{
  "description": "The Kanidm service account custom resource definition (CRD) defines a service account in Kanidm.",
  "properties": {
    "spec": {
      "additionalProperties": false,
      "description": "A service account represents a non-human account in Kanidm used for programmatic access and\nintegrations. Service accounts can have API tokens generated and associated with them for\nidentification and granting extended access rights. These accounts are managed by delegated\nadministrators and can have expiry times and other auditing information attached.\nMore info:\nhttps://kanidm.github.io/kanidm/master/accounts/service_accounts.html",
      "properties": {
        "apiTokenRotation": {
          "additionalProperties": false,
          "description": "Automatic rotation configuration for API tokens. When enabled, the operator will rotate\nAPI tokens periodically by destroying and recreating them. This results in new token values\nbeing written to their associated Kubernetes secrets.",
          "nullable": true,
          "properties": {
            "enabled": {
              "default": false,
              "description": "Enable automatic secret rotation. Defaults to false (opt-in).",
              "type": [
                "boolean",
                "null"
              ]
            },
            "periodDays": {
              "default": 90,
              "description": "Rotation period in days. Secrets will be rotated when they are older than this period.\nDefaults to 90 days.",
              "format": "uint32",
              "minimum": 0,
              "type": [
                "integer",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "apiTokens": {
          "description": "API tokens to be associated with the service account. If omitted, no tokens will be\nassociated. If specified, the operator will ensure that the tokens exist with the\nspecified attributes. If the tokens already exist, they will be updated to match the\nspecified attributes. If the tokens are removed from the spec, they will be deleted from\nthe service account.",
          "items": {
            "additionalProperties": false,
            "description": "API token configuration for service account authentication.\n\nAPI tokens can be used for identification of the service account and for granting extended\naccess rights. Tokens can be read-only or read-write, and can have expiry times and other\nauditing information attached.",
            "properties": {
              "expiry": {
                "description": "An optional rfc3339 time of the format \"YYYY-MM-DDTHH:MM:SS+TZ\",\n\"2020-09-25T11:22:02+10:00\". After this time the api token will no longer be valid.",
                "format": "date-time",
                "nullable": true,
                "type": [
                  "string",
                  "null"
                ]
              },
              "label": {
                "description": "A string describing the token. This is not used to identify the token, it is only for human\ndescription of the tokens purpose.",
                "type": "string"
              },
              "purpose": {
                "default": "readonly",
                "description": "The purpose of the API token.",
                "enum": [
                  "readonly",
                  "readwrite"
                ],
                "type": [
                  "string",
                  "null"
                ]
              },
              "secretName": {
                "description": "The name of the Kubernetes secret where the token value is stored.\n**WARNING**: A change to this field will result in a token rotation.",
                "nullable": true,
                "type": [
                  "string",
                  "null"
                ]
              }
            },
            "required": [
              "label"
            ],
            "type": "object"
          },
          "nullable": true,
          "type": [
            "array",
            "null"
          ]
        },
        "credentialsRotation": {
          "additionalProperties": false,
          "description": "Automatic rotation configuration for the credentials secret. Only applies when\ngenerate_credentials is true. When enabled, the operator will regenerate the password\nperiodically based on the configured rotation period.",
          "nullable": true,
          "properties": {
            "enabled": {
              "default": false,
              "description": "Enable automatic secret rotation. Defaults to false (opt-in).",
              "type": [
                "boolean",
                "null"
              ]
            },
            "periodDays": {
              "default": 90,
              "description": "Rotation period in days. Secrets will be rotated when they are older than this period.\nDefaults to 90 days.",
              "format": "uint32",
              "minimum": 0,
              "type": [
                "integer",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "generateCredentials": {
          "default": false,
          "description": "Whether to generate credentials for the service account. If true, the operator will create\na Kubernetes secret containing the service account's password. If false, no secret\nwill be created. Defaults to false.\nSecret name: `{{ name }}-kanidm-service-account-credentials`",
          "type": [
            "boolean",
            "null"
          ]
        },
        "kanidmName": {
          "description": "The name of the entity in Kanidm. If not specified, the Kubernetes resource name is used.\nUse this field to manage Kanidm entities with names that don't conform to Kubernetes naming rules\n(e.g., entities with underscores like `idm_admin` or `idm_all_persons`).\nThis field is immutable and cannot be changed after creation.",
          "nullable": true,
          "type": [
            "string",
            "null"
          ],
          "x-kubernetes-validations": [
            {
              "message": "kanidmName cannot be changed.",
              "rule": "self == oldSelf"
            }
          ]
        },
        "kanidmRef": {
          "additionalProperties": false,
          "description": "KanidmRef is a reference to a Kanidm object in the same cluster. It is used to specify where\nthe object is stored.",
          "properties": {
            "name": {
              "type": "string"
            },
            "namespace": {
              "description": "For cross-namespace resources. Reference Kanidm namespace. If omitted, the namespace of the\nresource will be used.",
              "nullable": true,
              "type": [
                "string",
                "null"
              ]
            }
          },
          "required": [
            "name"
          ],
          "type": "object",
          "x-kubernetes-validations": [
            {
              "message": "Value is immutable",
              "rule": "self == oldSelf"
            }
          ]
        },
        "posixAttributes": {
          "additionalProperties": false,
          "description": "POSIX attributes for the service account. When specified, the operator will activate them.\nIf omitted, the operator retains the attributes in the database but ceases to manage them.",
