---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
  name: capsuleconfigurations.capsule.clastix.io
spec:
  group: capsule.clastix.io
  names:
    kind: CapsuleConfiguration
    listKind: CapsuleConfigurationList
    plural: capsuleconfigurations
    singular: capsuleconfiguration
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: Reconcile status
      jsonPath: .status.conditions[?(@.type=="Ready")].status
      name: Ready
      type: string
    - description: Reconcile Message
      jsonPath: .status.conditions[?(@.type=="Ready")].message
      name: Status
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: CapsuleConfiguration is the Schema for the Capsule configuration
          API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: CapsuleConfigurationSpec defines the Capsule configuration.
            properties:
              administrators:
                description: |-
                  Define entities which can act as Administrators in the capsule construct
                  These entities are automatically owners for all existing tenants. Meaning they can add namespaces to any tenant. However they must be specific by using the capsule label
                  for interacting with namespaces. Because if that label is not defined, it's assumed that namespace interaction was not targeted towards a tenant and will therefore
                  be ignored by capsule.
                items:
                  properties:
                    kind:
                      description: Kind of entity. Possible values are "User", "Group",
                        and "ServiceAccount"
                      enum:
                      - User
                      - Group
                      - ServiceAccount
                      type: string
                    name:
                      description: Name of the entity.
                      type: string
                  required:
                  - kind
                  - name
                  type: object
                type: array
              admission:
                description: Configuration for dynamic Validating and Mutating Admission
                  webhooks managed by Capsule.
                properties:
                  mutating:
                    description: Configure dynamic Mutating Admission for Capsule
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        description: Annotations added to the Admission Webhook
                        type: object
                      client:
                        description: |-
                          Client defines how the Kubernetes API server reaches the admission webhook.
                          Exactly one of URL or Service must be configured.
                        properties:
                          caBundle:
                            description: |-
                              caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
                              If unspecified, system trust roots on the apiserver are used.
                            format: byte
                            type: string
                          service:
                            description: |-
                              service is a reference to the service for this webhook. Either
                              `service` or `url` must be specified.

                              If the webhook is running within the cluster, then you should use `service`.
                            properties:
                              name:
                                description: |-
                                  name is the name of the service.
                                  Required
                                type: string
                              namespace:
                                description: |-
                                  namespace is the namespace of the service.
                                  Required
                                type: string
                              path:
                                description: |-
                                  path is an optional URL path which will be sent in any request to
                                  this service.
                                type: string
                              port:
                                description: |-
                                  port is the port on the service that hosts the webhook.
                                  Default to 443 for backward compatibility.
                                  `port` should be a valid port number (1-65535, inclusive).
                                format: int32
                                type: integer
                            required:
                            - name
                            - namespace
                            type: object
                          url:
                            description: |-
                              url gives the location of the webhook, in standard URL form
                              (`scheme://host:port/path`). Exactly one of `url` or `service`
                              must be specified.

                              The `host` should not refer to a service running in the cluster; use
                              the `service` field instead. The host might be resolved via external
                              DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
                              in-cluster DNS as that would be a layering violation). `host` may
                              also be an IP address.

                              Please note that using `localhost` or `127.0.0.1` as a `host` is
                              risky unless you take great care to run this webhook on all hosts
                              which run an apiserver which might need to make calls to this
                              webhook. Such installs are likely to be non-portable, i.e., not easy
                              to turn up in a new cluster.

                              The scheme must be "https"; the URL must begin with "https://".

                              A path is optional, and if present may be any string permissible in
                              a URL. You may use the path to pass an arbitrary string to the
                              webhook, for example, a cluster identifier.

                              Attempting to use a user or basic auth e.g. "user:password@" is not
                              allowed. Fragments ("#...") and query parameters ("?...") are not
                              allowed, either.
                            type: string
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        description: Labels added to the Admission Webhook
                        type: object
                      name:
                        description: Name the Admission Webhook
                        maxLength: 63
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                        type: string
                      webhooks:
                        description: Define Dynamic Admission Webhooks
                        items:
                          properties:
                            admissionReviewVersions:
                              description: |-
                                AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
                                versions the Webhook expects. API server will try to use first version in
                                the list which it supports. If none of the versions specified in this list
                                supported by API server, validation will fail for this object.
                                If a persisted webhook configuration specifies allowed versions and does not
                                include any versions known to the API Server, calls to the webhook will fail
                                and be subject to the failure policy.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                            failurePolicy:
                              description: |-
                                FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
                                allowed values are Ignore or Fail. Defaults to Fail.
                              type: string
                            matchConditions:
                              description: |-
                                MatchConditions is a list of conditions that must be met for a request to be sent to this
                                webhook. Match conditions filter requests that have already been matched by the rules,
                                namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
                                There are a maximum of 64 match conditions allowed.

