{
  "description": "The Kanidm group custom resource definition (CRD) defines a group in Kanidm.",
  "properties": {
    "spec": {
      "additionalProperties": false,
      "description": "Groups are a collection of other entities that exist within Kanidm.\nMore info:\nhttps://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
      "properties": {
        "accountPolicy": {
          "additionalProperties": false,
          "description": "Account policy settings for the group.\n\nWhen set, the operator will enable account policy on this group and configure the specified\nsettings. Account policy defines security requirements that accounts must meet when they are\nmembers of this group.\n\nWhen an account is affected by multiple policies, the strictest component from each policy\nis applied.\n\nMore info: https://kanidm.github.io/kanidm/stable/accounts/account_policy.html",
          "nullable": true,
          "properties": {
            "allowPrimaryCredFallback": {
              "description": "Allow authenticating with the primary account password when logging in via LDAP.\nIf both an LDAP and primary password are specified, Kanidm will only accept the LDAP\npassword.",
              "nullable": true,
              "type": [
                "boolean",
                "null"
              ]
            },
            "authSessionExpiry": {
              "description": "Maximum length in seconds that an authentication session may exist for.\nAfter this time, the user must reauthenticate.\n\nThis value provides a difficult balance - forcing frequent re-authentications can frustrate\nand annoy users. However extremely long sessions allow a stolen or disclosed session\ntoken/device to read data for an extended period.",
              "format": "uint32",
              "minimum": 0,
              "nullable": true,
              "type": [
                "integer",
                "null"
              ]
            },
            "credentialTypeMinimum": {
              "description": "Minimum security strength of credentials that may be assigned to accounts affected by this\npolicy. In order from weakest to strongest: any \u003c mfa \u003c passkey \u003c attested_passkey.\n\n`attested_passkey` requires configuring `webauthnAttestationCaList`.",
              "enum": [
                "any",
                "mfa",
                "passkey",
                "attested_passkey"
              ],
              "nullable": true,
              "type": [
                "string",
                "null"
              ]
            },
            "limitSearchMaxFilterTest": {
              "description": "Maximum number of filter tests allowed in a search operation.",
              "format": "uint32",
              "minimum": 0,
              "nullable": true,
              "type": [
                "integer",
                "null"
              ]
            },
            "limitSearchMaxResults": {
              "description": "Maximum number of results returned from a search operation.",
              "format": "uint32",
              "minimum": 0,
              "nullable": true,
              "type": [
                "integer",
                "null"
              ]
            },
            "passwordMinimumLength": {
              "description": "Minimum length for passwords (if they are allowed by credential_type_minimum).",
              "format": "uint32",
              "minimum": 0,
              "nullable": true,
              "type": [
                "integer",
                "null"
              ]
            },
            "privilegeExpiry": {
              "description": "Maximum length in seconds that privileges will exist after reauthentication for a read/write\nsession. After this time, the session returns to read-only mode.\n\nMaximum allowed value is 3600 (1 hour).",
              "format": "uint32",
              "minimum": 0,
              "nullable": true,
              "type": [
                "integer",
                "null"
              ],
              "x-kubernetes-validations": [
                {
                  "message": "privilegeExpiry must be at most 3600 seconds (1 hour)",
                  "rule": "self \u003c= 3600"
                }
              ]
            },
            "webauthnAttestationCaList": {
              "description": "WebAuthn attestation CA list. This is the list of certificate authorities and device AAGUIDs\nthat must be used by members of this policy. This allows limiting devices to specific models.\n\nGenerate this list using `fido-mds-tool` from the webauthn-rs project.\n\nMore info:\nhttps://kanidm.github.io/kanidm/stable/accounts/account_policy.html#setting-webauthn-attestation-ca-lists",
              "nullable": true,
              "type": [
                "string",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "entryManagedBy": {
          "description": "Optional name/spn of a group or account that have entry manager rights over this group.",
          "nullable": true,
          "type": [
            "string",
            "null"
          ]
        },
        "kanidmName": {
          "description": "The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used.\nUse this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules\n(e.g., entities with underscores like `idm_admin` or `idm_all_persons`).\nThis field is immutable and cannot be changed after creation.",
          "nullable": true,
          "type": [
            "string",
            "null"
          ],
          "x-kubernetes-validations": [
            {
              "message": "kanidmName cannot be changed.",
              "rule": "self == oldSelf"
            }
          ]
        },
        "kanidmRef": {
          "additionalProperties": false,
          "description": "KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where\nthe object is stored.",
          "properties": {
            "name": {
              "type": "string"
            },
            "namespace": {
              "description": "For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the\nresource will be used.",
              "nullable": true,
              "type": [
                "string",
                "null"
              ]
            }
          },
          "required": [
            "name"
          ],
          "type": "object",
          "x-kubernetes-validations": [
            {
              "message": "Value is immutable",
              "rule": "self == oldSelf"
            }
          ]
        },
        "mail": {
          "description": "Set the exact list of mail addresses that this group is associated with. The first mail\naddress in the list is the `primary` and the remainder are aliases. Setting an empty list\nwill clear the mail attribute.",
          "items": {
            "type": "string"
          },
          "nullable": true,
          "type": [
            "array",
            "null"
          ]
        },
        "members": {
          "description": "Name or SPN of group members. Set the exact list of members that this group should contain,\nremoving any not listed in the set operation.\nIf you want to manage members from the database, do not set them here.",
          "items": {
            "type": "string"
          },
          "nullable": true,
          "type": [
            "array",
            "null"
          ]
        },
        "posixAttributes": {
          "additionalProperties": false,
          "description": "POSIX attributes for the group account. When specified, the operator will activate them.\nIf omitted, the operator retains the attributes in the database but ceases to manage them.",
          "nullable": true,
          "properties": {
            "gidnumber": {
              "description": "The group ID number (GID) for the group account.\n\nIf omitted, Kanidm will generate it automatically.",
              "format": "uint32",
              "minimum": 0,
              "nullable": true,
              "type": [
                "integer",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        }
      },
      "required": [
        "kanidmRef"
      ],
      "type": "object"
    },
    "status": {
      "additionalProperties": false,
      "description": "Most recent observed status of the Kanidm Group. Read-only.\n\nMore info:\nhttps://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
      "nullable": true,
      "properties": {
        "conditions": {
          "items": {
            "additionalProperties": false,
            "description": "Condition contains details for one aspect of the current state of this API Resource.",
            "properties": {
              "lastTransitionTime": {
                "description": "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
                "format": "date-time",
                "type": "string"
              },
              "message": {
                "description": "message is a human readable message indicating details about the transition. This may be an empty string.",
                "type": "string"
              },
              "observedGeneration": {
                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
                "format": "int64",
                "type": [
                  "integer",
                  "null"
                ]
              },
              "reason": {
                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
                "type": "string"
              },
              "status": {
                "description": "status of the condition, one of True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
                "type": "string"
              }
            },
            "required": [
              "lastTransitionTime",
              "message",
              "reason",
              "status",
              "type"
            ],
            "type": "object"
          },
          "nullable": true,
          "type": [
            "array",
            "null"
          ]
        },
        "gid": {
          "format": "uint32",
          "minimum": 0,
          "nullable": true,
          "type": [
            "integer",
            "null"
          ]
        },
        "kanidmRef": {
          "type": "string"
        },
        "ready": {
          "type": "boolean"
        }
      },
      "required": [
        "kanidmRef",
        "ready"
      ],
      "type": [
        "object",
        "null"
      ]
    }
  },
  "required": [
    "spec"
  ],
  "title": "KanidmGroup",
  "type": "object"
}