---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.21.0
  name: tenants.capsule.clastix.io
spec:
  group: capsule.clastix.io
  names:
    kind: Tenant
    listKind: TenantList
    plural: tenants
    shortNames:
    - tnt
    singular: tenant
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - description: The actual state of the Tenant
      jsonPath: .status.state
      name: State
      type: string
    - description: The max amount of Namespaces can be created
      jsonPath: .spec.namespaceOptions.quota
      name: Namespace quota
      type: integer
    - description: The total amount of Namespaces in use
      jsonPath: .status.size
      name: Namespace count
      type: integer
    - description: Node Selector applied to Pods
      jsonPath: .spec.nodeSelector
      name: Node selector
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: Tenant is the Schema for the tenants API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: TenantSpec defines the desired state of Tenant.
            properties:
              additionalRoleBindings:
                description: Specifies additional RoleBindings assigned to the Tenant.
                  Capsule will ensure that all namespaces in the Tenant always contain
                  the RoleBinding for the given ClusterRole. Optional.
                items:
                  properties:
                    annotations:
                      additionalProperties:
                        type: string
                      description: Additional Annotations for the synchronized rolebindings
                      type: object
                    clusterRoleName:
                      type: string
                    labels:
                      additionalProperties:
                        type: string
                      description: Additional Labels for the synchronized rolebindings
                      type: object
                    subjects:
                      items:
                        description: |-
                          Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
                          or a value for non-objects such as user and group names.
                        properties:
                          apiGroup:
                            description: |-
                              APIGroup holds the API group of the referenced subject.
                              Defaults to "" for ServiceAccount subjects.
                              Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
                            type: string
                          kind:
                            description: |-
                              Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
                              If the Authorizer does not recognized the kind value, the Authorizer should report an error.
                            type: string
                          name:
                            description: Name of the object being referenced.
                            type: string
                          namespace:
                            description: |-
                              Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
                              the Authorizer should report an error.
                            type: string
                        required:
                        - kind
                        - name
                        type: object
                        x-kubernetes-map-type: atomic
                      minItems: 1
                      type: array
                  required:
                  - clusterRoleName
                  - subjects
                  type: object
                type: array
              containerRegistries:
                description: Specifies the trusted Image Registries assigned to the
                  Tenant. Capsule assures that all Pods resources created in the Tenant
                  can use only one of the allowed trusted registries. Optional.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                type: object
              imagePullPolicies:
                description: Specify the allowed values for the imagePullPolicies
                  option in Pod resources. Capsule assures that all Pod resources
                  created in the Tenant can use only one of the allowed policy. Optional.
                items:
                  enum:
                  - Always
                  - Never
                  - IfNotPresent
                  type: string
                type: array
              ingressOptions:
                description: Specifies options for the Ingress resources, such as
                  allowed hostnames and IngressClass. Optional.
                properties:
                  allowedClasses:
                    description: Specifies the allowed IngressClasses assigned to
                      the Tenant. Capsule assures that all Ingress resources created
                      in the Tenant can use only one of the allowed IngressClasses.
                      Optional.
                    properties:
                      allowed:
                        description: Match exact elements which are allowed as class
                          names within this tenant
                        items:
                          type: string
                        type: array
                      allowedRegex:
                        description: |-
                          Deprecated: will be removed in a future release

                          Match elements by regex.
                        type: string
                    type: object
                  allowedHostnames:
                    description: Specifies the allowed hostnames in Ingresses for
                      the given Tenant. Capsule assures that all Ingress resources
                      created in the Tenant can use only one of the allowed hostnames.
                      Optional.
                    properties:
                      allowed:
                        description: Match exact elements which are allowed as class
                          names within this tenant
                        items:
                          type: string
                        type: array
                      allowedRegex:
                        description: |-
                          Deprecated: will be removed in a future release

                          Match elements by regex.
                        type: string
                    type: object
                  hostnameCollisionScope:
                    default: Disabled
                    description: |-
                      Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames.

                      - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule.

                      - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant.

                      - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace.

                      Optional.
                    enum:
                    - Cluster
                    - Tenant
                    - Namespace
                    - Disabled
                    type: string
                type: object
              limitRanges:
                description: Specifies the resource min/max usage restrictions to
                  the Tenant. The assigned values are inherited by any namespace created
                  in the Tenant. Optional.
                properties:
                  items:
                    items:
                      description: LimitRangeSpec defines a min/max usage limit for
                        resources that match on kind.
                      properties:
                        limits:
                          description: Limits is the list of LimitRangeItem objects
                            that are enforced.
                          items:
                            description: LimitRangeItem defines a min/max usage limit
                              for any resource that matches on kind.
                            properties:
                              default:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: Default resource requirement limit value
                                  by resource name if resource limit is omitted.
                                type: object
                              defaultRequest:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: DefaultRequest is the default resource
                                  requirement request value by resource name if resource
                                  request is omitted.
                                type: object
                              max:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: Max usage constraints on this kind by
                                  resource name.
                                type: object
                              maxLimitRequestRatio:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: MaxLimitRequestRatio if specified, the
                                  named resource must have a request and limit that
                                  are both non-zero where limit divided by request
                                  is less than or equal to the enumerated value; this
                                  represents the max burst for the named resource.
                                type: object
                              min:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: Min usage constraints on this kind by
                                  resource name.
                                type: object
                              type:
                                description: Type of resource that this limit applies
                                  to.
                                type: string
                            required:
                            - type
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                      required:
                      - limits
                      type: object
                    type: array
                type: object
              namespaceOptions:
                description: Specifies options for the Namespaces, such as additional
                  metadata or maximum number of namespaces allowed for that Tenant.
                  Once the namespace quota assigned to the Tenant has been reached,
                  the Tenant owner cannot create further namespaces. Optional.
                properties:
                  additionalMetadata:
                    description: Specifies additional labels and annotations the Capsule
                      operator places on any Namespace resource in the Tenant. Optional.
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        type: object
                    type: object
                  quota:
                    description: Specifies the maximum number of namespaces allowed
                      for that Tenant. Once the namespace quota assigned to the Tenant
                      has been reached, the Tenant owner cannot create further namespaces.
                      Optional.
                    format: int32
                    minimum: 1
                    type: integer
                type: object
              networkPolicies:
                description: Specifies the NetworkPolicies assigned to the Tenant.
                  The assigned NetworkPolicies are inherited by any namespace created
                  in the Tenant. Optional.
                properties:
                  items:
                    items:
                      description: NetworkPolicySpec provides the specification of
                        a NetworkPolicy
                      properties:
                        egress:
                          description: |-
                            egress is a list of egress rules to be applied to the selected pods. Outgoing traffic
                            is allowed if there are no NetworkPolicies selecting the pod (and cluster policy
                            otherwise allows the traffic), OR if the traffic matches at least one egress rule
                            across all of the NetworkPolicy objects whose podSelector matches the pod. If
                            this field is empty then this NetworkPolicy limits all outgoing traffic (and serves
                            solely to ensure that the pods it selects are isolated by default).
                            This field is beta-level in 1.8
                          items:
                            description: |-
                              NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods
                              matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to.
                              This type is beta-level in 1.8
                            properties:
                              ports:
                                description: |-
                                  ports is a list of destination ports for outgoing traffic.
                                  Each item in this list is combined using a logical OR. If this field is
                                  empty or missing, this rule matches all ports (traffic not restricted by port).
                                  If this field is present and contains at least one item, then this rule allows
                                  traffic only if the traffic matches at least one port in the list.
                                items:
                                  description: NetworkPolicyPort describes a port
                                    to allow traffic on
                                  properties:
                                    endPort:
                                      description: |-
                                        endPort indicates that the range of ports from port to endPort if set, inclusive,
                                        should be allowed by the policy. This field cannot be defined if the port field
                                        is not defined or if the port field is defined as a named (string) port.
                                        The endPort must be equal or greater than port.
                                      format: int32
                                      type: integer
                                    port:
                                      anyOf:
                                      - type: integer
                                      - type: string
                                      description: |-
                                        port represents the port on the given protocol. This can either be a numerical or named
                                        port on a pod. If this field is not provided, this matches all port names and
                                        numbers.
                                        If present, only traffic on the specified protocol AND port will be matched.
                                      x-kubernetes-int-or-string: true
                                    protocol:
                                      description: |-
                                        protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match.
                                        If not specified, this field defaults to TCP.
                                      type: string
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              to:
                                description: |-
                                  to is a list of destinations for outgoing traffic of pods selected for this rule.
                                  Items in this list are combined using a logical OR operation. If this field is
                                  empty or missing, this rule matches all destinations (traffic not restricted by
                                  destination). If this field is present and contains at least one item, this rule
                                  allows traffic only if the traffic matches at least one item in the to list.
                                items:
                                  description: |-
                                    NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
                                    fields are allowed
                                  properties:
                                    ipBlock:
                                      description: |-
                                        ipBlock defines policy on a particular IPBlock. If this field is set then
                                        neither of the other fields can be.
                                      properties:
                                        cidr:
                                          description: |-
                                            cidr is a string representing the IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                          type: string
                                        except:
                                          description: |-
                                            except is a slice of CIDRs that should not be included within an IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                            Except values will be rejected if they are outside the cidr range
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      required:
                                      - cidr
                                      type: object
                                    namespaceSelector:
                                      description: |-
                                        namespaceSelector selects namespaces using cluster-scoped labels. This field follows
                                        standard label selector semantics; if present but empty, it selects all namespaces.