                                The exact matching logic is (in order):
                                  1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.
                                  2. If ALL matchConditions evaluate to TRUE, the webhook is called.
                                  3. If any matchCondition evaluates to an error (but none are FALSE):
                                     - If failurePolicy=Fail, reject the request
                                     - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
                              items:
                                description: MatchCondition represents a condition
                                  which must by fulfilled for a request to be sent
                                  to a webhook.
                                properties:
                                  expression:
                                    description: |-
                                      expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
                                      CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

                                      'object' - The object from the incoming request. The value is null for DELETE requests.
                                      'oldObject' - The existing object. The value is null for CREATE requests.
                                      'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
                                      'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
                                        See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
                                      'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
                                        request resource.
                                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

                                      Required.
                                    type: string
                                  name:
                                    description: |-
                                      name is an identifier for this match condition, used for strategic merging of MatchConditions,
                                      as well as providing an identifier for logging purposes. A good name should be descriptive of
                                      the associated expression.
                                      Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
                                      must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or
                                      '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
                                      optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

                                      Required.
                                    type: string
                                required:
                                - expression
                                - name
                                type: object
                              type: array
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
                            matchPolicy:
                              description: |-
                                matchPolicy defines how the "rules" list is used to match incoming requests.
                                Allowed values are "Exact" or "Equivalent".

                                - Exact: match a request only if it exactly matches a specified rule.
                                For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
                                but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
                                a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.

                                - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
                                For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
                                and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
                                a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.

                                Defaults to "Equivalent"
                              type: string
                            name:
                              description: |-
                                The name of the admission webhook.
                                Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
                                "imagepolicy" is the name of the webhook, and kubernetes.io is the name
                                of the organization.
                                Required.
                              type: string
                            namespaceSelector:
                              description: |-
                                NamespaceSelector decides whether to run the webhook on an object based
                                on whether the namespace for that object matches the selector. If the
                                object itself is a namespace, the matching is performed on
                                object.metadata.labels. If the object is another cluster scoped resource,
                                it never skips the webhook.

                                For example, to run the webhook on any objects whose namespace is not
                                associated with "runlevel" of "0" or "1";  you will set the selector as
                                follows:
                                "namespaceSelector": {
                                  "matchExpressions": [
                                    {
                                      "key": "runlevel",
                                      "operator": "NotIn",
                                      "values": [
                                        "0",
                                        "1"
                                      ]
                                    }
                                  ]
                                }

                                If instead you want to only run the webhook on any objects whose
                                namespace is associated with the "environment" of "prod" or "staging";
                                you will set the selector as follows:
                                "namespaceSelector": {
                                  "matchExpressions": [
                                    {
                                      "key": "environment",
                                      "operator": "In",
                                      "values": [
                                        "prod",
                                        "staging"
                                      ]
                                    }
                                  ]
                                }

                                See
                                https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
                                for more examples of label selectors.

                                Default to the empty LabelSelector, which matches everything.
                              properties:
                                matchExpressions:
                                  description: matchExpressions is a list of label
                                    selector requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description: key is the label key that the
                                          selector applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            objectSelector:
                              description: |-
                                ObjectSelector decides whether to run the webhook based on if the
                                object has matching labels. objectSelector is evaluated against both
                                the oldObject and newObject that would be sent to the webhook, and
                                is considered to match if either object matches the selector. A null
                                object (oldObject in the case of create, or newObject in the case of
                                delete) or an object that cannot have labels (like a
                                DeploymentRollback or a PodProxyOptions object) is not considered to
                                match.
                                Use the object selector only if the webhook is opt-in, because end
                                users may skip the admission webhook by setting the labels.
                                Default to the empty LabelSelector, which matches everything.
                              properties:
                                matchExpressions:
                                  description: matchExpressions is a list of label
                                    selector requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description: key is the label key that the
                                          selector applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            opts:
                              description: Capsule Custom Admission Options
                              properties:
                                administrators:
                                  default: false
                                  description: |-
                                    If enabled, the request is only sent to admission if the user is mentioned
                                    As Part of the Capsule Administrators
                                  type: boolean
                                capsuleUsers:
                                  default: false
                                  description: |-
                                    If enabled, the request is only sent to admission if the user is mentioned
                                    As Part of the Capsule Users
                                  type: boolean
                              required:
                              - administrators
                              - capsuleUsers
                              type: object
                            path:
                              description: |-
                                `path` is the URL path which will be sent in any request to
                                this service.
                              type: string
                            reinvocationPolicy:
                              description: |-
                                reinvocationPolicy indicates whether this webhook should be called multiple times as part of a single admission evaluation.
                                Allowed values are "Never" and "IfNeeded".

