KanidmPersonAccount
kaniop.rs / v1beta1
apiVersion: kaniop.rs/v1beta1
kind: KanidmPersonAccount
metadata:
name: example
spec object required
A person represents a human's account in Kanidm. The majority of your users will be a person who
will use this account in their daily activities. These entries may contain personally
identifying information that is considered by Kanidm to be sensitive. Because of this, there
are default limits to who may access these data.
More info:
https://kanidm.github.io/kanidm/master/accounts/people_accounts.html
credentialsTokenTtl
integer
If credentials are not defined, Kaniop will generate a link accessible when describing
the person account. This link will be valid for the number of seconds defined here.
The default is 3600 seconds (1 hour).
format:
uint32minimum:
0
kanidmName
string
The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used.
Use this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules
(e.g., entities with underscores like `idm_admin` or `idm_all_persons`).
This field is immutable and cannot be changed after creation.
kanidmRef object required
KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where
the object is stored.
name
string required
namespace
string
For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the
resource will be used.
personAttributes object required
Attributes that personally identify a person account.
The attributes defined here are set by the operator. If you want to manage those attributes
from the database, do not set them here.
Additionally, if you unset them here, they will be kept in the database.
accountExpire
string
Set an accounts expiry time.
If omitted, the account will not expire.
format:
date-time
accountValidFrom
string
Set an account valid from time.
If omitted, the account will be valid from the time of creation.
format:
date-time
displayname
string required
Set the display name for the person.
legalname
string
Set the legal name for the person.
mail
[]string
Set the mail address, can be set multiple times for multiple addresses. The first listed
mail address is the 'primary'.
posixAttributes object
POSIX attributes for the person account. When specified, the operator will activate them.
If omitted, the operator retains the attributes in the database but ceases to manage them.
gidnumber
integer
The group ID number (GID) for the person account. In Kanidm there is no difference between
a UID and a GID number.
If omitted, Kanidm will generate it automatically.
More info:
https://kanidm.github.io/kanidm/stable/accounts/posix_accounts_and_groups.html#uid-and-gid-numbers
format:
uint32minimum:
0
loginshell
string
The login shell for the person account.
This sets the default shell that will be used when the user logs in via SSH or other
mechanisms that require a shell. Common values include /bin/bash, /bin/zsh, /bin/sh.
status object
Most recent observed status of the Kanidm Person Account. Read-only.
More info:
https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
conditions []object
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition. This may be an empty string.
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
format:
int64
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
status
string required
status of the condition, one of True, False, Unknown.
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
gid
integer
format:
uint32minimum:
0
kanidmRef
string required
ready
boolean required
No matches. Try .spec.credentialsTokenTtl for an exact path