                                        If podSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the namespaces selected by namespaceSelector.
                                        Otherwise it selects all pods in the namespaces selected by namespaceSelector.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    podSelector:
                                      description: |-
                                        podSelector is a label selector which selects pods. This field follows standard label
                                        selector semantics; if present but empty, it selects all pods.

                                        If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the pods matching podSelector in the policy's own namespace.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        ingress:
                          description: |-
                            ingress is a list of ingress rules to be applied to the selected pods.
                            Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod
                            (and cluster policy otherwise allows the traffic), OR if the traffic source is
                            the pod's local node, OR if the traffic matches at least one ingress rule
                            across all of the NetworkPolicy objects whose podSelector matches the pod. If
                            this field is empty then this NetworkPolicy does not allow any traffic (and serves
                            solely to ensure that the pods it selects are isolated by default)
                          items:
                            description: |-
                              NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods
                              matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
                            properties:
                              from:
                                description: |-
                                  from is a list of sources which should be able to access the pods selected for this rule.
                                  Items in this list are combined using a logical OR operation. If this field is
                                  empty or missing, this rule matches all sources (traffic not restricted by
                                  source). If this field is present and contains at least one item, this rule
                                  allows traffic only if the traffic matches at least one item in the from list.
                                items:
                                  description: |-
                                    NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
                                    fields are allowed
                                  properties:
                                    ipBlock:
                                      description: |-
                                        ipBlock defines policy on a particular IPBlock. If this field is set then
                                        neither of the other fields can be.
                                      properties:
                                        cidr:
                                          description: |-
                                            cidr is a string representing the IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                          type: string
                                        except:
                                          description: |-
                                            except is a slice of CIDRs that should not be included within an IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                            Except values will be rejected if they are outside the cidr range
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      required:
                                      - cidr
                                      type: object
                                    namespaceSelector:
                                      description: |-
                                        namespaceSelector selects namespaces using cluster-scoped labels. This field follows
                                        standard label selector semantics; if present but empty, it selects all namespaces.

                                        If podSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the namespaces selected by namespaceSelector.
                                        Otherwise it selects all pods in the namespaces selected by namespaceSelector.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    podSelector:
                                      description: |-
                                        podSelector is a label selector which selects pods. This field follows standard label
                                        selector semantics; if present but empty, it selects all pods.