                                Never: the webhook will not be called more than once in a single admission evaluation.

                                IfNeeded: the webhook will be called at least one additional time as part of the admission evaluation
                                if the object being admitted is modified by other admission plugins after the initial webhook call.
                                Webhooks that specify this option *must* be idempotent, able to process objects they previously admitted.
                                Note:
                                * the number of additional invocations is not guaranteed to be exactly one.
                                * if additional invocations result in further modifications to the object, webhooks are not guaranteed to be invoked again.
                                * webhooks that use this option may be reordered to minimize the number of additional invocations.
                                * to validate an object after all mutations are guaranteed complete, use a validating admission webhook instead.

                                Defaults to "Never".
                              type: string
                            rules:
                              description: |-
                                Rules describes what operations on what resources/subresources the webhook cares about.
                                The webhook cares about an operation if it matches _any_ Rule.
                                However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
                                from putting the cluster in a state which cannot be recovered from without completely
                                disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
                                on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
                              items:
                                description: |-
                                  RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
                                  sure that all the tuple expansions are valid.
                                properties:
                                  apiGroups:
                                    description: |-
                                      apiGroups is the API groups the resources belong to. '*' is all groups.
                                      If '*' is present, the length of the slice must be one.
                                      Required.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  apiVersions:
                                    description: |-
                                      apiVersions is the API versions the resources belong to. '*' is all versions.
                                      If '*' is present, the length of the slice must be one.
                                      Required.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  operations:
                                    description: |-
                                      operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
                                      for all of those operations and any future admission operations that are added.
                                      If '*' is present, the length of the slice must be one.
                                      Required.
                                    items:
                                      description: OperationType specifies an operation
                                        for a request.
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  resources:
                                    description: |-
                                      resources is a list of resources this rule applies to.

                                      For example:
                                      'pods' means pods.
                                      'pods/log' means the log subresource of pods.
                                      '*' means all resources, but not subresources.
                                      'pods/*' means all subresources of pods.
                                      '*/scale' means all scale subresources.
                                      '*/*' means all resources and their subresources.

                                      If wildcard is present, the validation rule will ensure resources do not
                                      overlap with each other.

                                      Depending on the enclosing object, subresources might not be allowed.
                                      Required.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  scope:
                                    description: |-
                                      scope specifies the scope of this rule.
                                      Valid values are "Cluster", "Namespaced", and "*"
                                      "Cluster" means that only cluster-scoped resources will match this rule.
                                      Namespace API objects are cluster-scoped.
                                      "Namespaced" means that only namespaced resources will match this rule.
                                      "*" means that there are no scope restrictions.
                                      Subresources match the scope of their parent resource.
                                      Default is "*".
                                    type: string
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            sideEffects:
                              description: |-
                                SideEffects states whether this webhook has side effects.
                                Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
                                Webhooks with side effects MUST implement a reconciliation system, since a request may be
                                rejected by a future step in the admission chain and the side effects therefore need to be undone.
                                Requests with the dryRun attribute will be auto-rejected if they match a webhook with
                                sideEffects == Unknown or Some.
                              type: string
                            timeoutSeconds:
                              description: |-
                                TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
                                the webhook call will be ignored or the API call will fail based on the
                                failure policy.
                                The timeout value must be between 1 and 30 seconds.
                                Default to 10 seconds.
                              format: int32
                              type: integer
                          required:
                          - admissionReviewVersions
                          - name
                          - path
                          - sideEffects
                          type: object
                        type: array
                    required:
                    - client
                    type: object
                    x-kubernetes-validations:
                    - message: client must configure exactly one of url or service
                      rule: has(self.client.url) != has(self.client.service)
                  serviceName:
                    default: capsule-webhook-service
                    description: Service Name of the Admission Service
                    type: string
                  validating:
                    description: Configure dynamic Validating Admission for Capsule
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        description: Annotations added to the Admission Webhook
                        type: object
                      client:
                        description: |-
                          Client defines how the Kubernetes API server reaches the admission webhook.
                          Exactly one of URL or Service must be configured.
                        properties:
                          caBundle:
                            description: |-
                              caBundle is a PEM encoded CA bundle which will be used to validate the webhook's server certificate.
                              If unspecified, system trust roots on the apiserver are used.
                            format: byte
                            type: string
                          service:
                            description: |-
                              service is a reference to the service for this webhook. Either
                              `service` or `url` must be specified.

