kind: CustomResourceDefinition
spec:
  group: secrets.stackable.tech
  names:
    kind: SecretClass
    plural: secretclasses
    singular: secretclass
    categories: []
    shortNames: []
  scope: Cluster
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          type: object
          title: SecretClass
          required:
            - spec
          properties:
            spec:
              type: object
              required:
                - backend
              properties:
                backend:
                  type: object
                  oneOf:
                    - required:
                        - k8sSearch
                    - required:
                        - autoTls
                    - required:
                        - kerberosKeytab
                  properties:
                    autoTls:
                      type: object
                      required:
                        - ca
                      properties:
                        ca:
                          type: object
                          required:
                            - secret
                          properties:
                            secret:
                              type: object
                              required:
                                - name
                                - namespace
                              properties:
                                name:
                                  type: string
                                  description: Name of the Secret being referred to.
                                namespace:
                                  type: string
                                  description: Namespace of the Secret being referred to.
                              description: Reference (name and namespace) to a Kubernetes Secret object where
                                the CA certificate and key is stored in the keys
                                `ca.crt` and `ca.key` respectively.
                            autoGenerate:
                              type: boolean
                              default: false
                              description: Whether the certificate authority should be managed by Secret
                                Operator, including being generated if it does
                                not already exist.
                            caCertificateLifetime:
                              type: string
                              default: 365d
                              description: >-
                                The lifetime of each generated certificate
                                authority.


                                Should always be more than double
                                `maxCertificateLifetime`.


                                If `autoGenerate: true` then the Secret Operator
                                will prepare a new CA certificate the old CA
                                approaches expiration. If `autoGenerate: false`
                                then the Secret Operator will log a warning
                                instead.
                          description: Configures the certificate authority used to issue Pod
                            certificates.
                        maxCertificateLifetime:
                          type: string
                          default: 15d
                          description: Maximum lifetime the created certificates are allowed to have. In
                            case consumers request a longer lifetime than
                            allowed by this setting, the lifetime will be the
                            minimum of both, so this setting takes precedence.
                            The default value is 15 days.
                      description: |-
                        The [`autoTls` backend](https://docs.stackable.tech/home/24.7/secret-operator/secretclass#backend-autotls) issues a TLS certificate signed by the Secret Operator. The certificate authority can be provided by the administrator, or managed automatically by the Secret Operator.

                        A new certificate and keypair will be generated and signed for each Pod, keys or certificates are never reused.
                    k8sSearch:
                      type: object
                      required:
                        - searchNamespace
                      properties:
                        searchNamespace:
                          type: object
                          oneOf:
                            - required:
                                - pod
                            - required:
                                - name
                          properties:
                            pod:
                              type: object
                              description: The Secret objects are located in the same namespace as the Pod
                                object. Should be used for Secrets that are
                                provisioned by the application administrator.
                            name:
                              type: string
                              description: The Secret objects are located in a single global namespace. Should
                                be used for secrets that are provisioned by the
                                cluster administrator.
                          description: Configures the namespace searched for Secret objects.
                      description: The [`k8sSearch`
                        backend](https://docs.stackable.tech/home/24.7/secret-operator/secretclass#backend-k8ssearch)
                        can be used to mount Secrets across namespaces into
                        Pods.
                    kerberosKeytab:
                      type: object
                      required:
                        - admin
                        - adminKeytabSecret
                        - adminPrincipal
                        - kdc
                        - realmName
                      properties:
                        kdc:
                          type: string
                          description: The hostname of the Kerberos Key Distribution Center (KDC). This
                            should be provided by the Kerberos administrator.
                        admin:
                          type: object
                          oneOf:
                            - required:
                                - mit
                            - required:
                                - activeDirectory
                          properties:
                            mit:
                              type: object
                              required:
                                - kadminServer
                              properties:
                                kadminServer:
                                  type: string
                                  description: The hostname of the Kerberos Admin Server. This should be provided
                                    by the Kerberos administrator.
                              description: Credentials should be provisioned in a MIT Kerberos Admin Server.
                            activeDirectory:
                              type: object
                              required:
                                - ldapServer
                                - ldapTlsCaSecret
                                - passwordCacheSecret
                                - schemaDistinguishedName
                                - userDistinguishedName
                              properties:
                                ldapServer:
                                  type: string
                                  description: An AD LDAP server, such as the AD Domain Controller. This must
                                    match the server’s FQDN, or GSSAPI
                                    authentication will fail.
                                ldapTlsCaSecret:
                                  type: object
                                  required:
                                    - name
                                    - namespace
                                  properties:
                                    name:
                                      type: string
                                      description: Name of the Secret being referred to.
                                    namespace:
                                      type: string
                                      description: Namespace of the Secret being referred to.
                                  description: Reference (name and namespace) to a Kubernetes Secret object
                                    containing the TLS CA (in `ca.crt`) that the
                                    LDAP server’s certificate should be
                                    authenticated against.
                                passwordCacheSecret:
                                  type: object
                                  required:
                                    - name
                                    - namespace
                                  properties:
                                    name:
                                      type: string
                                      description: Name of the Secret being referred to.
                                    namespace:
                                      type: string
                                      description: Namespace of the Secret being referred to.
                                  description: Reference (name and namespace) to a Kubernetes Secret object where
                                    workload passwords will be stored. This must
                                    not be accessible to end users.
                                userDistinguishedName:
                                  type: string
                                  description: The root Distinguished Name (DN) where service accounts should be
                                    provisioned, typically
                                    `CN=Users,{domain_dn}`.
                                schemaDistinguishedName:
                                  type: string
                                  description: The root Distinguished Name (DN) for AD-managed schemas, typically
                                    `CN=Schema,CN=Configuration,{domain_dn}`.
                              description: Credentials should be provisioned in a Microsoft Active Directory
                                domain.
                          description: Kerberos admin configuration settings.
                        realmName:
                          type: string
                          description: The name of the Kerberos realm. This should be provided by the
                            Kerberos administrator.
                        adminPrincipal:
                          type: string
                          description: The admin principal.
                        adminKeytabSecret:
                          type: object
                          required:
                            - name
                            - namespace
                          properties:
                            name:
                              type: string
                              description: Name of the Secret being referred to.
                            namespace:
                              type: string
                              description: Namespace of the Secret being referred to.
                          description: Reference (`name` and `namespace`) to a K8s Secret object where a
                            keytab with administrative privileges is stored in
                            the key `keytab`.
                      description: The [`kerberosKeytab`
                        backend](https://docs.stackable.tech/home/24.7/secret-operator/secretclass#backend-kerberoskeytab)
                        creates a Kerberos keytab file for a selected realm. The
                        Kerberos KDC and administrator credentials must be
                        provided by the administrator.
                  description: Each SecretClass is associated with a single
                    [backend](https://docs.stackable.tech/home/24.7/secret-operator/secretclass#backend),
                    which dictates the mechanism for issuing that kind of
                    Secret.
              description: A
                [SecretClass](https://docs.stackable.tech/home/24.7/secret-operator/secretclass)
                is a cluster-global Kubernetes resource that defines a category
                of secrets that the Secret Operator knows how to provision.
          description: Auto-generated derived type for SecretClassSpec via `CustomResource`
      served: true
      storage: true
      subresources: {}
      additionalPrinterColumns: []
metadata:
  name: secretclasses.secrets.stackable.tech
  annotations:
    helm.sh/resource-policy: keep
apiVersion: apiextensions.k8s.io/v1