                                        If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the pods matching podSelector in the policy's own namespace.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              ports:
                                description: |-
                                  ports is a list of ports which should be made accessible on the pods selected for
                                  this rule. Each item in this list is combined using a logical OR. If this field is
                                  empty or missing, this rule matches all ports (traffic not restricted by port).
                                  If this field is present and contains at least one item, then this rule allows
                                  traffic only if the traffic matches at least one port in the list.
                                items:
                                  description: NetworkPolicyPort describes a port
                                    to allow traffic on
                                  properties:
                                    endPort:
                                      description: |-
                                        endPort indicates that the range of ports from port to endPort if set, inclusive,
                                        should be allowed by the policy. This field cannot be defined if the port field
                                        is not defined or if the port field is defined as a named (string) port.
                                        The endPort must be equal or greater than port.
                                      format: int32
                                      type: integer
                                    port:
                                      anyOf:
                                      - type: integer
                                      - type: string
                                      description: |-
                                        port represents the port on the given protocol. This can either be a numerical or named
                                        port on a pod. If this field is not provided, this matches all port names and
                                        numbers.
                                        If present, only traffic on the specified protocol AND port will be matched.
                                      x-kubernetes-int-or-string: true
                                    protocol:
                                      description: |-
                                        protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match.
                                        If not specified, this field defaults to TCP.
                                      type: string
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        podSelector:
                          description: |-
                            podSelector selects the pods to which this NetworkPolicy object applies.
                            The array of rules is applied to any pods selected by this field. An empty
                            selector matches all pods in the policy's namespace.
                            Multiple network policies can select the same set of pods. In this case,
                            the ingress rules for each are combined additively.
                            This field is optional. If it is not specified, it defaults to an empty selector.
                          properties:
                            matchExpressions:
                              description: matchExpressions is a list of label selector
                                requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description: key is the label key that the selector
                                      applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - key
                                - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                        policyTypes:
                          description: |-
                            policyTypes is a list of rule types that the NetworkPolicy relates to.
                            Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"].
                            If this field is not specified, it will default based on the existence of ingress or egress rules;
                            policies that contain an egress section are assumed to affect egress, and all policies
                            (whether or not they contain an ingress section) are assumed to affect ingress.
                            If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].
                            Likewise, if you want to write a policy that specifies that no egress is allowed,
                            you must specify a policyTypes value that include "Egress" (since such a policy would not include
                            an egress section and would otherwise default to just [ "Ingress" ]).
                            This field is beta-level in 1.8
                          items:
                            description: |-
                              PolicyType string describes the NetworkPolicy type
                              This type is beta-level in 1.8
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                type: object
              nodeSelector:
                additionalProperties:
                  type: string
                description: Specifies the label to control the placement of pods
                  on a given pool of worker nodes. All namespaces created within the
                  Tenant will have the node selector annotation. This annotation tells
                  the Kubernetes scheduler to place pods on the nodes having the selector
                  label. Optional.
                type: object
              owners:
                description: Specifies the owners of the Tenant. Mandatory.
                items:
                  properties:
                    kind:
                      description: Kind of tenant owner. Possible values are "User",
                        "Group", and "ServiceAccount"
                      enum:
                      - User
                      - Group
                      - ServiceAccount
                      type: string
                    name:
                      description: Name of tenant owner.
                      type: string
                    proxySettings:
                      description: Proxy settings for tenant owner.
                      items:
                        properties:
                          kind:
                            enum:
                            - Nodes
                            - StorageClasses
                            - IngressClasses
                            - PriorityClasses
                            type: string
                          operations:
                            items:
                              enum:
                              - List
                              - Update
                              - Delete
                              type: string
                            type: array
                        required:
                        - kind
                        - operations
                        type: object
                      type: array
                  required:
                  - kind
                  - name
                  type: object
                type: array
              priorityClasses:
                description: Specifies the allowed priorityClasses assigned to the
                  Tenant. Capsule assures that all Pods resources created in the Tenant
                  can use only one of the allowed PriorityClasses. Optional.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                type: object
              resourceQuotas:
                description: Specifies a list of ResourceQuota resources assigned
                  to the Tenant. The assigned values are inherited by any namespace
                  created in the Tenant. The Capsule operator aggregates ResourceQuota
                  at Tenant level, so that the hard quota is never crossed for the
                  given Tenant. This permits the Tenant owner to consume resources
                  in the Tenant regardless of the namespace. Optional.
                properties:
                  items:
                    items:
                      description: ResourceQuotaSpec defines the desired hard limits
                        to enforce for Quota.
                      properties:
                        hard:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: |-
                            hard is the set of desired hard limits for each named resource.
                            More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
                          type: object
                        scopeSelector:
                          description: |-
                            scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
                            but expressed using ScopeSelectorOperator in combination with possible values.
                            For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
                          properties:
                            matchExpressions:
                              description: A list of scope selector requirements by
                                scope of the resources.
                              items:
                                description: |-
                                  A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
                                  that relates the scope name and values.
                                properties:
                                  operator:
                                    description: |-
                                      Represents a scope's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists, DoesNotExist.
                                    type: string
                                  scopeName:
                                    description: The name of the scope that the selector
                                      applies to.
                                    type: string
                                  values:
                                    description: |-
                                      An array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty.
                                      This array is replaced during a strategic merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - operator
                                - scopeName
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                          type: object
                          x-kubernetes-map-type: atomic
                        scopes:
                          description: |-
                            A collection of filters that must match each object tracked by a quota.
                            If not specified, the quota matches all objects.
                          items:
                            description: A ResourceQuotaScope defines a filter that
                              must match each object tracked by a quota
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                  scope:
                    default: Tenant
                    description: Define if the Resource Budget should compute resource
                      across all Namespaces in the Tenant or individually per cluster.
                      Default is Tenant
                    enum:
                    - Tenant
                    - Namespace
                    type: string
                type: object
              serviceOptions:
                description: Specifies options for the Service, such as additional
                  metadata or block of certain type of Services. Optional.
                properties:
                  additionalMetadata:
                    description: Specifies additional labels and annotations the Capsule
                      operator places on any Service resource in the Tenant. Optional.
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        type: object
                    type: object
                  allowedServices:
                    description: Block or deny certain type of Services. Optional.
                    properties:
                      externalName:
                        default: true
                        description: Specifies if ExternalName service type resources
                          are allowed for the Tenant. Default is true. Optional.
                        type: boolean
                      loadBalancer:
                        default: true
                        description: Specifies if LoadBalancer service type resources
                          are allowed for the Tenant. Default is true. Optional.
                        type: boolean
                      nodePort:
                        default: true
                        description: Specifies if NodePort service type resources
                          are allowed for the Tenant. Default is true. Optional.
                        type: boolean
                    type: object
                  externalIPs:
                    description: Specifies the external IPs that can be used in Services
                      with type ClusterIP. An empty list means no IPs are allowed.
                      Optional.
                    properties:
                      allowed:
                        items:
                          pattern: ^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$
                          type: string
                        type: array
                    required:
                    - allowed
                    type: object
                  forbiddenAnnotations:
                    description: Define the annotations that a Tenant Owner cannot
                      set for their Service resources.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                  forbiddenLabels:
                    description: Define the labels that a Tenant Owner cannot set
                      for their Service resources.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                type: object
              storageClasses:
                description: Specifies the allowed StorageClasses assigned to the
                  Tenant. Capsule assures that all PersistentVolumeClaim resources
                  created in the Tenant can use only one of the allowed StorageClasses.
                  Optional.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                type: object
            required:
            - owners
            type: object
          status:
            description: Returns the observed state of the Tenant.
            properties:
              namespaces:
                description: List of namespaces assigned to the Tenant.
                items:
                  type: string
                type: array
              size:
                description: How many namespaces are assigned to the Tenant.
                type: integer
              state:
                default: Active
                description: The operational state of the Tenant. Possible values
                  are "Active", "Cordoned".
                enum:
                - Cordoned
                - Active
                type: string
            required:
            - size
            - state
            type: object
        required:
        - spec
        type: object
    served: true
    storage: false
    subresources:
      status: {}
  - additionalPrinterColumns:
    - description: The actual state of the Tenant
      jsonPath: .status.conditions[?(@.type=="Cordoned")].reason
      name: State
      type: string
    - description: The max amount of Namespaces can be created
      jsonPath: .spec.namespaceOptions.quota
      name: Namespace quota
      type: integer
    - description: The total amount of Namespaces in use
      jsonPath: .status.size
      name: Namespace count
      type: integer
    - description: Node Selector applied to Pods
      jsonPath: .spec.nodeSelector
      name: Node selector
      type: string
    - description: Reconcile Status for the tenant
      jsonPath: .status.conditions[?(@.type=="Ready")].status
      name: Ready
      type: string
    - description: Reconcile Message for the tenant
      jsonPath: .status.conditions[?(@.type=="Ready")].message
      name: Status
      type: string
    - description: Age
      jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v1beta2
    schema:
      openAPIV3Schema:
        description: Tenant is the Schema for the tenants API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: TenantSpec defines the desired state of Tenant.
            properties:
              additionalRoleBindings:
                description: Specifies additional RoleBindings assigned to the Tenant.
                  Capsule will ensure that all namespaces in the Tenant always contain
                  the RoleBinding for the given ClusterRole. Optional.
                items:
                  properties:
                    annotations:
                      additionalProperties:
                        type: string
                      description: Additional Annotations for the synchronized rolebindings
                      type: object
                    clusterRoleName:
                      type: string
                    labels:
                      additionalProperties:
                        type: string
                      description: Additional Labels for the synchronized rolebindings
                      type: object
                    subjects:
                      items:
                        description: |-
                          Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
                          or a value for non-objects such as user and group names.
                        properties:
                          apiGroup:
                            description: |-
                              APIGroup holds the API group of the referenced subject.
                              Defaults to "" for ServiceAccount subjects.
                              Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
                            type: string
                          kind:
                            description: |-
                              Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
                              If the Authorizer does not recognized the kind value, the Authorizer should report an error.
                            type: string
                          name:
                            description: Name of the object being referenced.
                            type: string
                          namespace:
                            description: |-
                              Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
                              the Authorizer should report an error.
                            type: string
                        required:
                        - kind
                        - name
                        type: object
                        x-kubernetes-map-type: atomic
                      minItems: 1
                      type: array
                  required:
                  - clusterRoleName
                  - subjects
                  type: object
                type: array
              containerRegistries:
                description: |-
                  Deprecated: Use Enforcement.Registries instead

                  Specifies the trusted Image Registries assigned to the Tenant. Capsule assures that all Pods resources created in the Tenant can use only one of the allowed trusted registries. Optional.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                type: object
              cordoned:
                default: false
                description: Toggling the Tenant resources cordoning, when enable
                  resources cannot be deleted.
                type: boolean
              data:
                description: |-
                  Specify additional data relating to the tenant.
                  Mainly useable in templating and more accessible than labels/annotations.
                x-kubernetes-preserve-unknown-fields: true
              deviceClasses:
                description: Specifies options for the DeviceClass resources.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                  matchExpressions:
                    description: matchExpressions is a list of label selector requirements.
                      The requirements are ANDed.
                    items:
                      description: |-
                        A label selector requirement is a selector that contains values, a key, and an operator that
                        relates the key and values.
                      properties:
                        key:
                          description: key is the label key that the selector applies
                            to.
                          type: string
                        operator:
                          description: |-
                            operator represents a key's relationship to a set of values.
                            Valid operators are In, NotIn, Exists and DoesNotExist.
                          type: string
                        values:
                          description: |-
                            values is an array of string values. If the operator is In or NotIn,
                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
                            the values array must be empty. This array is replaced during a strategic
                            merge patch.
                          items:
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      required:
                      - key
                      - operator
                      type: object
                    type: array
                    x-kubernetes-list-type: atomic
                  matchLabels:
                    additionalProperties:
                      type: string
                    description: |-
                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                      map is equivalent to an element of matchExpressions, whose key field is "key", the
                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                    type: object
                type: object
                x-kubernetes-map-type: atomic
              forceTenantPrefix:
                description: |-
                  Use this if you want to disable/enable the Tenant name prefix to specific Tenants, overriding global forceTenantPrefix in CapsuleConfiguration.
                  When set to 'true', it enforces Namespaces created for this Tenant to be named with the Tenant name prefix,
                  separated by a dash (i.e. for Tenant 'foo', namespace names must be prefixed with 'foo-'),
                  this is useful to avoid Namespace name collision.
                  When set to 'false', it allows Namespaces created for this Tenant to be named anything.
                  Overrides CapsuleConfiguration global forceTenantPrefix for the Tenant only.
                  If unset, Tenant uses CapsuleConfiguration's forceTenantPrefix
                  Optional
                type: boolean
              gatewayOptions:
                description: Specifies options for the GatewayClass resources.
                properties:
                  allowedClasses:
                    properties:
                      allowed:
                        description: Match exact elements which are allowed as class
                          names within this tenant
                        items:
                          type: string
                        type: array
                      allowedRegex:
                        description: |-
                          Deprecated: will be removed in a future release

                          Match elements by regex.
                        type: string
                      default:
                        type: string
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                type: object
              imagePullPolicies:
                description: |-
                  Deprecated: Use Enforcement.Registries instead