                              If the webhook is running within the cluster, then you should use `service`.
                            properties:
                              name:
                                description: |-
                                  name is the name of the service.
                                  Required
                                type: string
                              namespace:
                                description: |-
                                  namespace is the namespace of the service.
                                  Required
                                type: string
                              path:
                                description: |-
                                  path is an optional URL path which will be sent in any request to
                                  this service.
                                type: string
                              port:
                                description: |-
                                  port is the port on the service that hosts the webhook.
                                  Default to 443 for backward compatibility.
                                  `port` should be a valid port number (1-65535, inclusive).
                                format: int32
                                type: integer
                            required:
                            - name
                            - namespace
                            type: object
                          url:
                            description: |-
                              url gives the location of the webhook, in standard URL form
                              (`scheme://host:port/path`). Exactly one of `url` or `service`
                              must be specified.

                              The `host` should not refer to a service running in the cluster; use
                              the `service` field instead. The host might be resolved via external
                              DNS in some apiservers (e.g., `kube-apiserver` cannot resolve
                              in-cluster DNS as that would be a layering violation). `host` may
                              also be an IP address.

                              Please note that using `localhost` or `127.0.0.1` as a `host` is
                              risky unless you take great care to run this webhook on all hosts
                              which run an apiserver which might need to make calls to this
                              webhook. Such installs are likely to be non-portable, i.e., not easy
                              to turn up in a new cluster.

                              The scheme must be "https"; the URL must begin with "https://".

                              A path is optional, and if present may be any string permissible in
                              a URL. You may use the path to pass an arbitrary string to the
                              webhook, for example, a cluster identifier.

                              Attempting to use a user or basic auth e.g. "user:password@" is not
                              allowed. Fragments ("#...") and query parameters ("?...") are not
                              allowed, either.
                            type: string
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        description: Labels added to the Admission Webhook
                        type: object
                      name:
                        description: Name the Admission Webhook
                        maxLength: 63
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                        type: string
                      webhooks:
                        description: Define Dynamic Admission Webhooks
                        items:
                          properties:
                            admissionReviewVersions:
                              description: |-
                                AdmissionReviewVersions is an ordered list of preferred `AdmissionReview`
                                versions the Webhook expects. API server will try to use first version in
                                the list which it supports. If none of the versions specified in this list
                                supported by API server, validation will fail for this object.
                                If a persisted webhook configuration specifies allowed versions and does not
                                include any versions known to the API Server, calls to the webhook will fail
                                and be subject to the failure policy.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                            failurePolicy:
                              description: |-
                                FailurePolicy defines how unrecognized errors from the admission endpoint are handled -
                                allowed values are Ignore or Fail. Defaults to Fail.
                              type: string
                            matchConditions:
                              description: |-
                                MatchConditions is a list of conditions that must be met for a request to be sent to this
                                webhook. Match conditions filter requests that have already been matched by the rules,
                                namespaceSelector, and objectSelector. An empty list of matchConditions matches all requests.
                                There are a maximum of 64 match conditions allowed.

