kind: CustomResourceDefinition
spec:
  group: authentication.stackable.tech
  names:
    kind: AuthenticationClass
    plural: authenticationclasses
    singular: authenticationclass
    categories: []
    shortNames: []
  scope: Cluster
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          type: object
          title: AuthenticationClass
          required:
            - spec
          properties:
            spec:
              type: object
              required:
                - provider
              properties:
                provider:
                  type: object
                  oneOf:
                    - required:
                        - static
                    - required:
                        - ldap
                    - required:
                        - oidc
                    - required:
                        - tls
                    - required:
                        - kerberos
                  properties:
                    tls:
                      type: object
                      properties:
                        clientCertSecretClass:
                          type: string
                          nullable: true
                          description: |-
                            See [ADR017: TLS authentication](https://docs.stackable.tech/home/26.3/contributor/adr/adr017-tls_authentication).
                            If `client_cert_secret_class` is not set, the TLS settings may also be used for client authentication.
                            If `client_cert_secret_class` is set, the [SecretClass](https://docs.stackable.tech/home/26.3/secret-operator/secretclass)
                            will be used to provision client certificates.
                      description: |-
                        The [TLS provider](https://docs.stackable.tech/home/26.3/concepts/authentication#_tls).
                        The TLS AuthenticationClass is used when users should authenticate themselves with a
                        TLS certificate.
                    ldap:
                      type: object
                      required:
                        - hostname
                      properties:
                        tls:
                          type: object
                          nullable: true
                          required:
                            - verification
                          properties:
                            verification:
                              type: object
                              oneOf:
                                - required:
                                    - none
                                - required:
                                    - server
                              properties:
                                none:
                                  type: object
                                  description: Use TLS but don't verify certificates.
                                server:
                                  type: object
                                  required:
                                    - caCert
                                  properties:
                                    caCert:
                                      type: object
                                      oneOf:
                                        - required:
                                            - webPki
                                        - required:
                                            - secretClass
                                      properties:
                                        webPki:
                                          type: object
                                          description: >-
                                            Use TLS and the CA certificates
                                            trusted by the common web browsers
                                            to verify the server.

                                            This can be useful when you e.g. use
                                            public AWS S3 or other public
                                            available services.
                                        secretClass:
                                          type: string
                                          description: |-
                                            Name of the [SecretClass](https://docs.stackable.tech/home/26.3/secret-operator/secretclass) which will provide the CA certificate.
                                            Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
                                            so if you got provided with a CA cert but don't have access to the key you can still use this method.
                                      description: CA cert to verify the server.
                                  description: Use TLS and a CA certificate to verify the server.
                              description: The verification method used to verify the certificates of the
                                server and/or the client.
                          description: Use a TLS connection. If not specified no TLS will be used.
                        port:
                          type: integer
                          format: uint16
                          maximum: 65535
                          minimum: 0
                          nullable: true
                          description: Port of the LDAP server. If TLS is used defaults to 636 otherwise
                            to 389.
                        hostname:
                          type: string
                          description: "Host of the LDAP server, for example: `my.ldap.server` or
                            `127.0.0.1`."
                        searchBase:
                          type: string
                          default: ""
                          description: "LDAP search base, for example: `ou=users,dc=example,dc=org`."
                        searchFilter:
                          type: string
                          default: ""
                          description: "LDAP query to filter users, for example:
                            `(memberOf=cn=myTeam,ou=teams,dc=example,dc=org)`."
                        ldapFieldNames:
                          type: object
                          default:
                            uid: uid
                            email: mail
                            group: memberof
                            surname: sn
                            givenName: givenName
                          properties:
                            uid:
                              type: string
                              default: uid
                              description: The name of the username field
                            email:
                              type: string
                              default: mail
                              description: The name of the email field
                            group:
                              type: string
                              default: memberof
                              description: The name of the group field
                            surname:
                              type: string
                              default: sn
                              description: The name of the lastname field
                            givenName:
                              type: string
                              default: givenName
                              description: The name of the firstname field
                          description: The name of the LDAP object fields.
                        bindCredentials:
                          type: object
                          nullable: true
                          required:
                            - secretClass
                          properties:
                            scope:
                              type: object
                              nullable: true
                              properties:
                                pod:
                                  type: boolean
                                  default: false
                                  description: >-
                                    The pod scope is resolved to the name of the
                                    Kubernetes Pod.

                                    This allows the secret to differentiate
                                    between StatefulSet replicas.
                                node:
                                  type: boolean
                                  default: false
                                  description: >-
                                    The node scope is resolved to the name of
                                    the Kubernetes Node object that the Pod is
                                    running on.

                                    This will typically be the DNS name of the
                                    node.
                                services:
                                  type: array
                                  items:
                                    type: string
                                  default: []
                                  description: >-
                                    The service scope allows Pod objects to
                                    specify custom scopes.

                                    This should typically correspond to Service
                                    objects that the Pod participates in.
                                listenerVolumes:
                                  type: array
                                  items:
                                    type: string
                                  default: []
                                  description: >-
                                    The listener volume scope allows Node and
                                    Service scopes to be inferred from the
                                    applicable listeners.

