KanidmGroup
kaniop.rs / v1beta1
apiVersion: kaniop.rs/v1beta1
kind: KanidmGroup
metadata:
name: example
spec object required
Groups are a collection of other entities that exist within Kanidm.
More info:
https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
accountPolicy object
Account policy settings for the group.
When set, the operator will enable account policy on this group and configure the specified
settings. Account policy defines security requirements that accounts must meet when they are
members of this group.
When an account is affected by multiple policies, the strictest component from each policy
is applied.
More info: https://kanidm.github.io/kanidm/stable/accounts/account_policy.html
allowPrimaryCredFallback
boolean
Allow authenticating with the primary account password when logging in via LDAP.
If both an LDAP and primary password are specified, Kanidm will only accept the LDAP
password.
authSessionExpiry
integer
Maximum length in seconds that an authentication session may exist for.
After this time, the user must reauthenticate.
This value provides a difficult balance - forcing frequent re-authentications can frustrate
and annoy users. However extremely long sessions allow a stolen or disclosed session
token/device to read data for an extended period.
format:
uint32minimum:
0
credentialTypeMinimum
string
Minimum security strength of credentials that may be assigned to accounts affected by this
policy. In order from weakest to strongest: any < mfa < passkey < attested_passkey.
`attested_passkey` requires configuring `webauthnAttestationCaList`.
enum:
any, mfa, passkey, attested_passkey
limitSearchMaxFilterTest
integer
Maximum number of filter tests allowed in a search operation.
format:
uint32minimum:
0
limitSearchMaxResults
integer
Maximum number of results returned from a search operation.
format:
uint32minimum:
0
passwordMinimumLength
integer
Minimum length for passwords (if they are allowed by credential_type_minimum).
format:
uint32minimum:
0
privilegeExpiry
integer
Maximum length in seconds that privileges will exist after reauthentication for a read/write
session. After this time, the session returns to read-only mode.
Maximum allowed value is 3600 (1 hour).
format:
uint32minimum:
0
webauthnAttestationCaList
string
WebAuthn attestation CA list. This is the list of certificate authorities and device AAGUIDs
that must be used by members of this policy. This allows limiting devices to specific models.
Generate this list using `fido-mds-tool` from the webauthn-rs project.
More info:
https://kanidm.github.io/kanidm/stable/accounts/account_policy.html#setting-webauthn-attestation-ca-lists
entryManagedBy
string
Optional name/spn of a group or account that have entry manager rights over this group.
kanidmName
string
The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used.
Use this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules
(e.g., entities with underscores like `idm_admin` or `idm_all_persons`).
This field is immutable and cannot be changed after creation.
kanidmRef object required
KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where
the object is stored.
name
string required
namespace
string
For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the
resource will be used.
mail
[]string
Set the exact list of mail addresses that this group is associated with. The first mail
address in the list is the `primary` and the remainder are aliases. Setting an empty list
will clear the mail attribute.
members
[]string
Name or SPN of group members. Set the exact list of members that this group should contain,
removing any not listed in the set operation.
If you want to manage members from the database, do not set them here.
posixAttributes object
POSIX attributes for the group account. When specified, the operator will activate them.
If omitted, the operator retains the attributes in the database but ceases to manage them.
gidnumber
integer
The group ID number (GID) for the group account.
If omitted, Kanidm will generate it automatically.
format:
uint32minimum:
0status object
Most recent observed status of the Kanidm Group. Read-only.
More info:
https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
conditions []object
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition. This may be an empty string.
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
format:
int64
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
status
string required
status of the condition, one of True, False, Unknown.
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
gid
integer
format:
uint32minimum:
0
kanidmRef
string required
ready
boolean required
No matches. Try .spec.accountPolicy for an exact path