                                The exact matching logic is (in order):
                                  1. If ANY matchCondition evaluates to FALSE, the webhook is skipped.
                                  2. If ALL matchConditions evaluate to TRUE, the webhook is called.
                                  3. If any matchCondition evaluates to an error (but none are FALSE):
                                     - If failurePolicy=Fail, reject the request
                                     - If failurePolicy=Ignore, the error is ignored and the webhook is skipped
                              items:
                                description: MatchCondition represents a condition
                                  which must by fulfilled for a request to be sent
                                  to a webhook.
                                properties:
                                  expression:
                                    description: |-
                                      expression represents the expression which will be evaluated by CEL. Must evaluate to bool.
                                      CEL expressions have access to the contents of the AdmissionRequest and Authorizer, organized into CEL variables:

                                      'object' - The object from the incoming request. The value is null for DELETE requests.
                                      'oldObject' - The existing object. The value is null for CREATE requests.
                                      'request' - Attributes of the admission request(/pkg/apis/admission/types.go#AdmissionRequest).
                                      'authorizer' - A CEL Authorizer. May be used to perform authorization checks for the principal (user or service account) of the request.
                                        See https://pkg.go.dev/k8s.io/apiserver/pkg/cel/library#Authz
                                      'authorizer.requestResource' - A CEL ResourceCheck constructed from the 'authorizer' and configured with the
                                        request resource.
                                      Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/

                                      Required.
                                    type: string
                                  name:
                                    description: |-
                                      name is an identifier for this match condition, used for strategic merging of MatchConditions,
                                      as well as providing an identifier for logging purposes. A good name should be descriptive of
                                      the associated expression.
                                      Name must be a qualified name consisting of alphanumeric characters, '-', '_' or '.', and
                                      must start and end with an alphanumeric character (e.g. 'MyName',  or 'my.name',  or
                                      '123-abc', regex used for validation is '([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9]') with an
                                      optional DNS subdomain prefix and '/' (e.g. 'example.com/MyName')

                                      Required.
                                    type: string
                                required:
                                - expression
                                - name
                                type: object
                              type: array
                              x-kubernetes-list-map-keys:
                              - name
                              x-kubernetes-list-type: map
                            matchPolicy:
                              description: |-
                                matchPolicy defines how the "rules" list is used to match incoming requests.
                                Allowed values are "Exact" or "Equivalent".

                                - Exact: match a request only if it exactly matches a specified rule.
                                For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
                                but "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
                                a request to apps/v1beta1 or extensions/v1beta1 would not be sent to the webhook.

                                - Equivalent: match a request if modifies a resource listed in rules, even via another API group or version.
                                For example, if deployments can be modified via apps/v1, apps/v1beta1, and extensions/v1beta1,
                                and "rules" only included `apiGroups:["apps"], apiVersions:["v1"], resources: ["deployments"]`,
                                a request to apps/v1beta1 or extensions/v1beta1 would be converted to apps/v1 and sent to the webhook.

                                Defaults to "Equivalent"
                              type: string
                            name:
                              description: |-
                                The name of the admission webhook.
                                Name should be fully qualified, e.g., imagepolicy.kubernetes.io, where
                                "imagepolicy" is the name of the webhook, and kubernetes.io is the name
                                of the organization.
                                Required.
                              type: string
                            namespaceSelector:
                              description: |-
                                NamespaceSelector decides whether to run the webhook on an object based
                                on whether the namespace for that object matches the selector. If the
                                object itself is a namespace, the matching is performed on
                                object.metadata.labels. If the object is another cluster scoped resource,
                                it never skips the webhook.

                                For example, to run the webhook on any objects whose namespace is not
                                associated with "runlevel" of "0" or "1";  you will set the selector as
                                follows:
                                "namespaceSelector": {
                                  "matchExpressions": [
                                    {
                                      "key": "runlevel",
                                      "operator": "NotIn",
                                      "values": [
                                        "0",
                                        "1"
                                      ]
                                    }
                                  ]
                                }

                                If instead you want to only run the webhook on any objects whose
                                namespace is associated with the "environment" of "prod" or "staging";
                                you will set the selector as follows:
                                "namespaceSelector": {
                                  "matchExpressions": [
                                    {
                                      "key": "environment",
                                      "operator": "In",
                                      "values": [
                                        "prod",
                                        "staging"
                                      ]
                                    }
                                  ]
                                }

                                See
                                https://kubernetes.io/docs/concepts/overview/working-with-objects/labels
                                for more examples of label selectors.

