{ "description": "The Kanidm person account custom resource definition (CRD) defines a person account in Kanidm.", "properties": { "spec": { "additionalProperties": false, "description": "A person represents a human's account in Kanidm. The majority of your users will be a person who\nwill use this account in their daily activities. These entries may contain personally\nidentifying information that is considered by Kanidm to be sensitive. Because of this, there\nare default limits to who may access these data.\nMore info:\nhttps://kanidm.github.io/kanidm/master/accounts/people_accounts.html", "properties": { "credentialsTokenTtl": { "default": 3600, "description": "If credentials are not defined, Kaniop will generate a link accessible when describing\nthe person account. This link will be valid for the number of seconds defined here.\nThe default is 3600 seconds (1 hour).", "format": "uint32", "minimum": 0, "type": [ "integer", "null" ] }, "kanidmName": { "description": "The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used.\nUse this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules\n(e.g., entities with underscores like `idm_admin` or `idm_all_persons`).\nThis field is immutable and cannot be changed after creation.", "nullable": true, "type": [ "string", "null" ], "x-kubernetes-validations": [ { "message": "kanidmName cannot be changed.", "rule": "self == oldSelf" } ] }, "kanidmRef": { "additionalProperties": false, "description": "KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where\nthe object is stored.", "properties": { "name": { "type": "string" }, "namespace": { "description": "For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the\nresource will be used.", "nullable": true, "type": [ "string", "null" ] } }, "required": [ "name" ], "type": "object", "x-kubernetes-validations": [ { "message": "Value is immutable", "rule": "self == oldSelf" } ] }, "personAttributes": { "additionalProperties": false, "description": "Attributes that personally identify a person account.\n\nThe attributes defined here are set by the operator. If you want to manage those attributes\nfrom the database, do not set them here.\nAdditionally, if you unset them here, they will be kept in the database.", "properties": { "accountExpire": { "description": "Set an accounts expiry time.\n\nIf omitted, the account will not expire.", "format": "date-time", "nullable": true, "type": [ "string", "null" ] }, "accountValidFrom": { "description": "Set an account valid from time.\n\nIf omitted, the account will be valid from the time of creation.", "format": "date-time", "nullable": true, "type": [ "string", "null" ] }, "displayname": { "description": "Set the display name for the person.", "type": "string" }, "legalname": { "description": "Set the legal name for the person.", "nullable": true, "type": [ "string", "null" ] }, "mail": { "description": "Set the mail address, can be set multiple times for multiple addresses. The first listed\nmail address is the 'primary'.", "items": { "type": "string" }, "nullable": true, "type": [ "array", "null" ] } }, "required": [ "displayname" ], "type": "object" }, "posixAttributes": { "additionalProperties": false, "description": "POSIX attributes for the person account. When specified, the operator will activate them.\nIf omitted, the operator retains the attributes in the database but ceases to manage them.", "nullable": true, "properties": { "gidnumber": { "description": "The group ID number (GID) for the person account. In Kanidm there is no difference between\na UID and a GID number.\n\nIf omitted, Kanidm will generate it automatically.\n\nMore info:\nhttps://kanidm.github.io/kanidm/stable/accounts/posix_accounts_and_groups.html#uid-and-gid-numbers", "format": "uint32", "minimum": 0, "nullable": true, "type": [ "integer", "null" ] }, "loginshell": { "description": "The login shell for the person account.\n\nThis sets the default shell that will be used when the user logs in via SSH or other\nmechanisms that require a shell. Common values include /bin/bash, /bin/zsh, /bin/sh.", "nullable": true, "type": [ "string", "null" ] } }, "type": [ "object", "null" ] } }, "required": [ "kanidmRef", "personAttributes" ], "type": "object" }, "status": { "additionalProperties": false, "description": "Most recent observed status of the Kanidm Person Account. Read-only.\nMore info:\nhttps://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status", "nullable": true, "properties": { "conditions": { "items": { "additionalProperties": false, "description": "Condition contains details for one aspect of the current state of this API Resource.", "properties": { "lastTransitionTime": { "description": "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", "format": "date-time", "type": "string" }, "message": { "description": "message is a human readable message indicating details about the transition. This may be an empty string.", "type": "string" }, "observedGeneration": { "description": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.", "format": "int64", "type": [ "integer", "null" ] }, "reason": { "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.", "type": "string" }, "status": { "description": "status of the condition, one of True, False, Unknown.", "type": "string" }, "type": { "description": "type of condition in CamelCase or in foo.example.com/CamelCase.", "type": "string" } }, "required": [ "lastTransitionTime", "message", "reason", "status", "type" ], "type": "object" }, "nullable": true, "type": [ "array", "null" ] }, "gid": { "format": "uint32", "minimum": 0, "nullable": true, "type": [ "integer", "null" ] }, "kanidmRef": { "type": "string" }, "ready": { "type": "boolean" } }, "required": [ "kanidmRef", "ready" ], "type": [ "object", "null" ] } }, "required": [ "spec" ], "title": "KanidmPersonAccount", "type": "object" }