x-kubernetes-validations": [ { "message": "keyId is required when mode is providerKms and forbidden otherwise", "rule": "(self.mode == 'providerKms') == has(self.keyId)" }, { "message": "keyRef is required when mode is clientSide and forbidden otherwise", "rule": "(self.mode == 'clientSide') == has(self.keyRef)" } ] }, "limits": { "additionalProperties": false, "description": "Transport limits and safety retention. This field is mutable.", "nullable": true, "properties": { "maxConcurrentParts": { "default": 4, "minimum": 0, "type": [ "integer", "null" ] }, "maxDownloadBytesPerSecond": { "minimum": 0, "nullable": true, "type": [ "integer", "null" ] }, "maxUploadBytesPerSecond": { "minimum": 0, "nullable": true, "type": [ "integer", "null" ] }, "safetyBackupMinRetention": { "default": "720h", "type": [ "string", "null" ] } }, "type": [ "object", "null" ], "x-kubernetes-validations": [ { "message": "maxConcurrentParts must be between 1 and 64", "rule": "self.maxConcurrentParts \u003e= 1 \u0026\u0026 self.maxConcurrentParts \u003c= 64" } ] }, "s3": { "additionalProperties": false, "description": "S3-compatible storage configuration. The bucket, prefix, and endpoint fields are immutable after the repository has been used.", "properties": { "bucket": { "description": "S3 bucket name. Must not be empty.\n\nThis field is immutable after the repository has been used. To use a different bucket, delete this Repository and create a new one.", "type": "string", "x-kubernetes-validations": [ { "message": "bucket must not be empty", "rule": "self.size() \u003e 0" } ] }, "caBundleRef": { "description": "Reference to a ConfigMap or Secret containing a CA bundle for TLS verification.", "nullable": true, "type": [ "string", "null" ] }, "endpoint": { "description": "S3 endpoint URL. Must use HTTPS unless insecure is enabled.\n\nThis field is immutable after the repository has been used. To use a different endpoint, delete this Repository and create a new one.", "type": "string" }, "forcePathStyle": { "default": false, "description": "Use path-style addressing (http://endpoint/bucket) instead of virtual-hosted-style (http://bucket.endpoint).", "type": [ "boolean", "null" ] }, "insecure": { "default": false, "description": "Allow HTTP endpoints. Not recommended for production use.", "type": [ "boolean", "null" ] }, "prefix": { "description": "Prefix within the bucket. Must not contain path traversal segments (..).\n\nThis field is immutable after the repository has been used. To use a different prefix, delete this Repository and create a new one.", "type": "string", "x-kubernetes-validations": [ { "message": "prefix must not contain path traversal segments", "rule": "!self.contains('..')" } ] }, "region": { "description": "AWS region. Required for all S3-compatible providers.", "type": "string" } }, "required": [ "bucket", "endpoint", "prefix", "region" ], "type": "object", "x-kubernetes-validations": [ { "message": "endpoint must use HTTPS unless insecure is enabled", "rule": "self.endpoint.startsWith('https://') || self.insecure" } ] } }, "required": [ "authentication", "s3" ], "type": "object", "x-kubernetes-validations": [ { "message": "s3.bucket is immutable after creation. To use a different bucket, delete this KanidmBackupRepository and create a new one. Existing Backup CRs referencing this repository are not affected, but remote S3 data in the old bucket remains accessible only through the old Repository.", "rule": "self.s3.bucket == oldSelf.s3.bucket" }, { "message": "s3.prefix is immutable after creation. To use a different prefix, delete this KanidmBackupRepository and create a new one. Existing Backup CRs referencing this repository are not affected, but remote S3 data under the old prefix remains accessible only through the old Repository.", "rule": "self.s3.prefix == oldSelf.s3.prefix" }, { "message": "s3.endpoint is immutable after creation. To use a different endpoint, delete this KanidmBackupRepository and create a new one. Existing Backup CRs referencing this repository are not affected, but remote S3 data at the old endpoint remains accessible only through the old Repository.", "rule": "self.s3.endpoint == oldSelf.s3.endpoint" } ] }, "status": { "additionalProperties": false, "nullable": true, "properties": { "conditions": { "items": { "additionalProperties": false, "description": "Condition contains details for one aspect of the current state of this API Resource.", "properties": { "lastTransitionTime": { "description": "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", "format": "date-time", "type": "string" }, "message": { "description": "message is a human readable message indicating details about the transition. This may be an empty string.", "type": "string" }, "observedGeneration": { "description": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.", "format": "int64", "type": [ "integer", "null" ] }, "reason": { "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.", "type": "string" }, "status": { "description": "status of the condition, one of True, False, Unknown.", "type": "string" }, "type": { "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", "type": "string" } }, "required": [ "lastTransitionTime", "message", "reason", "status", "type" ], "type": "object" }, "type": [ "array", "null" ], "x-kubernetes-list-map-keys": [ "type" ], "x-kubernetes-list-type": "map" }, "observedGeneration": { "format": "int64", "nullable": true, "type": [ "integer", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "spec" ], "title": "KanidmBackupRepository", "type": "object" }