                                Default to the empty LabelSelector, which matches everything.
                              properties:
                                matchExpressions:
                                  description: matchExpressions is a list of label
                                    selector requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description: key is the label key that the
                                          selector applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            objectSelector:
                              description: |-
                                ObjectSelector decides whether to run the webhook based on if the
                                object has matching labels. objectSelector is evaluated against both
                                the oldObject and newObject that would be sent to the webhook, and
                                is considered to match if either object matches the selector. A null
                                object (oldObject in the case of create, or newObject in the case of
                                delete) or an object that cannot have labels (like a
                                DeploymentRollback or a PodProxyOptions object) is not considered to
                                match.
                                Use the object selector only if the webhook is opt-in, because end
                                users may skip the admission webhook by setting the labels.
                                Default to the empty LabelSelector, which matches everything.
                              properties:
                                matchExpressions:
                                  description: matchExpressions is a list of label
                                    selector requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description: key is the label key that the
                                          selector applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            opts:
                              description: Capsule Custom Admission Options
                              properties:
                                administrators:
                                  default: false
                                  description: |-
                                    If enabled, the request is only sent to admission if the user is mentioned
                                    As Part of the Capsule Administrators
                                  type: boolean
                                capsuleUsers:
                                  default: false
                                  description: |-
                                    If enabled, the request is only sent to admission if the user is mentioned
                                    As Part of the Capsule Users
                                  type: boolean
                              required:
                              - administrators
                              - capsuleUsers
                              type: object
                            path:
                              description: |-
                                `path` is the URL path which will be sent in any request to
                                this service.
                              type: string
                            rules:
                              description: |-
                                Rules describes what operations on what resources/subresources the webhook cares about.
                                The webhook cares about an operation if it matches _any_ Rule.
                                However, in order to prevent ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks
                                from putting the cluster in a state which cannot be recovered from without completely
                                disabling the plugin, ValidatingAdmissionWebhooks and MutatingAdmissionWebhooks are never called
                                on admission requests for ValidatingWebhookConfiguration and MutatingWebhookConfiguration objects.
                              items:
                                description: |-
                                  RuleWithOperations is a tuple of Operations and Resources. It is recommended to make
                                  sure that all the tuple expansions are valid.
                                properties:
                                  apiGroups:
                                    description: |-
                                      apiGroups is the API groups the resources belong to. '*' is all groups.
                                      If '*' is present, the length of the slice must be one.
                                      Required.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  apiVersions:
                                    description: |-
                                      apiVersions is the API versions the resources belong to. '*' is all versions.
                                      If '*' is present, the length of the slice must be one.
                                      Required.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  operations:
                                    description: |-
                                      operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or *
                                      for all of those operations and any future admission operations that are added.
                                      If '*' is present, the length of the slice must be one.
                                      Required.
                                    items:
                                      description: OperationType specifies an operation
                                        for a request.
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  resources:
                                    description: |-
                                      resources is a list of resources this rule applies to.

                                      For example:
                                      'pods' means pods.
                                      'pods/log' means the log subresource of pods.
                                      '*' means all resources, but not subresources.
                                      'pods/*' means all subresources of pods.
                                      '*/scale' means all scale subresources.
                                      '*/*' means all resources and their subresources.

                                      If wildcard is present, the validation rule will ensure resources do not
                                      overlap with each other.

