---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    helm.sh/resource-policy: keep
    controller-gen.kubebuilder.io/version: v0.17.3
  name: iams.observability.pingcap.com
spec:
  group: observability.pingcap.com
  names:
    kind: IAM
    listKind: IAMList
    plural: iams
    singular: iam
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.phase
      name: PHASE
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: AGE
      type: date
    name: v1
    schema:
      openAPIV3Schema:
        description: IAM is the Schema for the iams API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: IAMSpec defines the desired state of IAM
            properties:
              aliCloud:
                properties:
                  account:
                    description: Account is the AliCloud account where this role should
                      be created
                    type: string
                  assumeRolePolicyDocument:
                    description: AssumeRolePolicyDocument is IAM AssumeRolePolicyDocument's
                      base64 encoding
                    type: string
                  lastAssumeRolePolicyDocument:
                    description: LastAssumeRolePolicyDocument is last version IAM
                      AssumeRolePolicyDocument's base64 encoding
                    type: string
                  policies:
                    items:
                      properties:
                        policyDocument:
                          description: PolicyDocument is IAM PolicyDocument's base64
                            encoding
                          type: string
                        policyName:
                          type: string
                      type: object
                    type: array
                type: object
              aws:
                properties:
                  account:
                    description: Account is the aws account where should create this
                      role
                    type: string
                  assumeRolePolicyDocument:
                    description: AssumeRolePolicyDocument is IAM AssumeRolePolicyDocument's
                      base64 encoding
                    type: string
                  lastAssumeRolePolicyDocument:
                    description: LastAssumeRolePolicyDocument is last version IAM
                      AssumeRolePolicyDocument's base64 encoding
                    type: string
                  policies:
                    items:
                      properties:
                        policyDocument:
                          description: PolicyDocument is IAM PolicyDocument's base64
                            encoding
                          type: string
                        policyName:
                          type: string
                      type: object
                    type: array
                type: object
              azure:
                properties:
                  additionalRoleMembers:
                    description: additional principal ID of azure identities for role
                      assignment.
                    items:
                      type: string
                    type: array
                  lastAdditionalRoleMembers:
                    description: |-
                      LastAdditionalRoleMembers stores the last applied principal IDs.
                      It is used by controller to remove stale role assignments when members are changed.
                    items:
                      type: string
                    type: array
                  resourceGroup:
                    type: string
                  roleCondition:
                    type: string
                  roleScope:
                    description: |-
                      Scope at which the role assignment or definition applies to
                      e.g. blob storage container: /subscriptions/xxx/resourceGroups/xxx/providers/Microsoft.Storage/storageAccounts/xxx/blobServices/default/containers/xxx
                    type: string
                  subscriptionID:
                    description: SubscriptionID is the azure subscription id where
                      should create this service account
                    type: string
                  useExternalPrincipal:
                    description: |-
                      UseExternalPrincipal means using externally provided principal IDs only.
                      In this mode, controller skips creating user-assigned identity and federated identity,
                      and only manages role assignments for AdditionalRoleMembers.
                    type: boolean
                  workloadOIDCIssuer:
                    type: string
                  workloadServiceAccounts:
                    items:
                      type: string
                    type: array
                type: object
              gcp:
                properties:
                  assumeRoleAccounts:
                    description: AssumeRoleAccounts is account email address who can
                      access this service account
                    items:
                      type: string
                    type: array
                  lastAssumeRoleAccounts:
                    description: LastAssumeRoleAccounts is account email address of
                      last version who can access this service account
                    items:
                      type: string
                    type: array
                  policies:
                    additionalProperties:
                      items:
                        properties:
                          policyCondition:
                            type: string
                          policyName:
                            description: PolicyName used to build condition title(prefix
                              + accountName + PolicyName)
                            type: string
                          policyRole:
                            type: string
                        type: object
                      type: array
                    type: object
                  projectID:
                    description: ProjectID is the gcp project id where should create
                      this service account
                    type: string
                  useExternalPrincipal:
                    description: |-
                      UseExternalPrincipal means using externally provided principals only.
                      In this mode, controller skips creating/updating service account IAM and
                      only manages bucket policy bindings for AssumeRoleAccounts.
                    type: boolean
                type: object
            type: object
          status:
            description: IAMStatus defines the observed state of IAM
            properties:
              arn:
                type: string
              clientID:
                type: string
              phase:
                description: Phase is the now status for IAM resource
                type: string
              principalID:
                type: string
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}