                  Specify the allowed values for the imagePullPolicies option in Pod resources. Capsule assures that all Pod resources created in the Tenant can use only one of the allowed policy. Optional.
                items:
                  enum:
                  - Always
                  - Never
                  - IfNotPresent
                  type: string
                type: array
              ingressOptions:
                description: Specifies options for the Ingress resources, such as
                  allowed hostnames and IngressClass. Optional.
                properties:
                  allowWildcardHostnames:
                    description: Toggles the ability for Ingress resources created
                      in a Tenant to have a hostname wildcard.
                    type: boolean
                  allowedClasses:
                    description: |-
                      Specifies the allowed IngressClasses assigned to the Tenant.
                      Capsule assures that all Ingress resources created in the Tenant can use only one of the allowed IngressClasses.
                      A default value can be specified, and all the Ingress resources created will inherit the declared class.
                      Optional.
                    properties:
                      allowed:
                        description: Match exact elements which are allowed as class
                          names within this tenant
                        items:
                          type: string
                        type: array
                      allowedRegex:
                        description: |-
                          Deprecated: will be removed in a future release

                          Match elements by regex.
                        type: string
                      default:
                        type: string
                      matchExpressions:
                        description: matchExpressions is a list of label selector
                          requirements. The requirements are ANDed.
                        items:
                          description: |-
                            A label selector requirement is a selector that contains values, a key, and an operator that
                            relates the key and values.
                          properties:
                            key:
                              description: key is the label key that the selector
                                applies to.
                              type: string
                            operator:
                              description: |-
                                operator represents a key's relationship to a set of values.
                                Valid operators are In, NotIn, Exists and DoesNotExist.
                              type: string
                            values:
                              description: |-
                                values is an array of string values. If the operator is In or NotIn,
                                the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                the values array must be empty. This array is replaced during a strategic
                                merge patch.
                              items:
                                type: string
                              type: array
                              x-kubernetes-list-type: atomic
                          required:
                          - key
                          - operator
                          type: object
                        type: array
                        x-kubernetes-list-type: atomic
                      matchLabels:
                        additionalProperties:
                          type: string
                        description: |-
                          matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                          map is equivalent to an element of matchExpressions, whose key field is "key", the
                          operator is "In", and the values array contains only "value". The requirements are ANDed.
                        type: object
                    type: object
                    x-kubernetes-map-type: atomic
                  allowedHostnames:
                    description: Specifies the allowed hostnames in Ingresses for
                      the given Tenant. Capsule assures that all Ingress resources
                      created in the Tenant can use only one of the allowed hostnames.
                      Optional.
                    properties:
                      allowed:
                        description: Match exact elements which are allowed as class
                          names within this tenant
                        items:
                          type: string
                        type: array
                      allowedRegex:
                        description: |-
                          Deprecated: will be removed in a future release

                          Match elements by regex.
                        type: string
                    type: object
                  hostnameCollisionScope:
                    default: Disabled
                    description: |-
                      Defines the scope of hostname collision check performed when Tenant Owners create Ingress with allowed hostnames.

                      - Cluster: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces managed by Capsule.

                      - Tenant: disallow the creation of an Ingress if the pair hostname and path is already used across the Namespaces of the Tenant.

                      - Namespace: disallow the creation of an Ingress if the pair hostname and path is already used in the Ingress Namespace.

                      Optional.
                    enum:
                    - Cluster
                    - Tenant
                    - Namespace
                    - Disabled
                    type: string
                type: object
              limitRanges:
                description: |-
                  Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/)

                  Specifies the resource min/max usage restrictions to the Tenant. The assigned values are inherited by any namespace created in the Tenant. Optional.
                properties:
                  items:
                    items:
                      description: LimitRangeSpec defines a min/max usage limit for
                        resources that match on kind.
                      properties:
                        limits:
                          description: Limits is the list of LimitRangeItem objects
                            that are enforced.
                          items:
                            description: LimitRangeItem defines a min/max usage limit
                              for any resource that matches on kind.
                            properties:
                              default:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: Default resource requirement limit value
                                  by resource name if resource limit is omitted.
                                type: object
                              defaultRequest:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: DefaultRequest is the default resource
                                  requirement request value by resource name if resource
                                  request is omitted.
                                type: object
                              max:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: Max usage constraints on this kind by
                                  resource name.
                                type: object
                              maxLimitRequestRatio:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: MaxLimitRequestRatio if specified, the
                                  named resource must have a request and limit that
                                  are both non-zero where limit divided by request
                                  is less than or equal to the enumerated value; this
                                  represents the max burst for the named resource.
                                type: object
                              min:
                                additionalProperties:
                                  anyOf:
                                  - type: integer
                                  - type: string
                                  pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                  x-kubernetes-int-or-string: true
                                description: Min usage constraints on this kind by
                                  resource name.
                                type: object
                              type:
                                description: Type of resource that this limit applies
                                  to.
                                type: string
                            required:
                            - type
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                      required:
                      - limits
                      type: object
                    type: array
                type: object
              namespaceOptions:
                description: Specifies options for the Namespaces, such as additional
                  metadata or maximum number of namespaces allowed for that Tenant.
                  Once the namespace quota assigned to the Tenant has been reached,
                  the Tenant owner cannot create further namespaces. Optional.
                properties:
                  additionalMetadata:
                    description: |-
                      Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

                      Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant. Optional.
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        type: object
                    type: object
                  additionalMetadataList:
                    description: |-
                      Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

                      Specifies additional labels and annotations the Capsule operator places on any Namespace resource in the Tenant via a list. Optional.
                    items:
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                        namespaceSelector:
                          description: |-
                            A label selector is a label query over a set of resources. The result of matchLabels and
                            matchExpressions are ANDed. An empty label selector matches all objects. A null
                            label selector matches no objects.
                          properties:
                            matchExpressions:
                              description: matchExpressions is a list of label selector
                                requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description: key is the label key that the selector
                                      applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - key
                                - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                      type: object
                    type: array
                  forbiddenAnnotations:
                    description: |-
                      Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

                      Define the annotations that a Tenant Owner cannot set for their Namespace resources.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                  forbiddenLabels:
                    description: |-
                      Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

                      Define the labels that a Tenant Owner cannot set for their Namespace resources.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                  managedMetadataOnly:
                    default: false
                    description: If enabled only metadata from additionalMetadata
                      is reconciled to the namespaces.
                    type: boolean
                  quota:
                    description: Specifies the maximum number of namespaces allowed
                      for that Tenant. Once the namespace quota assigned to the Tenant
                      has been reached, the Tenant owner cannot create further namespaces.
                      Optional.
                    format: int32
                    minimum: 1
                    type: integer
                  requiredMetadata:
                    description: |-
                      Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/#namespace)

                      Required Metadata for namespace within this tenant
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        description: Annotations that must be defined for each namespace
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        description: Labels that must be defined for each namespace
                        type: object
                    type: object
                type: object
              networkPolicies:
                description: |-
                  Deprecated: Use Tenant Replications instead (https://projectcapsule.dev/docs/replications/)