                                      Depending on the enclosing object, subresources might not be allowed.
                                      Required.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  scope:
                                    description: |-
                                      scope specifies the scope of this rule.
                                      Valid values are "Cluster", "Namespaced", and "*"
                                      "Cluster" means that only cluster-scoped resources will match this rule.
                                      Namespace API objects are cluster-scoped.
                                      "Namespaced" means that only namespaced resources will match this rule.
                                      "*" means that there are no scope restrictions.
                                      Subresources match the scope of their parent resource.
                                      Default is "*".
                                    type: string
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            sideEffects:
                              description: |-
                                SideEffects states whether this webhook has side effects.
                                Acceptable values are: None, NoneOnDryRun (webhooks created via v1beta1 may also specify Some or Unknown).
                                Webhooks with side effects MUST implement a reconciliation system, since a request may be
                                rejected by a future step in the admission chain and the side effects therefore need to be undone.
                                Requests with the dryRun attribute will be auto-rejected if they match a webhook with
                                sideEffects == Unknown or Some.
                              type: string
                            timeoutSeconds:
                              description: |-
                                TimeoutSeconds specifies the timeout for this webhook. After the timeout passes,
                                the webhook call will be ignored or the API call will fail based on the
                                failure policy.
                                The timeout value must be between 1 and 30 seconds.
                                Default to 10 seconds.
                              format: int32
                              type: integer
                          required:
                          - admissionReviewVersions
                          - name
                          - path
                          - sideEffects
                          type: object
                        type: array
                    required:
                    - client
                    type: object
                    x-kubernetes-validations:
                    - message: client must configure exactly one of url or service
                      rule: has(self.client.url) != has(self.client.service)
                type: object
              allowServiceAccountPromotion:
                default: false
                description: |-
                  ServiceAccounts within tenant namespaces can be promoted to owners of the given tenant
                  this can be achieved by labeling the serviceaccount and then they are considered owners. This can only be done by other owners of the tenant.
                  However ServiceAccounts which have been promoted to owner can not promote further serviceAccounts.
                type: boolean
              cacheInvalidation:
                default: 24h
                description: Define the period of time upon a cache invalidation is
                  executed for all caches.
                type: string
              enableTLSReconciler:
                default: false
                description: |-
                  Toggles the TLS reconciler, the controller that is able to generate CA and certificates for the webhooks
                  when not using an already provided CA and certificate, or when these are managed externally with Vault, or cert-manager.
                type: boolean
              events:
                default:
                  namespace: default
                description: Event (Audit) Configuration
                properties:
                  namespace:
                    default: default
                    description: Namespace where the events are logged for cluster
                      scoped resources or deny events (default namespace)
                    type: string
                type: object
              forceTenantPrefix:
                default: false
                description: |-
                  Enforces the Tenant owner, during Namespace creation, to name it using the selected Tenant name as prefix,
                  separated by a dash. This is useful to avoid Namespace name collision in a public CaaS environment.
                type: boolean
              ignoreUserWithGroups:
                description: |-
                  Define groups which when found in the request of a user will be ignored by the Capsule
                  this might be useful if you have one group where all the users are in, but you want to separate administrators from normal users with additional groups.
                items:
                  type: string
                type: array
              impersonation:
                description: Service Account Client configuration for impersonation
                  properties
                properties:
                  caSecretKey:
                    default: ca.crt
                    description: Key in the secret that holds the CA certificate (e.g.,
                      "ca.crt")
                    type: string
                  caSecretName:
                    description: Name of the secret containing the CA certificate
                    maxLength: 63
                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                    type: string
                  caSecretNamespace:
                    description: Namespace where the CA certificate secret is located
                    maxLength: 253
                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                    type: string
                  endpoint:
                    description: Kubernetes API Endpoint to use for impersonation
                    type: string
                  globalDefaultServiceAccount:
                    description: |-
                      Default ServiceAccount for global resources (GlobalTenantResource)
                      When defined, users are required to use this ServiceAccount anywhere in the cluster
                      unless they explicitly provide their own.
                    maxLength: 63
                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                    type: string
                  globalDefaultServiceAccountNamespace:
                    description: |-
                      Default ServiceAccount for global resources (GlobalTenantResource)
                      When defined, users are required to use this ServiceAccount anywhere in the cluster
                      unless they explicitly provide their own.
                    maxLength: 253
                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                    type: string
                  skipTlsVerify:
                    default: false
                    description: If true, TLS certificate verification is skipped
                      (not recommended for production)
                    type: boolean
                  tenantDefaultServiceAccount:
                    description: |-
                      Default ServiceAccount for namespaced resources (TenantResource)
                      When defined, users are required to use this ServiceAccount within the namespace
                      where they deploy the resource, unless they explicitly provide their own.
                    maxLength: 63
                    pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                    type: string
                type: object
              nodeMetadata:
                description: |-
                  Allows to set the forbidden metadata for the worker nodes that could be patched by a Tenant.
                  This applies only if the Tenant has an active NodeSelector, and the Owner have right to patch their nodes.
                properties:
                  forbiddenAnnotations:
                    description: Define the annotations that a Tenant Owner cannot
                      set for their nodes.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                  forbiddenLabels:
                    description: Define the labels that a Tenant Owner cannot set
                      for their nodes.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                type: object
              overrides:
                default:
                  TLSSecretName: capsule-tls
                  mutatingWebhookConfigurationName: capsule-mutating-webhook-configuration
                  validatingWebhookConfigurationName: capsule-validating-webhook-configuration
                description: |-
                  Allows to set different name rather than the canonical one for the Capsule configuration objects,
                  such as webhook secret or configurations.
                properties:
                  TLSSecretName:
                    default: capsule-tls
                    description: |-
                      Defines the Secret name used for the webhook server.
                      Must be in the same Namespace where the Capsule Deployment is deployed.
                    type: string
                  mutatingWebhookConfigurationName:
                    default: capsule-mutating-webhook-configuration
                    description: |-
                      Deprecated: use dynamic admission instead

