/*
Copyright (c) 2020 SAP SE or an SAP affiliate company. All rights reserved. This file is licensed under the Apache Software License, v. 2 except as noted otherwise in the LICENSE file

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

     http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

// This file was autogenerated by go-to-protobuf. Do not edit it manually!

syntax = 'proto2';

package github.com.gardener.gardener.pkg.apis.settings.v1alpha1;

import "k8s.io/apimachinery/pkg/apis/meta/v1/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/generated.proto";
import "k8s.io/apimachinery/pkg/runtime/schema/generated.proto";

// Package-wide variables from generator "generated".
option go_package = "v1alpha1";

// ClusterOpenIDConnectPreset is a OpenID Connect configuration that is applied
// to a Shoot objects cluster-wide.
message ClusterOpenIDConnectPreset {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec is the specification of this OpenIDConnect preset.
  optional ClusterOpenIDConnectPresetSpec spec = 2;
}

// ClusterOpenIDConnectPresetList is a collection of ClusterOpenIDConnectPresets.
message ClusterOpenIDConnectPresetList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of ClusterOpenIDConnectPresets.
  repeated ClusterOpenIDConnectPreset items = 2;
}

// ClusterOpenIDConnectPresetSpec contains the OpenIDConnect specification and
// project selector matching Shoots in Projects.
message ClusterOpenIDConnectPresetSpec {
  optional OpenIDConnectPresetSpec openIDConnectPresetSpec = 1;

  // Project decides whether to apply the configuration if the
  // Shoot is in a specific Project mathching the label selector.
  // Use the selector only if the OIDC Preset is opt-in, because end
  // users may skip the admission by setting the labels.
  // Default to the empty LabelSelector, which matches everything.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector projectSelector = 2;
}

// KubeAPIServerOpenIDConnect contains configuration settings for the OIDC provider.
// Note: Descriptions were taken from the Kubernetes documentation.
message KubeAPIServerOpenIDConnect {
  // If set, the OpenID server's certificate will be verified by one of the authorities in the oidc-ca-file, otherwise the host's root CA set will be used.
  // +optional
  optional string caBundle = 1;

  // The client ID for the OpenID Connect client.
  // Required.
  optional string clientID = 2;

  // If provided, the name of a custom OpenID Connect claim for specifying user groups. The claim value is expected to be a string or array of strings. This field is experimental, please see the authentication documentation for further details.
  // +optional
  optional string groupsClaim = 3;

  // If provided, all groups will be prefixed with this value to prevent conflicts with other authentication strategies.
  // +optional
  optional string groupsPrefix = 4;

  // The URL of the OpenID issuer, only HTTPS scheme will be accepted. If set, it will be used to verify the OIDC JSON Web Token (JWT).
  // Required.
  optional string issuerURL = 5;

  // key=value pairs that describes a required claim in the ID Token. If set, the claim is verified to be present in the ID Token with a matching value.
  // Only applied when the Kubernetes version of the Shoot is >= 1.11
  // +optional
  map<string, string> requiredClaims = 6;

  // List of allowed JOSE asymmetric signing algorithms. JWTs with a 'alg' header value not in this list will be rejected. Values are defined by RFC 7518 https://tools.ietf.org/html/rfc7518#section-3.1
  // Defaults to [RS256]
  // +optional
  repeated string signingAlgs = 7;

  // The OpenID claim to use as the user name. Note that claims other than the default ('sub') is not guaranteed to be unique and immutable. This field is experimental, please see the authentication documentation for further details.
  // Defaults to "sub".
  // +optional
  optional string usernameClaim = 8;

  // If provided, all usernames will be prefixed with this value. If not provided, username claims other than 'email' are prefixed by the issuer URL to avoid clashes. To skip any prefixing, provide the value '-'.
  // +optional
  optional string usernamePrefix = 9;
}

// OpenIDConnectClientAuthentication contains configuration for OIDC clients.
message OpenIDConnectClientAuthentication {
  // The client Secret for the OpenID Connect client.
  // +optional
  optional string secret = 1;

  // Extra configuration added to kubeconfig's auth-provider.
  // Must not be any of idp-issuer-url, client-id, client-secret, idp-certificate-authority, idp-certificate-authority-data, id-token or refresh-token
  // +optional
  map<string, string> extraConfig = 2;
}

// OpenIDConnectPreset is a OpenID Connect configuration that is applied
// to a Shoot in a namespace.
message OpenIDConnectPreset {
  // Standard object metadata.
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;

  // Spec is the specification of this OpenIDConnect preset.
  optional OpenIDConnectPresetSpec spec = 2;
}

// OpenIDConnectPresetList is a collection of OpenIDConnectPresets.
message OpenIDConnectPresetList {
  // Standard list object metadata.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.ListMeta metadata = 1;

  // Items is the list of OpenIDConnectPresets.
  repeated OpenIDConnectPreset items = 2;
}

// OpenIDConnectPresetSpec contains the Shoot selector for which
// a specific OpenID Connect configuration is applied.
message OpenIDConnectPresetSpec {
  // Server contains the kube-apiserver's OpenID Connect configuration.
  // This configuration is not overwritting any existing OpenID Connect
  // configuration already set on the Shoot object.
  optional KubeAPIServerOpenIDConnect server = 1;

  // Client contains the configuration used for client OIDC authentication
  // of Shoot clusters.
  // This configuration is not overwritting any existing OpenID Connect
  // client authentication already set on the Shoot object.
  // +optional
  optional OpenIDConnectClientAuthentication client = 2;

  // ShootSelector decides whether to apply the configuration if the
  // Shoot has matching labels.
  // Use the selector only if the OIDC Preset is opt-in, because end
  // users may skip the admission by setting the labels.
  // Default to the empty LabelSelector, which matches everything.
  // +optional
  optional k8s.io.apimachinery.pkg.apis.meta.v1.LabelSelector shootSelector = 3;

  // Weight associated with matching the corresponding preset,
  // in the range 1-100.
  // Required.
  optional int32 weight = 4;
}