                  Specifies the NetworkPolicies assigned to the Tenant. The assigned NetworkPolicies are inherited by any namespace created in the Tenant. Optional.
                properties:
                  items:
                    items:
                      description: NetworkPolicySpec provides the specification of
                        a NetworkPolicy
                      properties:
                        egress:
                          description: |-
                            egress is a list of egress rules to be applied to the selected pods. Outgoing traffic
                            is allowed if there are no NetworkPolicies selecting the pod (and cluster policy
                            otherwise allows the traffic), OR if the traffic matches at least one egress rule
                            across all of the NetworkPolicy objects whose podSelector matches the pod. If
                            this field is empty then this NetworkPolicy limits all outgoing traffic (and serves
                            solely to ensure that the pods it selects are isolated by default).
                            This field is beta-level in 1.8
                          items:
                            description: |-
                              NetworkPolicyEgressRule describes a particular set of traffic that is allowed out of pods
                              matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and to.
                              This type is beta-level in 1.8
                            properties:
                              ports:
                                description: |-
                                  ports is a list of destination ports for outgoing traffic.
                                  Each item in this list is combined using a logical OR. If this field is
                                  empty or missing, this rule matches all ports (traffic not restricted by port).
                                  If this field is present and contains at least one item, then this rule allows
                                  traffic only if the traffic matches at least one port in the list.
                                items:
                                  description: NetworkPolicyPort describes a port
                                    to allow traffic on
                                  properties:
                                    endPort:
                                      description: |-
                                        endPort indicates that the range of ports from port to endPort if set, inclusive,
                                        should be allowed by the policy. This field cannot be defined if the port field
                                        is not defined or if the port field is defined as a named (string) port.
                                        The endPort must be equal or greater than port.
                                      format: int32
                                      type: integer
                                    port:
                                      anyOf:
                                      - type: integer
                                      - type: string
                                      description: |-
                                        port represents the port on the given protocol. This can either be a numerical or named
                                        port on a pod. If this field is not provided, this matches all port names and
                                        numbers.
                                        If present, only traffic on the specified protocol AND port will be matched.
                                      x-kubernetes-int-or-string: true
                                    protocol:
                                      description: |-
                                        protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match.
                                        If not specified, this field defaults to TCP.
                                      type: string
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              to:
                                description: |-
                                  to is a list of destinations for outgoing traffic of pods selected for this rule.
                                  Items in this list are combined using a logical OR operation. If this field is
                                  empty or missing, this rule matches all destinations (traffic not restricted by
                                  destination). If this field is present and contains at least one item, this rule
                                  allows traffic only if the traffic matches at least one item in the to list.
                                items:
                                  description: |-
                                    NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
                                    fields are allowed
                                  properties:
                                    ipBlock:
                                      description: |-
                                        ipBlock defines policy on a particular IPBlock. If this field is set then
                                        neither of the other fields can be.
                                      properties:
                                        cidr:
                                          description: |-
                                            cidr is a string representing the IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                          type: string
                                        except:
                                          description: |-
                                            except is a slice of CIDRs that should not be included within an IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                            Except values will be rejected if they are outside the cidr range
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      required:
                                      - cidr
                                      type: object
                                    namespaceSelector:
                                      description: |-
                                        namespaceSelector selects namespaces using cluster-scoped labels. This field follows
                                        standard label selector semantics; if present but empty, it selects all namespaces.

                                        If podSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the namespaces selected by namespaceSelector.
                                        Otherwise it selects all pods in the namespaces selected by namespaceSelector.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    podSelector:
                                      description: |-
                                        podSelector is a label selector which selects pods. This field follows standard label
                                        selector semantics; if present but empty, it selects all pods.

                                        If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the pods matching podSelector in the policy's own namespace.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        ingress:
                          description: |-
                            ingress is a list of ingress rules to be applied to the selected pods.
                            Traffic is allowed to a pod if there are no NetworkPolicies selecting the pod
                            (and cluster policy otherwise allows the traffic), OR if the traffic source is
                            the pod's local node, OR if the traffic matches at least one ingress rule
                            across all of the NetworkPolicy objects whose podSelector matches the pod. If
                            this field is empty then this NetworkPolicy does not allow any traffic (and serves
                            solely to ensure that the pods it selects are isolated by default)
                          items:
                            description: |-
                              NetworkPolicyIngressRule describes a particular set of traffic that is allowed to the pods
                              matched by a NetworkPolicySpec's podSelector. The traffic must match both ports and from.
                            properties:
                              from:
                                description: |-
                                  from is a list of sources which should be able to access the pods selected for this rule.
                                  Items in this list are combined using a logical OR operation. If this field is
                                  empty or missing, this rule matches all sources (traffic not restricted by
                                  source). If this field is present and contains at least one item, this rule
                                  allows traffic only if the traffic matches at least one item in the from list.
                                items:
                                  description: |-
                                    NetworkPolicyPeer describes a peer to allow traffic to/from. Only certain combinations of
                                    fields are allowed
                                  properties:
                                    ipBlock:
                                      description: |-
                                        ipBlock defines policy on a particular IPBlock. If this field is set then
                                        neither of the other fields can be.
                                      properties:
                                        cidr:
                                          description: |-
                                            cidr is a string representing the IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                          type: string
                                        except:
                                          description: |-
                                            except is a slice of CIDRs that should not be included within an IPBlock
                                            Valid examples are "192.168.1.0/24" or "2001:db8::/64"
                                            Except values will be rejected if they are outside the cidr range
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      required:
                                      - cidr
                                      type: object
                                    namespaceSelector:
                                      description: |-
                                        namespaceSelector selects namespaces using cluster-scoped labels. This field follows
                                        standard label selector semantics; if present but empty, it selects all namespaces.

                                        If podSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the namespaces selected by namespaceSelector.
                                        Otherwise it selects all pods in the namespaces selected by namespaceSelector.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                    podSelector:
                                      description: |-
                                        podSelector is a label selector which selects pods. This field follows standard label
                                        selector semantics; if present but empty, it selects all pods.

                                        If namespaceSelector is also set, then the NetworkPolicyPeer as a whole selects
                                        the pods matching podSelector in the Namespaces selected by NamespaceSelector.
                                        Otherwise it selects the pods matching podSelector in the policy's own namespace.
                                      properties:
                                        matchExpressions:
                                          description: matchExpressions is a list
                                            of label selector requirements. The requirements
                                            are ANDed.
                                          items:
                                            description: |-
                                              A label selector requirement is a selector that contains values, a key, and an operator that
                                              relates the key and values.
                                            properties:
                                              key:
                                                description: key is the label key
                                                  that the selector applies to.
                                                type: string
                                              operator:
                                                description: |-
                                                  operator represents a key's relationship to a set of values.
                                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                                type: string
                                              values:
                                                description: |-
                                                  values is an array of string values. If the operator is In or NotIn,
                                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                                  the values array must be empty. This array is replaced during a strategic
                                                  merge patch.
                                                items:
                                                  type: string
                                                type: array
                                                x-kubernetes-list-type: atomic
                                            required:
                                            - key
                                            - operator
                                            type: object
                                          type: array
                                          x-kubernetes-list-type: atomic
                                        matchLabels:
                                          additionalProperties:
                                            type: string
                                          description: |-
                                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                                          type: object
                                      type: object
                                      x-kubernetes-map-type: atomic
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              ports:
                                description: |-
                                  ports is a list of ports which should be made accessible on the pods selected for
                                  this rule. Each item in this list is combined using a logical OR. If this field is
                                  empty or missing, this rule matches all ports (traffic not restricted by port).
                                  If this field is present and contains at least one item, then this rule allows
                                  traffic only if the traffic matches at least one port in the list.
                                items:
                                  description: NetworkPolicyPort describes a port
                                    to allow traffic on
                                  properties:
                                    endPort:
                                      description: |-
                                        endPort indicates that the range of ports from port to endPort if set, inclusive,
                                        should be allowed by the policy. This field cannot be defined if the port field
                                        is not defined or if the port field is defined as a named (string) port.
                                        The endPort must be equal or greater than port.
                                      format: int32
                                      type: integer
                                    port:
                                      anyOf:
                                      - type: integer
                                      - type: string
                                      description: |-
                                        port represents the port on the given protocol. This can either be a numerical or named
                                        port on a pod. If this field is not provided, this matches all port names and
                                        numbers.
                                        If present, only traffic on the specified protocol AND port will be matched.
                                      x-kubernetes-int-or-string: true
                                    protocol:
                                      description: |-
                                        protocol represents the protocol (TCP, UDP, or SCTP) which traffic must match.
                                        If not specified, this field defaults to TCP.
                                      type: string
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        podSelector:
                          description: |-
                            podSelector selects the pods to which this NetworkPolicy object applies.
                            The array of rules is applied to any pods selected by this field. An empty
                            selector matches all pods in the policy's namespace.
                            Multiple network policies can select the same set of pods. In this case,
                            the ingress rules for each are combined additively.
                            This field is optional. If it is not specified, it defaults to an empty selector.
                          properties:
                            matchExpressions:
                              description: matchExpressions is a list of label selector
                                requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description: key is the label key that the selector
                                      applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - key
                                - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                        policyTypes:
                          description: |-
                            policyTypes is a list of rule types that the NetworkPolicy relates to.
                            Valid options are ["Ingress"], ["Egress"], or ["Ingress", "Egress"].
                            If this field is not specified, it will default based on the existence of ingress or egress rules;
                            policies that contain an egress section are assumed to affect egress, and all policies
                            (whether or not they contain an ingress section) are assumed to affect ingress.
                            If you want to write an egress-only policy, you must explicitly specify policyTypes [ "Egress" ].
                            Likewise, if you want to write a policy that specifies that no egress is allowed,
                            you must specify a policyTypes value that include "Egress" (since such a policy would not include
                            an egress section and would otherwise default to just [ "Ingress" ]).
                            This field is beta-level in 1.8
                          items:
                            description: |-
                              PolicyType string describes the NetworkPolicy type
                              This type is beta-level in 1.8
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                type: object
              nodeSelector:
                additionalProperties:
                  type: string
                description: Specifies the label to control the placement of pods
                  on a given pool of worker nodes. All namespaces created within the
                  Tenant will have the node selector annotation. This annotation tells
                  the Kubernetes scheduler to place pods on the nodes having the selector
                  label. Optional.
                type: object
              owners:
                description: |-
                  Specifies the owners of the Tenant.
                  Optional
                items:
                  properties:
                    annotations:
                      additionalProperties:
                        type: string
                      description: Additional Annotations for the synchronized rolebindings
                      type: object
                    clusterRoles:
                      default:
                      - admin
                      - capsule-namespace-deleter
                      description: Defines additional cluster-roles for the specific
                        Owner.
                      items:
                        type: string
                      type: array
                    kind:
                      description: Kind of entity. Possible values are "User", "Group",
                        and "ServiceAccount"
                      enum:
                      - User
                      - Group
                      - ServiceAccount
                      type: string
                    labels:
                      additionalProperties:
                        type: string
                      description: Additional Labels for the synchronized rolebindings
                      type: object
                    name:
                      description: Name of the entity.
                      type: string
                    proxySettings:
                      description: Proxy settings for tenant owner.
                      items:
                        properties:
                          kind:
                            enum:
                            - Nodes
                            - StorageClasses
                            - IngressClasses
                            - PriorityClasses
                            - RuntimeClasses
                            - PersistentVolumes
                            type: string
                          operations:
                            items:
                              enum:
                              - List
                              - Update
                              - Delete
                              type: string
                            type: array
                        required:
                        - kind
                        - operations
                        type: object
                      type: array
                  required:
                  - kind
                  - name
                  type: object
                type: array
              permissions:
                description: Specify Permissions for the Tenant.
                properties:
                  allowOwnerPromotion:
                    default: true
                    description: ClusterRoles granted to the promoted ServiceAccounts
                      across the Tenant
                    type: boolean
                  matchOwners:
                    description: |-
                      Matches TenantOwner objects which are promoted to owners of this tenant
                      The elements are OR operations and independent. You can see the resulting Tenant Owners
                      in the Status.Owners specification of the Tenant.
                    items:
                      description: |-
                        A label selector is a label query over a set of resources. The result of matchLabels and
                        matchExpressions are ANDed. An empty label selector matches all objects. A null
                        label selector matches no objects.
                      properties:
                        matchExpressions:
                          description: matchExpressions is a list of label selector
                            requirements. The requirements are ANDed.
                          items:
                            description: |-
                              A label selector requirement is a selector that contains values, a key, and an operator that
                              relates the key and values.
                            properties:
                              key:
                                description: key is the label key that the selector
                                  applies to.
                                type: string
                              operator:
                                description: |-
                                  operator represents a key's relationship to a set of values.
                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                type: string
                              values:
                                description: |-
                                  values is an array of string values. If the operator is In or NotIn,
                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                  the values array must be empty. This array is replaced during a strategic
                                  merge patch.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                            required:
                            - key
                            - operator
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: |-
                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                          type: object
                      type: object
                      x-kubernetes-map-type: atomic
                    type: array
                type: object
              podOptions:
                description: |-
                  Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/)

