kind: CustomResourceDefinition
spec:
  group: authentication.stackable.tech
  names:
    kind: AuthenticationClass
    plural: authenticationclasses
    singular: authenticationclass
    categories: []
    shortNames: []
  scope: Cluster
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          type: object
          title: AuthenticationClass
          required:
            - spec
          properties:
            spec:
              type: object
              required:
                - provider
              properties:
                provider:
                  type: object
                  oneOf:
                    - required:
                        - ldap
                    - required:
                        - tls
                    - required:
                        - static
                  properties:
                    tls:
                      type: object
                      properties:
                        clientCertSecretClass:
                          type: string
                          nullable: true
                          description: See
                            `<https://docs.stackable.tech/home/contributor/adr/ADR016-tls-authentication.html>`.
                            If `client_cert_secret_class` is not set, the TLS
                            settings may also be used for client authentication.
                            If `client_cert_secret_class` is set, the
                            [SecretClass](https://docs.stackable.tech/secret-operator/secretclass.html)
                            will be used to provision client certificates.
                    ldap:
                      type: object
                      required:
                        - hostname
                      properties:
                        tls:
                          type: object
                          nullable: true
                          required:
                            - verification
                          properties:
                            verification:
                              type: object
                              oneOf:
                                - required:
                                    - none
                                - required:
                                    - server
                              properties:
                                none:
                                  type: object
                                  description: Use TLS but don't verify certificates
                                server:
                                  type: object
                                  required:
                                    - caCert
                                  properties:
                                    caCert:
                                      type: object
                                      oneOf:
                                        - required:
                                            - webPki
                                        - required:
                                            - secretClass
                                      properties:
                                        webPki:
                                          type: object
                                          description: Use TLS and the ca certificates trusted by the common web browsers
                                            to verify the server. This can be
                                            useful when you e.g. use public AWS
                                            S3 or other public available
                                            services.
                                        secretClass:
                                          type: string
                                          description: Name of the SecretClass which will provide the ca cert. Note that a
                                            SecretClass does not need to have a
                                            key but can also work with just a ca
                                            cert. So if you got provided with a
                                            ca cert but don't have access to the
                                            key you can still use this method.
                                      description: Ca cert to verify the server
                                  description: Use TLS and ca certificate to verify the server
                              description: The verification method used to verify the certificates of the
                                server and/or the client
                          description: Use a TLS connection. If not specified no TLS will be used
                        port:
                          type: integer
                          format: uint16
                          minimum: 0
                          nullable: true
                          description: Port of the LDAP server. If TLS is used defaults to 636 otherwise
                            to 389
                        hostname:
                          type: string
                          description: Hostname of the LDAP server
                        searchBase:
                          type: string
                          default: ""
                          description: LDAP search base
                        searchFilter:
                          type: string
                          default: ""
                          description: LDAP query to filter users
                        ldapFieldNames:
                          type: object
                          default:
                            uid: uid
                            email: mail
                            group: memberof
                            surname: sn
                            givenName: givenName
                          properties:
                            uid:
                              type: string
                              default: uid
                              description: The name of the username field
                            email:
                              type: string
                              default: mail
                              description: The name of the email field
                            group:
                              type: string
                              default: memberof
                              description: The name of the group field
                            surname:
                              type: string
                              default: sn
                              description: The name of the lastname field
                            givenName:
                              type: string
                              default: givenName
                              description: The name of the firstname field
                          description: The name of the LDAP object fields
                        bindCredentials:
                          type: object
                          nullable: true
                          required:
                            - secretClass
                          properties:
                            scope:
                              type: object
                              nullable: true
                              properties:
                                pod:
                                  type: boolean
                                  default: false
                                node:
                                  type: boolean
                                  default: false
                                services:
                                  type: array
                                  items:
                                    type: string
                                  default: []
                              description: "[Scope](https://docs.stackable.tech/secret-operator/scope.html) of
                                the
                                [SecretClass](https://docs.stackable.tech/secre\
                                t-operator/secretclass.html)"
                            secretClass:
                              type: string
                              description: "[SecretClass](https://docs.stackable.tech/secret-operator/secretc\
                                lass.html) containing the LDAP bind credentials"
                          description: In case you need a special account for searching the LDAP server
                            you can specify it here
                    static:
                      type: object
                      required:
                        - userCredentialsSecret
                      properties:
                        userCredentialsSecret:
                          type: object
                          required:
                            - name
                          properties:
                            name:
                              type: string
                              description: Name of the secret
                          description: Secret providing the usernames and password. The secret must
                            contain an entry for every user, with the key being
                            the username and the value the password in plain
                            text. It must be located in the same namespace as
                            the product using it.
                  description: Provider used for authentication like LDAP or Kerberos
          description: Auto-generated derived type for AuthenticationClassSpec via
            `CustomResource`
      served: true
      storage: true
      subresources: {}
      additionalPrinterColumns: []
metadata:
  name: authenticationclasses.authentication.stackable.tech
  annotations:
    helm.sh/resource-policy: keep
apiVersion: apiextensions.k8s.io/v1