          "nullable": true,
          "properties": {
            "gidnumber": {
              "description": "The group ID number (GID) for the person account. In Kanidm there is no difference between\na UID and a GID number.\n\nIf omitted, Kanidm will generate it automatically.\n\nMore info:\nhttps://kanidm.github.io/kanidm/stable/accounts/posix_accounts_and_groups.html#uid-and-gid-numbers",
              "format": "uint32",
              "minimum": 0,
              "nullable": true,
              "type": [
                "integer",
                "null"
              ]
            },
            "loginshell": {
              "description": "The login shell for the person account.\n\nThis sets the default shell that will be used when the user logs in via SSH or other\nmechanisms that require a shell. Common values include /bin/bash, /bin/zsh, /bin/sh.",
              "nullable": true,
              "type": [
                "string",
                "null"
              ]
            }
          },
          "type": [
            "object",
            "null"
          ]
        },
        "serviceAccountAttributes": {
          "additionalProperties": false,
          "description": "Attributes that personally identify a service account.\n\nThe attributes defined here are set by the operator. If you want to manage those attributes\nfrom the database, do not set them here.\nAdditionally, if you unset them here, they will be kept in the database.",
          "properties": {
            "accountExpire": {
              "description": "Set an accounts expiry time.\n\nIf omitted, the account will not expire.",
              "format": "date-time",
              "nullable": true,
              "type": [
                "string",
                "null"
              ]
            },
            "accountValidFrom": {
              "description": "Set an account valid from time.\n\nIf omitted, the account will be valid from the time of creation.",
              "format": "date-time",
              "nullable": true,
              "type": [
                "string",
                "null"
              ]
            },
            "displayname": {
              "description": "Set the display name for the service account.",
              "type": "string"
            },
            "entryManagedBy": {
              "description": "Name/spn of a group or account that have entry manager rights over this service account.",
              "type": "string"
            },
            "mail": {
              "description": "Set the mail address, can be set multiple times for multiple addresses. The first listed\nmail address is the 'primary'.",
              "items": {
                "type": "string"
              },
              "nullable": true,
              "type": [
                "array",
                "null"
              ]
            }
          },
          "required": [
            "displayname",
            "entryManagedBy"
          ],
          "type": "object"
        }
      },
      "required": [
        "kanidmRef",
        "serviceAccountAttributes"
      ],
      "type": "object"
    },
    "status": {
      "additionalProperties": false,
      "description": "Most recent observed status of the Kanidm Service Account. Read-only.\nMore info:\nhttps://github.com/kubernetes/community/blob/master/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
      "nullable": true,
      "properties": {
        "apiTokens": {
          "items": {
            "additionalProperties": false,
            "properties": {
              "expiry": {
                "description": "Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON.  Wrappers are provided for many of the factory methods that the time package offers.",
                "format": "date-time",
                "nullable": true,
                "type": [
                  "string",
                  "null"
                ]
              },
              "label": {
                "type": "string"
              },
              "purpose": {
                "default": "readonly",
                "enum": [
                  "readonly",
                  "readwrite"
                ],
                "type": [
                  "string",
                  "null"
                ]
              },
              "secretName": {
                "nullable": true,
                "type": [
                  "string",
                  "null"
                ]
              },
              "tokenId": {
                "description": "The unique identifier for this API token in Kanidm, used for management operations.",
                "type": "string"
              }
            },
            "required": [
              "label",
              "tokenId"
            ],
            "type": "object"
          },
          "type": "array"
        },
        "conditions": {
          "items": {
            "additionalProperties": false,
            "description": "Condition contains details for one aspect of the current state of this API Resource.",
            "properties": {
              "lastTransitionTime": {
                "description": "lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.",
                "format": "date-time",
                "type": "string"
              },
              "message": {
                "description": "message is a human readable message indicating details about the transition. This may be an empty string.",
                "type": "string"
              },
              "observedGeneration": {
                "description": "observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.",
                "format": "int64",
                "type": [
                  "integer",
                  "null"
                ]
              },
              "reason": {
                "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.",
                "type": "string"
              },
              "status": {
                "description": "status of the condition, one of True, False, Unknown.",
                "type": "string"
              },
              "type": {
                "description": "type of condition in CamelCase or in foo.example.com/CamelCase.",
                "type": "string"
              }
            },
            "required": [
              "lastTransitionTime",
              "message",
              "reason",
              "status",
              "type"
            ],
            "type": "object"
          },
          "nullable": true,
          "type": [
            "array",
            "null"
          ]
        },
        "credentialsSecret": {
          "nullable": true,
          "type": [
            "string",
            "null"
          ]
        },
        "gid": {
          "format": "uint32",
          "minimum": 0,
          "nullable": true,
          "type": [
            "integer",
            "null"
          ]
        },
        "kanidmRef": {
          "type": "string"
        },
        "ready": {
          "type": "boolean"
        }
      },
      "required": [
        "apiTokens",
        "kanidmRef",
        "ready"
      ],
      "type": [
        "object",
        "null"
      ]
    }
  },
  "required": [
    "spec"
  ],
  "title": "KanidmServiceAccount",
  "type": "object"
}