KanidmServiceAccount

kaniop.rs / v1beta1

apiVersion: kaniop.rs/v1beta1 kind: KanidmServiceAccount metadata: name: example

spec object required

A service account represents a non-human account in Kanidm used for programmatic access and integrations. Service accounts can have API tokens generated and associated with them for identification and granting extended access rights. These accounts are managed by delegated administrators and can have expiry times and other auditing information attached. More info: https://kanidm.github.io/kanidm/master/accounts/service_accounts.html

apiTokenRotation object

Automatic rotation configuration for API tokens. When enabled, the operator will rotate API tokens periodically by destroying and recreating them. This results in new token values being written to their associated Kubernetes secrets.

enabled boolean

Enable automatic secret rotation. Defaults to false (opt-in).

periodDays integer

Rotation period in days. Secrets will be rotated when they are older than this period. Defaults to 90 days.

format: uint32

minimum: 0

apiTokens []object

API tokens to be associated with the service account. If omitted, no tokens will be associated. If specified, the operator will ensure that the tokens exist with the specified attributes. If the tokens already exist, they will be updated to match the specified attributes. If the tokens are removed from the spec, they will be deleted from the service account.

expiry string

An optional rfc3339 time of the format "YYYY-MM-DDTHH:MM:SS+TZ", "2020-09-25T11:22:02+10:00". After this time the api token will no longer be valid.

format: date-time

label string required

A string describing the token. This is not used to identify the token, it is only for human description of the tokens purpose.

purpose string

The purpose of the API token.

enum: readonly, readwrite

secretName string

The name of the Kubernetes secret where the token value is stored. **WARNING**: A change to this field will result in a token rotation.

credentialsRotation object

Automatic rotation configuration for the credentials secret. Only applies when generate_credentials is true. When enabled, the operator will regenerate the password periodically based on the configured rotation period.

enabled boolean

Enable automatic secret rotation. Defaults to false (opt-in).

periodDays integer

Rotation period in days. Secrets will be rotated when they are older than this period. Defaults to 90 days.

format: uint32

minimum: 0

generateCredentials boolean

Whether to generate credentials for the service account. If true, the operator will create a Kubernetes secret containing the service account's password. If false, no secret will be created. Defaults to false. Secret name: `{{ name }}-kanidm-service-account-credentials`

kanidmName string

The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used. Use this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules (e.g., entities with underscores like `idm_admin` or `idm_all_persons`). This field is immutable and cannot be changed after creation.

kanidmRef object required

KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where the object is stored.

name string required

namespace string

For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the resource will be used.

posixAttributes object

POSIX attributes for the service account. When specified, the operator will activate them. If omitted, the operator retains the attributes in the database but ceases to manage them.

gidnumber integer

The group ID number (GID) for the person account. In Kanidm there is no difference between a UID and a GID number. If omitted, Kanidm will generate it automatically. More info: https://kanidm.github.io/kanidm/stable/accounts/posix_accounts_and_groups.html#uid-and-gid-numbers

format: uint32

minimum: 0

loginshell string

The login shell for the person account. This sets the default shell that will be used when the user logs in via SSH or other mechanisms that require a shell. Common values include /bin/bash, /bin/zsh, /bin/sh.

serviceAccountAttributes object required

Attributes that personally identify a service account. The attributes defined here are set by the operator. If you want to manage those attributes from the database, do not set them here. Additionally, if you unset them here, they will be kept in the database.

accountExpire string

Set an accounts expiry time. If omitted, the account will not expire.

format: date-time

accountValidFrom string

Set an account valid from time. If omitted, the account will be valid from the time of creation.

format: date-time

displayname string required

Set the display name for the service account.

entryManagedBy string required

Name/spn of a group or account that have entry manager rights over this service account.

mail []string

Set the mail address, can be set multiple times for multiple addresses. The first listed mail address is the 'primary'.

status object

Most recent observed status of the Kanidm Service Account. Read-only. More info: https://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status

apiTokens []object required

expiry string

Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers.

format: date-time

label string required

purpose string

enum: readonly, readwrite

secretName string

tokenId string required

The unique identifier for this API token in Kanidm, used for management operations.

conditions []object

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

status string required

status of the condition, one of True, False, Unknown.

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

credentialsSecret string

gid integer

format: uint32

minimum: 0

kanidmRef string required

ready boolean required

No matches. Try .spec.apiTokenRotation for an exact path