                      Name of the MutatingWebhookConfiguration which contains the dynamic admission controller paths and resources.
                    type: string
                  validatingWebhookConfigurationName:
                    default: capsule-validating-webhook-configuration
                    description: |-
                      Deprecated: use dynamic admission instead

                      Name of the ValidatingWebhookConfiguration which contains the dynamic admission controller paths and resources.
                    type: string
                required:
                - TLSSecretName
                - mutatingWebhookConfigurationName
                - validatingWebhookConfigurationName
                type: object
              protectedNamespaceRegex:
                description: Disallow creation of namespaces, whose name matches this
                  regexp
                type: string
              rbac:
                default: {}
                description: Define Properties for managed ClusterRoles by Capsule
                properties:
                  administrationClusterRoles:
                    default:
                    - capsule-namespace-deleter
                    description: The ClusterRoles applied for Administrators
                    items:
                      type: string
                    type: array
                  deleter:
                    default: capsule-namespace-deleter
                    description: Name for the ClusterRole required to grant Namespace
                      Deletion permissions.
                    type: string
                  promotionClusterRoles:
                    default:
                    - capsule-namespace-provisioner
                    - capsule-namespace-deleter
                    description: The ClusterRoles applied for ServiceAccounts which
                      had owner Promotion
                    items:
                      type: string
                    type: array
                  provisioner:
                    default: capsule-namespace-provisioner
                    description: Name for the ClusterRole required to grant Namespace
                      Provision permissions.
                    type: string
                type: object
              userGroups:
                description: |-
                  Deprecated: use users property instead (https://projectcapsule.dev/docs/operating/setup/configuration/#users)

                  Names of the groups considered as Capsule users.
                items:
                  type: string
                type: array
              userNames:
                description: |-
                  Deprecated: use users property instead (https://projectcapsule.dev/docs/operating/setup/configuration/#users)

                  Names of the users considered as Capsule users.
                items:
                  type: string
                type: array
              users:
                description: |-
                  Define entities which are considered part of the Capsule construct
                  Users not mentioned here will be ignored by Capsule
                items:
                  properties:
                    kind:
                      description: Kind of entity. Possible values are "User", "Group",
                        and "ServiceAccount"
                      enum:
                      - User
                      - Group
                      - ServiceAccount
                      type: string
                    name:
                      description: Name of the entity.
                      type: string
                  required:
                  - kind
                  - name
                  type: object
                type: array
            required:
            - cacheInvalidation
            - enableTLSReconciler
            - rbac
            type: object
          status:
            description: CapsuleConfigurationStatus defines the Capsule configuration
              status.
            properties:
              conditions:
                description: |-
                  Conditions holds the reconciliation conditions for this CapsuleConfiguration.
                  Includes a Ready condition indicating whether the configuration was
                  successfully validated and applied.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              observedGeneration:
                description: ObservedGeneration is the most recent generation the
                  controller has observed.
                format: int64
                type: integer
              tenants:
                description: |-
                  Tenants is the sorted list of Tenant names currently present in the cluster.
                  The total count is available via len(Tenants).
                items:
                  type: string
                type: array
                x-kubernetes-list-type: atomic
              users:
                description: Users which are considered Capsule Users and are bound
                  to the Capsule Tenant construct.
                items:
                  properties:
                    kind:
                      description: Kind of entity. Possible values are "User", "Group",
                        and "ServiceAccount"
                      enum:
                      - User
                      - Group
                      - ServiceAccount
                      type: string
                    name:
                      description: Name of the entity.
                      type: string
                  required:
                  - kind
                  - name
                  type: object
                type: array
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
