# Source: https://raw.githubusercontent.com/vmware-tanzu/pinniped/v{version}/deploy/supervisor/idp.supervisor.pinniped.dev_ldapidentityproviders.yaml
# Version: 0.40.0
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.18.0
  name: ldapidentityproviders.idp.supervisor.pinniped.dev
spec:
  group: idp.supervisor.pinniped.dev
  names:
    categories:
    - pinniped
    - pinniped-idp
    - pinniped-idps
    kind: LDAPIdentityProvider
    listKind: LDAPIdentityProviderList
    plural: ldapidentityproviders
    singular: ldapidentityprovider
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.host
      name: Host
      type: string
    - jsonPath: .status.phase
      name: Status
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          LDAPIdentityProvider describes the configuration of an upstream Lightweight Directory Access
          Protocol (LDAP) identity provider.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec for configuring the identity provider.
            properties:
              bind:
                description: |-
                  Bind contains the configuration for how to provide access credentials during an initial bind to the LDAP server
                  to be allowed to perform searches and binds to validate a user's credentials during a user's authentication attempt.
                properties:
                  secretName:
                    description: |-
                      SecretName contains the name of a namespace-local Secret object that provides the username and
                      password for an LDAP bind user. This account will be used to perform LDAP searches. The Secret should be
                      of type "kubernetes.io/basic-auth" which includes "username" and "password" keys. The username value
                      should be the full dn (distinguished name) of your bind account, e.g. "cn=bind-account,ou=users,dc=example,dc=com".
                      The password must be non-empty.
                    minLength: 1
                    type: string
                required:
                - secretName
                type: object
              groupSearch:
                description: GroupSearch contains the configuration for searching
                  for a user's group membership in the LDAP provider.
                properties:
                  attributes:
                    description: |-
                      Attributes specifies how the group's information should be read from each LDAP entry which was found as
                      the result of the group search.
                    properties:
                      groupName:
                        description: |-
                          GroupName specifies the name of the attribute in the LDAP entries whose value shall become a group name
                          in the user's list of groups after a successful authentication.
                          The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
                          server in the user's entry. E.g. "cn" for common name. Distinguished names can be used by specifying lower-case "dn".
                          Optional. When not specified, the default will act as if the GroupName were specified as "dn" (distinguished name).
                        type: string
                    type: object
                  base:
                    description: |-
                      Base is the dn (distinguished name) that should be used as the search base when searching for groups. E.g.
                      "ou=groups,dc=example,dc=com". When not specified, no group search will be performed and
                      authenticated users will not belong to any groups from the LDAP provider. Also, when not specified,
                      the values of Filter, UserAttributeForFilter, Attributes, and SkipGroupRefresh are ignored.
                    type: string
                  filter:
                    description: |-
                      Filter is the LDAP search filter which should be applied when searching for groups for a user.
                      The pattern "{}" must occur in the filter at least once and will be dynamically replaced by the
                      value of an attribute of the user entry found as a result of the user search. Which attribute's
                      value is used to replace the placeholder(s) depends on the value of UserAttributeForFilter.
                      For more information about LDAP filters, see https://ldap.com/ldap-filters.
                      Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used.
                      Optional. When not specified, the default will act as if the Filter were specified as "member={}".
                    type: string
                  skipGroupRefresh:
                    description: |-
                      The user's group membership is refreshed as they interact with the supervisor
                      to obtain new credentials (as their old credentials expire).  This allows group
                      membership changes to be quickly reflected into Kubernetes clusters.  Since
                      group membership is often used to bind authorization policies, it is important
                      to keep the groups observed in Kubernetes clusters in-sync with the identity
                      provider.

                      In some environments, frequent group membership queries may result in a
                      significant performance impact on the identity provider and/or the supervisor.
                      The best approach to handle performance impacts is to tweak the group query
                      to be more performant, for example by disabling nested group search or by
                      using a more targeted group search base.

                      If the group search query cannot be made performant and you are willing to
                      have group memberships remain static for approximately a day, then set
                      skipGroupRefresh to true.  This is an insecure configuration as authorization
                      policies that are bound to group membership will not notice if a user has
                      been removed from a particular group until their next login.