                  Specifies options for the Pods deployed in the Tenant namespaces, such as additional metadata.
                properties:
                  additionalMetadata:
                    description: Specifies additional labels and annotations the Capsule
                      operator places on any Pod resource in the Tenant. Optional.
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        type: object
                    type: object
                type: object
              preventDeletion:
                default: false
                description: |-
                  Prevent accidental deletion of the Tenant.
                  When enabled, the deletion request will be declined.
                type: boolean
              priorityClasses:
                description: |-
                  Specifies the allowed priorityClasses assigned to the Tenant.
                  Capsule assures that all Pods resources created in the Tenant can use only one of the allowed PriorityClasses.
                  A default value can be specified, and all the Pod resources created will inherit the declared class.
                  Optional.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                  default:
                    type: string
                  matchExpressions:
                    description: matchExpressions is a list of label selector requirements.
                      The requirements are ANDed.
                    items:
                      description: |-
                        A label selector requirement is a selector that contains values, a key, and an operator that
                        relates the key and values.
                      properties:
                        key:
                          description: key is the label key that the selector applies
                            to.
                          type: string
                        operator:
                          description: |-
                            operator represents a key's relationship to a set of values.
                            Valid operators are In, NotIn, Exists and DoesNotExist.
                          type: string
                        values:
                          description: |-
                            values is an array of string values. If the operator is In or NotIn,
                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
                            the values array must be empty. This array is replaced during a strategic
                            merge patch.
                          items:
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      required:
                      - key
                      - operator
                      type: object
                    type: array
                    x-kubernetes-list-type: atomic
                  matchLabels:
                    additionalProperties:
                      type: string
                    description: |-
                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                      map is equivalent to an element of matchExpressions, whose key field is "key", the
                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                    type: object
                type: object
                x-kubernetes-map-type: atomic
              resourceQuotas:
                description: |-
                  Deprecated: Use Rules Quota (https://projectcapsule.dev/docs/tenants/rules/#quotas)

                  Specifies a list of ResourceQuota resources assigned to the Tenant. The assigned values are inherited by any namespace created in the Tenant. The Capsule operator aggregates ResourceQuota at Tenant level, so that the hard quota is never crossed for the given Tenant. This permits the Tenant owner to consume resources in the Tenant regardless of the namespace. Optional.
                properties:
                  items:
                    items:
                      description: ResourceQuotaSpec defines the desired hard limits
                        to enforce for Quota.
                      properties:
                        hard:
                          additionalProperties:
                            anyOf:
                            - type: integer
                            - type: string
                            pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                            x-kubernetes-int-or-string: true
                          description: |-
                            hard is the set of desired hard limits for each named resource.
                            More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
                          type: object
                        scopeSelector:
                          description: |-
                            scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
                            but expressed using ScopeSelectorOperator in combination with possible values.
                            For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
                          properties:
                            matchExpressions:
                              description: A list of scope selector requirements by
                                scope of the resources.
                              items:
                                description: |-
                                  A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
                                  that relates the scope name and values.
                                properties:
                                  operator:
                                    description: |-
                                      Represents a scope's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists, DoesNotExist.
                                    type: string
                                  scopeName:
                                    description: The name of the scope that the selector
                                      applies to.
                                    type: string
                                  values:
                                    description: |-
                                      An array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty.
                                      This array is replaced during a strategic merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - operator
                                - scopeName
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                          type: object
                          x-kubernetes-map-type: atomic
                        scopes:
                          description: |-
                            A collection of filters that must match each object tracked by a quota.
                            If not specified, the quota matches all objects.
                          items:
                            description: A ResourceQuotaScope defines a filter that
                              must match each object tracked by a quota
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      type: object
                    type: array
                  scope:
                    default: Tenant
                    description: Define if the Resource Budget should compute resource
                      across all Namespaces in the Tenant or individually per cluster.
                      Default is Tenant
                    enum:
                    - Tenant
                    - Namespace
                    type: string
                type: object
              rules:
                description: |-
                  Specify enforcement specifications for the scope of the Tenant.
                   We are moving all configuration enforcement. per namespace into a rule construct.
                   It's currently not final.

