KanidmPersonAccount
kaniop.rs / v1beta1
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
name: example
spec object required
A person represents a human's account in Kanidm. The majority of your users will be a person who
will use this account in their daily activities. These entries may contain personally
identifying information that is considered by Kanidm to be sensitive. Because of this, there
are default limits to who may access these data.
More info:
https://kanidm.github.io/kanidm/master/accounts/people_accounts.html
credentialsTokenTtl
integer
If credentials are not defined, Kaniop will generate a link accessible when describing
the person account. This link will be valid for the number of seconds defined here.
The default is 3600 seconds (1 hour).
minimum:
0
kanidmName
string
The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used.
Use this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules
(e.g., entities with underscores like `idm_admin` or `idm_all_persons`).
This field is immutable and cannot be changed after creation.
kanidmRef object required
KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where
the object is stored.
name
string required
namespace
string
For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the
resource will be used.
personAttributes object required
Attributes that personally identify a person account.
The attributes defined here are set by the operator. If you want to manage those attributes
from the database, do not set them here.
Additionally, if you unset them here, they will be kept in the database.
accountExpire
string
Set an accounts expiry time.
If omitted, the account will not expire.
format:
date-time
accountValidFrom
string
Set an account valid from time.
If omitted, the account will be valid from the time of creation.
format:
date-time
displayname
string required
Set the display name for the person.
legalname
string
Set the legal name for the person.
mail
[]string
Set the mail address, can be set multiple times for multiple addresses. The first listed
mail address is the 'primary'.
posixAttributes object
POSIX attributes for the person account. When specified, the operator will activate them.
If omitted, the operator retains the attributes in the database but ceases to manage them.
gidnumber
integer
The group ID number (GID) for the person account. In Kanidm there is no difference between
a UID and a GID number.
If omitted, Kanidm will generate it automatically.
More info:
https://kanidm.github.io/kanidm/stable/accounts/posix_accounts_and_groups.html#uid-and-gid-numbers
minimum:
0
loginshell
string
The login shell for the person account.
This sets the default shell that will be used when the user logs in via SSH or other
mechanisms that require a shell. Common values include /bin/bash, /bin/zsh, /bin/sh.
sshPublicKeys
object
SSH public keys managed by Kaniop, indexed by their Kanidm tag.
Keys added directly in Kanidm under other tags are preserved.
If omitted, SSH keys are not managed. An empty map removes previously managed keys.
Kanidm performs the validation of SSH key material.
The map is a single atomic unit for server-side apply ownership.
status object
Most recent observed status of the Kanidm Person Account. Read-only.
More info:
https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
conditions []object
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition. This may be an empty string.
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
format:
int64
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
status
string required
status of the condition, one of True, False, Unknown.
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
credentialBootstrap object
Persistent bootstrap state. Keeping the token expiry in status prevents operator restarts from
generating duplicate reset tokens while preserving the existing retry-after-expiry behaviour.
state
string
Lifecycle of the initial credential bootstrap for a person account.
enum:
pending, tokenIssued, complete
tokenExpiresAt
string
Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.
format:
date-time
credentialState
string
Observed credential presence. `Unknown` is fail-closed: it must never trigger credential
bootstrap or reset-token creation.
enum:
unknown, present, absent
gid
integer
minimum:
0
kanidmRef
string required
managedSshPublicKeyTags
[]string
Tags claimed by this resource after successful synchronization with Kanidm.
Used to revoke only keys previously managed by Kaniop.
ready
boolean required
No matches. Try .spec.credentialsTokenTtl for an exact path