                                    This must correspond to Volume names in the
                                    Pod that mount Listeners.
                              description: |-
                                [Scope](https://docs.stackable.tech/home/26.3/secret-operator/scope) of the
                                [SecretClass](https://docs.stackable.tech/home/26.3/secret-operator/secretclass).
                            secretClass:
                              type: string
                              description: "[SecretClass](https://docs.stackable.tech/home/26.3/secret-operat\
                                or/secretclass) containing the LDAP bind
                                credentials."
                          description: In case you need a special account for searching the LDAP server
                            you can specify it here.
                      description: |-
                        The [LDAP provider](https://docs.stackable.tech/home/26.3/concepts/authentication#_ldap).
                        There is also the ["Authentication with LDAP" tutorial](https://docs.stackable.tech/home/26.3/tutorials/authentication_with_openldap)
                        where you can learn to configure Superset and Trino with OpenLDAP.
                    oidc:
                      type: object
                      required:
                        - hostname
                        - principalClaim
                        - scopes
                      properties:
                        tls:
                          type: object
                          nullable: true
                          required:
                            - verification
                          properties:
                            verification:
                              type: object
                              oneOf:
                                - required:
                                    - none
                                - required:
                                    - server
                              properties:
                                none:
                                  type: object
                                  description: Use TLS but don't verify certificates.
                                server:
                                  type: object
                                  required:
                                    - caCert
                                  properties:
                                    caCert:
                                      type: object
                                      oneOf:
                                        - required:
                                            - webPki
                                        - required:
                                            - secretClass
                                      properties:
                                        webPki:
                                          type: object
                                          description: >-
                                            Use TLS and the CA certificates
                                            trusted by the common web browsers
                                            to verify the server.

                                            This can be useful when you e.g. use
                                            public AWS S3 or other public
                                            available services.
                                        secretClass:
                                          type: string
                                          description: |-
                                            Name of the [SecretClass](https://docs.stackable.tech/home/26.3/secret-operator/secretclass) which will provide the CA certificate.
                                            Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
                                            so if you got provided with a CA cert but don't have access to the key you can still use this method.
                                      description: CA cert to verify the server.
                                  description: Use TLS and a CA certificate to verify the server.
                              description: The verification method used to verify the certificates of the
                                server and/or the client.
                          description: Use a TLS connection. If not specified no TLS will be used.
                        port:
                          type: integer
                          format: uint16
                          maximum: 65535
                          minimum: 0
                          nullable: true
                          description: >-
                            Port of the identity provider. If TLS is used
                            defaults to 443,

                            otherwise to 80.
                        scopes:
                          type: array
                          items:
                            type: string
                          description: >-
                            Scopes to request from your identity provider. It is
                            recommended to

                            request the `openid`, `email`, and `profile` scopes.
                        hostname:
                          type: string
                          description: Host of the identity provider, e.g. `my.keycloak.corp` or
                            `127.0.0.1`.
                        rootPath:
                          type: string
                          default: /
                          description: Root HTTP path of the identity provider. Defaults to `/`.
                        providerHint:
                          enum:
                            - Keycloak
                            - null
                          type: string
                          nullable: true
                          description: >-
                            This is a hint about which identity provider is used
                            by the

                            AuthenticationClass. Operators *can* opt to use this

                            value to enable known quirks around OIDC / OAuth
                            authentication.

                            Not providing a hint means there is no hint and OIDC
                            should be used as it is

                            intended to be used (via the `.well-known`
                            discovery).
                        principalClaim:
                          type: string
                          description: >-
                            If a product extracts some sort of "effective user"
                            that is represented by a

                            string internally, this config determines with claim
                            is used to extract that

                            string. It is desirable to use `sub` in here (or
                            some other stable identifier),

                            but in many cases you might need to use
                            `preferred_username` (e.g. in case of Keycloak)

                            or a different claim instead.


                            Please note that some products hard-coded the claim
                            in their implementation,

                            so some product operators might error out if the
                            product hardcodes a different

                            claim than configured here.


                            We don't provide any default value, as there is no
                            correct way of doing it

                            that works in all setups. Most demos will probably
                            use `preferred_username`,

                            although `sub` being more desirable, but technically
                            impossible with the current

                            behavior of the products.
                      description: The OIDC provider can be used to configure OpenID Connect.
                    static:
                      type: object
                      required:
                        - userCredentialsSecret
                      properties:
                        userCredentialsSecret:
                          type: object
                          required:
                            - name
                          properties:
                            name:
                              type: string
                              description: Name of the Secret.
                          description: >-
                            Secret providing the usernames and passwords.

                            The Secret must contain an entry for every user,
                            with the key being the username and the value the
                            password in plain text.

                            It must be located in the same namespace as the
                            product using it.
                      description: |-
                        The [static provider](https://https://docs.stackable.tech/home/26.3/concepts/authentication#_static)
                        is used to configure a static set of users, identified by username and password.
                    kerberos:
                      type: object
                      required:
                        - kerberosSecretClass
                      properties:
                        kerberosSecretClass:
                          type: string
                          description: Mandatory SecretClass used to obtain keytabs.
                      description: |-
                        The [Kerberos provider](https://docs.stackable.tech/home/26.3/concepts/authentication#_kerberos).
                        The Kerberos AuthenticationClass is used when users should authenticate themselves via
                        Kerberos.
                  description: Provider used for authentication like LDAP or Kerberos.
              description: |-
                The Stackable Platform uses the AuthenticationClass as a central mechanism to handle user
                authentication across supported products.

                The authentication mechanism needs to be configured only in the AuthenticationClass which is
                then referenced in the product. Multiple different authentication providers are supported.
                Learn more in the [authentication concept documentation][1] and the
                [Authentication with OpenLDAP tutorial][2].

                [1]: https://docs.stackable.tech/home/26.3/concepts/authentication
                [2]: https://docs.stackable.tech/home/26.3/tutorials/authentication_with_openldap
          description: Auto-generated derived type for AuthenticationClassSpec via
            `CustomResource`
      served: true
      storage: true
      subresources: {}
      additionalPrinterColumns: []
metadata:
  name: authenticationclasses.authentication.stackable.tech
apiVersion: apiextensions.k8s.io/v1