                  Read More: https://projectcapsule.dev/docs/tenants/rules/
                items:
                  description: Rules Distributed via Tenants
                  properties:
                    audience:
                      description: |-
                        Audience limits this rule to matching request subjects.
                        An empty audience matches every request.
                      items:
                        properties:
                          kind:
                            enum:
                            - User
                            - Group
                            - ServiceAccount
                            - Custom
                            type: string
                          name:
                            type: string
                        required:
                        - kind
                        - name
                        type: object
                      type: array
                    enforce:
                      description: Enforcement for given rule
                      properties:
                        action:
                          default: deny
                          description: |-
                            Declare the action being performed on the enforcement rule:
                            deny: On match, deny admission request
                            allow: On match, allowed admission request
                            audit: On match, audit (post event) of admission request
                          enum:
                          - allow
                          - deny
                          - audit
                          type: string
                        ingress:
                          description: Enforcement for Ingress and Gateway API resource
                            hostnames.
                          properties:
                            hostnames:
                              description: |-
                                Hostnames defines allowed, denied, or audited hostname expressions.
                                A resource targeted by an allow or deny rule must declare non-empty values
                                in all hostname fields. Audit-only rules record missing hostnames without
                                denying them.
                              items:
                                description: |-
                                  At least one of Exact or Exp must be set.
                                  Both may be set together.
                                properties:
                                  exact:
                                    description: Exact matches one of the provided
                                      values exactly.
                                    items:
                                      type: string
                                    minItems: 1
                                    type: array
                                  exp:
                                    description: Exp matches regular expression.
                                    minLength: 1
                                    type: string
                                  negate:
                                    default: false
                                    description: Negate regular Expression
                                    type: boolean
                                type: object
                                x-kubernetes-validations:
                                - message: at least one of exact or exp must be set
                                  rule: has(self.exact) || has(self.exp)
                              minItems: 1
                              type: array
                            types:
                              description: Types defines the resource kinds to which
                                hostname enforcement applies.
                              items:
                                enum:
                                - Ingress
                                - Route
                                - ListenerSet
                                - HTTPRoute
                                - Gateway
                                - TLSRoute
                                - GRPCRoute
                                type: string
                              minItems: 1
                              type: array
                          type: object
                        metadata:
                          description: Enforcement for object metadata on namespaced
                            resources.
                          items:
                            description: MetadataRule defines metadata constraints
                              for namespaced resources.
                            properties:
                              annotations:
                                additionalProperties:
                                  properties:
                                    default:
                                      description: |-
                                        Default is applied by admission mutation when the concrete metadata key is absent.
                                        It is not reconciled after admission.
                                      type: string
                                    managed:
                                      description: |-
                                        Managed is enforced by admission mutation and reconciled by the RuleStatus
                                        controller using server-side apply when the rule configuration changes.
                                      type: string
                                    required:
                                      default: false
                                      description: |-
                                        Required enforces that the metadata key must be present.

                                        This is mainly meaningful with action=allow. Deny and audit rules remain
                                        value matchers and do not require missing metadata to exist.
                                      type: boolean
                                    values:
                                      description: |-
                                        Values defines allowed, denied, or audited values for the metadata key.

                                        If Required=true and Values is empty, only presence is enforced.
                                      items:
                                        description: |-
                                          At least one of Exact or Exp must be set.
                                          Both may be set together.
                                        properties:
                                          exact:
                                            description: Exact matches one of the
                                              provided values exactly.
                                            items:
                                              type: string
                                            minItems: 1
                                            type: array
                                          exp:
                                            description: Exp matches regular expression.
                                            minLength: 1
                                            type: string
                                          negate:
                                            default: false
                                            description: Negate regular Expression
                                            type: boolean
                                        type: object
                                        x-kubernetes-validations:
                                        - message: at least one of exact or exp must
                                            be set
                                          rule: has(self.exact) || has(self.exp)
                                      type: array
                                  type: object
                                description: Annotations defines metadata policies
                                  by annotation key.
                                type: object
                              apiGroups:
                                description: |-
                                  API groups or API group/version selectors of the referents.

                                  Empty or omitted APIGroups means the core Kubernetes API version "v1".
                                  Use "*" to match all API groups and versions.

                                  Examples:
                                  - [] or [""] means core "v1".
                                  - ["v1"] means core "v1".
                                  - ["apps"] means any version in the "apps" API group.
                                  - ["apps/v1"] means only "apps/v1".
                                  - ["apps", "batch/v1"] means any "apps" version and "batch/v1".
                                  - ["*"] means all API groups and versions.
                                items:
                                  type: string
                                type: array
                              kinds:
                                description: |-
                                  Kinds of the referents.

                                  Use "*" to match all kinds.
                                items:
                                  minLength: 1
                                  type: string
                                minItems: 1
                                type: array
                              labels:
                                additionalProperties:
                                  properties:
                                    default:
                                      description: |-
                                        Default is applied by admission mutation when the concrete metadata key is absent.
                                        It is not reconciled after admission.
                                      type: string
                                    managed:
                                      description: |-
                                        Managed is enforced by admission mutation and reconciled by the RuleStatus
                                        controller using server-side apply when the rule configuration changes.
                                      type: string
                                    required:
                                      default: false
                                      description: |-
                                        Required enforces that the metadata key must be present.

                                        This is mainly meaningful with action=allow. Deny and audit rules remain
                                        value matchers and do not require missing metadata to exist.
                                      type: boolean
                                    values:
                                      description: |-
                                        Values defines allowed, denied, or audited values for the metadata key.

                                        If Required=true and Values is empty, only presence is enforced.
                                      items:
                                        description: |-
                                          At least one of Exact or Exp must be set.
                                          Both may be set together.
                                        properties:
                                          exact:
                                            description: Exact matches one of the
                                              provided values exactly.
                                            items:
                                              type: string
                                            minItems: 1
                                            type: array
                                          exp:
                                            description: Exp matches regular expression.
                                            minLength: 1
                                            type: string
                                          negate:
                                            default: false
                                            description: Negate regular Expression
                                            type: boolean
                                        type: object
                                        x-kubernetes-validations:
                                        - message: at least one of exact or exp must
                                            be set
                                          rule: has(self.exact) || has(self.exp)
                                      type: array
                                  type: object
                                description: Labels defines metadata policies by label
                                  key.
                                type: object
                            required:
                            - kinds
                            type: object
                            x-kubernetes-validations:
                            - message: at least one of labels or annotations must
                                be set
                              rule: has(self.labels) || has(self.annotations)
                          type: array
                        services:
                          description: Enforcement for Services.
                          properties:
                            externalIPs:
                              description: ExternalIPs defines constraints for spec.externalIPs.
                              properties:
                                cidrs:
                                  description: |-
                                    CIDRs restricts spec.externalIPs. Individual IP addresses are treated as
                                    host CIDRs (/32 for IPv4 and /128 for IPv6).
                                    For deny rules, empty means all external IPs are denied. For allow and
                                    audit rules, empty means no external IP restriction.
                                  items:
                                    type: string
                                  type: array
                              type: object
                            externalNames:
                              description: ExternalNames defines additional constraints
                                for Services of type ExternalName.
                              properties:
                                hostnames:
                                  description: |-
                                    Hostnames restricts spec.externalName.
                                    Empty means no additional hostname restriction once ExternalName is allowed by types.
                                  items:
                                    description: |-
                                      At least one of Exact or Exp must be set.
                                      Both may be set together.
                                    properties:
                                      exact:
                                        description: Exact matches one of the provided
                                          values exactly.
                                        items:
                                          type: string
                                        minItems: 1
                                        type: array
                                      exp:
                                        description: Exp matches regular expression.
                                        minLength: 1
                                        type: string
                                      negate:
                                        default: false
                                        description: Negate regular Expression
                                        type: boolean
                                    type: object
                                    x-kubernetes-validations:
                                    - message: at least one of exact or exp must be
                                        set
                                      rule: has(self.exact) || has(self.exp)
                                  type: array
                              type: object
                            loadBalancers:
                              description: LoadBalancers defines additional constraints
                                for Services of type LoadBalancer.
                              properties:
                                cidrs:
                                  description: |-
                                    CIDRs restricts spec.loadBalancerIP and spec.loadBalancerSourceRanges.
                                    Empty means no additional CIDR restriction once LoadBalancer is allowed by types.
                                  items:
                                    type: string
                                  type: array
                              type: object
                            nodePorts:
                              description: NodePorts defines additional constraints
                                for nodePort values.
                              properties:
                                ports:
                                  description: |-
                                    Ports restricts explicitly requested nodePort values.
                                    Empty means no additional port restriction once NodePort is allowed by types.
                                  items:
                                    properties:
                                      from:
                                        format: int32
                                        maximum: 65535
                                        minimum: 1
                                        type: integer
                                      to:
                                        format: int32
                                        maximum: 65535
                                        minimum: 1
                                        type: integer
                                    required:
                                    - from
                                    - to
                                    type: object
                                  type: array
                              type: object
                            types:
                              description: |-
                                Types defines the Service types matched by this rule.