                      This is an experimental feature that may be removed or significantly altered
                      in the future.  Consumers of this configuration should carefully read all
                      release notes before upgrading to ensure that the meaning of this field has
                      not changed.
                    type: boolean
                  userAttributeForFilter:
                    description: |-
                      UserAttributeForFilter specifies which attribute's value from the user entry found as a result of
                      the user search will be used to replace the "{}" placeholder(s) in the group search Filter.
                      For example, specifying "uid" as the UserAttributeForFilter while specifying
                      "&(objectClass=posixGroup)(memberUid={})" as the Filter would search for groups by replacing
                      the "{}" placeholder in the Filter with the value of the user's "uid" attribute.
                      Optional. When not specified, the default will act as if "dn" were specified. For example, leaving
                      UserAttributeForFilter unspecified while specifying "&(objectClass=groupOfNames)(member={})" as the Filter
                      would search for groups by replacing the "{}" placeholder(s) with the dn (distinguished name) of the user.
                    type: string
                type: object
              host:
                description: 'Host is the hostname of this LDAP identity provider,
                  i.e., where to connect. For example: ldap.example.com:636.'
                minLength: 1
                type: string
              tls:
                description: TLS contains the connection settings for how to establish
                  the connection to the Host.
                properties:
                  certificateAuthorityData:
                    description: X.509 Certificate Authority (base64-encoded PEM bundle).
                      If omitted, a default set of system roots will be trusted.
                    type: string
                  certificateAuthorityDataSource:
                    description: |-
                      Reference to a CA bundle in a secret or a configmap.
                      Any changes to the CA bundle in the secret or configmap will be dynamically reloaded.
                    properties:
                      key:
                        description: |-
                          Key is the key name within the secret or configmap from which to read the CA bundle.
                          The value found at this key in the secret or configmap must not be empty, and must be a valid PEM-encoded
                          certificate bundle.
                        minLength: 1
                        type: string
                      kind:
                        description: |-
                          Kind configures whether the CA bundle is being sourced from a Kubernetes secret or a configmap.
                          Allowed values are "Secret" or "ConfigMap".
                          "ConfigMap" uses a Kubernetes configmap to source CA Bundles.
                          "Secret" uses Kubernetes secrets of type kubernetes.io/tls or Opaque to source CA Bundles.
                        enum:
                        - Secret
                        - ConfigMap
                        type: string
                      name:
                        description: |-
                          Name is the resource name of the secret or configmap from which to read the CA bundle.
                          The referenced secret or configmap must be created in the same namespace where Pinniped Supervisor is installed.
                        minLength: 1
                        type: string
                    required:
                    - key
                    - kind
                    - name
                    type: object
                type: object
              userSearch:
                description: UserSearch contains the configuration for searching for
                  a user by name in the LDAP provider.
                properties:
                  attributes:
                    description: |-
                      Attributes specifies how the user's information should be read from the LDAP entry which was found as
                      the result of the user search.
                    properties:
                      uid:
                        description: |-
                          UID specifies the name of the attribute in the LDAP entry which whose value shall be used to uniquely
                          identify the user within this LDAP provider after a successful authentication. E.g. "uidNumber" or "objectGUID".
                          The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
                          server in the user's entry. Distinguished names can be used by specifying lower-case "dn".
                        minLength: 1
                        type: string
                      username:
                        description: |-
                          Username specifies the name of the attribute in the LDAP entry whose value shall become the username
                          of the user after a successful authentication. This would typically be the same attribute name used in
                          the user search filter, although it can be different. E.g. "mail" or "uid" or "userPrincipalName".
                          The value of this field is case-sensitive and must match the case of the attribute name returned by the LDAP
                          server in the user's entry. Distinguished names can be used by specifying lower-case "dn". When this field
                          is set to "dn" then the LDAPIdentityProviderUserSearch's Filter field cannot be blank, since the default
                          value of "dn={}" would not work.
                        minLength: 1
                        type: string
                    type: object
                  base:
                    description: |-
                      Base is the dn (distinguished name) that should be used as the search base when searching for users.
                      E.g. "ou=users,dc=example,dc=com".
                    minLength: 1
                    type: string
                  filter:
                    description: |-
                      Filter is the LDAP search filter which should be applied when searching for users. The pattern "{}" must occur
                      in the filter at least once and will be dynamically replaced by the username for which the search is being run.
                      E.g. "mail={}" or "&(objectClass=person)(uid={})". For more information about LDAP filters, see
                      https://ldap.com/ldap-filters.
                      Note that the dn (distinguished name) is not an attribute of an entry, so "dn={}" cannot be used.
                      Optional. When not specified, the default will act as if the Filter were specified as the value from
                      Attributes.Username appended by "={}". When the Attributes.Username is set to "dn" then the Filter must be
                      explicitly specified, since the default value of "dn={}" would not work.
                    type: string
                type: object
            required:
            - host
            type: object
          status:
            description: Status of the identity provider.
            properties:
              conditions:
                description: Represents the observations of an identity provider's
                  current state.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
              phase:
                default: Pending
                description: Phase summarizes the overall status of the LDAPIdentityProvider.
                enum:
                - Pending
                - Ready
                - Error
                type: string
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