                                Supported values:
                                - ClusterIP
                                - NodePort
                                - LoadBalancer
                                - ExternalName
                              items:
                                enum:
                                - ClusterIP
                                - NodePort
                                - LoadBalancer
                                - ExternalName
                                type: string
                              type: array
                          type: object
                        workloads:
                          description: Enforcement for Workloads (Pods)
                          properties:
                            qosClasses:
                              description: |-
                                Define Pod QoS classes matched by this enforcement rule.
                                Supported values are Guaranteed, Burstable and BestEffort.
                              items:
                                description: PodQOSClass defines the supported qos
                                  classes of Pods.
                                type: string
                              type: array
                            registries:
                              description: |-
                                Define registries which are allowed to be used within this tenant
                                The rules are aggregated, since you can use Regular Expressions the match registry endpoints
                              items:
                                properties:
                                  exact:
                                    description: Exact matches one of the provided
                                      values exactly.
                                    items:
                                      type: string
                                    minItems: 1
                                    type: array
                                  exp:
                                    description: Exp matches regular expression.
                                    minLength: 1
                                    type: string
                                  negate:
                                    default: false
                                    description: Negate regular Expression
                                    type: boolean
                                  policy:
                                    description: Allowed PullPolicy for the given
                                      registry. Supplying no value allows all policies.
                                    items:
                                      description: PullPolicy describes a policy for
                                        if/when to pull a container image
                                      type: string
                                    type: array
                                type: object
                                x-kubernetes-validations:
                                - message: at least one of exact or exp must be set
                                  rule: has(self.exact) || has(self.exp)
                              type: array
                            resources:
                              description: |-
                                Resources defines mutation and enforcement policies for Pod and container
                                resource requests and limits. The workload targets select where the
                                policies apply. With no targets, resource policies apply to all compatible
                                locations: Pod-level resources, regular containers, and init containers.
                                Resource names unsupported at Pod level still apply to compatible container
                                locations.
                                Mutation is applied when a Pod is created. Remove and MatchRequest manage
                                explicit values, Default fills an absent value, and Ratio fills an absent
                                limit from its request. An explicit Ratio violation is then handled by the
                                enclosing allow, deny, or audit action.
                              properties:
                                limits:
                                  additionalProperties:
                                    description: WorkloadResourceLimitPolicy defines
                                      how a resource limit is mutated and enforced.
                                    properties:
                                      policy:
                                        description: |-
                                          Policy selects how the limit is handled: Preserve leaves it unchanged,
                                          Default fills an absent limit, Remove deletes it, MatchRequest manages it
                                          to equal the request, and Ratio defaults an absent limit and enforces the
                                          maximum multiplier against explicitly supplied limits.
                                        enum:
                                        - Preserve
                                        - Default
                                        - Remove
                                        - MatchRequest
                                        - Ratio
                                        type: string
                                      value:
                                        anyOf:
                                        - type: integer
                                        - type: string
                                        description: |-
                                          Value is the quantity applied by Default or the maximum limit-to-request
                                          multiplier applied by Ratio.
                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                        x-kubernetes-int-or-string: true
                                    required:
                                    - policy
                                    type: object
                                    x-kubernetes-validations:
                                    - message: value must be set only for the Default
                                        and Ratio policies
                                      rule: 'self.policy == ''Default'' || self.policy
                                        == ''Ratio'' ? has(self.value) : !has(self.value)'
                                  description: Limits defines policies for resource
                                    limits.
                                  minProperties: 1
                                  type: object
                                requests:
                                  additionalProperties:
                                    description: WorkloadResourceRequestPolicy defines
                                      how a resource request is mutated.
                                    properties:
                                      policy:
                                        description: |-
                                          Policy selects how the request is handled: Preserve leaves it unchanged,
                                          Default fills an absent request, and Remove deletes it.
                                        enum:
                                        - Preserve
                                        - Default
                                        - Remove
                                        type: string
                                      value:
                                        anyOf:
                                        - type: integer
                                        - type: string
                                        description: Value is the quantity applied
                                          by the Default policy.
                                        pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                                        x-kubernetes-int-or-string: true
                                    required:
                                    - policy
                                    type: object
                                    x-kubernetes-validations:
                                    - message: value must be set only for the Default
                                        policy
                                      rule: 'self.policy == ''Default'' ? has(self.value)
                                        : !has(self.value)'
                                  description: Requests defines policies for resource
                                    requests.
                                  minProperties: 1
                                  type: object
                              type: object
                              x-kubernetes-validations:
                              - message: at least one of requests or limits must be
                                  set
                                rule: has(self.requests) || has(self.limits)
                            schedulers:
                              description: |-
                                Schedulers defines schedulerName matchers for Pod admission.

                                The rule is evaluated against pod.spec.schedulerName.
                                Empty schedulerName is ignored and is not normalized to default-scheduler.
                              items:
                                description: |-
                                  At least one of Exact or Exp must be set.
                                  Both may be set together.
                                properties:
                                  exact:
                                    description: Exact matches one of the provided
                                      values exactly.
                                    items:
                                      type: string
                                    minItems: 1
                                    type: array
                                  exp:
                                    description: Exp matches regular expression.
                                    minLength: 1
                                    type: string
                                  negate:
                                    default: false
                                    description: Negate regular Expression
                                    type: boolean
                                type: object
                                x-kubernetes-validations:
                                - message: at least one of exact or exp must be set
                                  rule: has(self.exact) || has(self.exp)
                              type: array
                            targets:
                              description: |-
                                Define the enforcement targets this rule applies to.
                                If empty, each webhook applies its own backwards-compatible default.
                              items:
                                enum:
                                - pod
                                - pod/initcontainers
                                - pod/ephemeralcontainers
                                - pod/containers
                                - pod/volumes
                                type: string
                              type: array
                          type: object
                      type: object
                    namespaceSelector:
                      description: Select namespaces which are going to be targeted
                        with this rule
                      properties:
                        matchExpressions:
                          description: matchExpressions is a list of label selector
                            requirements. The requirements are ANDed.
                          items:
                            description: |-
                              A label selector requirement is a selector that contains values, a key, and an operator that
                              relates the key and values.
                            properties:
                              key:
                                description: key is the label key that the selector
                                  applies to.
                                type: string
                              operator:
                                description: |-
                                  operator represents a key's relationship to a set of values.
                                  Valid operators are In, NotIn, Exists and DoesNotExist.
                                type: string
                              values:
                                description: |-
                                  values is an array of string values. If the operator is In or NotIn,
                                  the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                  the values array must be empty. This array is replaced during a strategic
                                  merge patch.
                                items:
                                  type: string
                                type: array
                                x-kubernetes-list-type: atomic
                            required:
                            - key
                            - operator
                            type: object
                          type: array
                          x-kubernetes-list-type: atomic
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: |-
                            matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                            map is equivalent to an element of matchExpressions, whose key field is "key", the
                            operator is "In", and the values array contains only "value". The requirements are ANDed.
                          type: object
                      type: object
                      x-kubernetes-map-type: atomic
                    permissions:
                      description: Permissions for given rule
                      properties:
                        bindings:
                          description: Bindings defines additional RoleBindings for
                            namespaces selected by this rule.
                          items:
                            properties:
                              annotations:
                                additionalProperties:
                                  type: string
                                description: Additional Annotations for the synchronized
                                  rolebindings
                                type: object
                              clusterRoleName:
                                type: string
                              labels:
                                additionalProperties:
                                  type: string
                                description: Additional Labels for the synchronized
                                  rolebindings
                                type: object
                              subjects:
                                items:
                                  description: |-
                                    Subject contains a reference to the object or user identities a role binding applies to.  This can either hold a direct API object reference,
                                    or a value for non-objects such as user and group names.
                                  properties:
                                    apiGroup:
                                      description: |-
                                        APIGroup holds the API group of the referenced subject.
                                        Defaults to "" for ServiceAccount subjects.
                                        Defaults to "rbac.authorization.k8s.io" for User and Group subjects.
                                      type: string
                                    kind:
                                      description: |-
                                        Kind of object being referenced. Values defined by this API group are "User", "Group", and "ServiceAccount".
                                        If the Authorizer does not recognized the kind value, the Authorizer should report an error.
                                      type: string
                                    name:
                                      description: Name of the object being referenced.
                                      type: string
                                    namespace:
                                      description: |-
                                        Namespace of the referenced object.  If the object kind is non-namespace, such as "User" or "Group", and this value is not empty
                                        the Authorizer should report an error.
                                      type: string
                                  required:
                                  - kind
                                  - name
                                  type: object
                                  x-kubernetes-map-type: atomic
                                minItems: 1
                                type: array
                            required:
                            - clusterRoleName
                            - subjects
                            type: object
                          type: array
                        promotions:
                          description: |-
                            Define Promotion Rules which distributed additional ClusterRoles across the Tenant
                            for promoted ServiceAccounts.
                          items:
                            properties:
                              clusterRoles:
                                description: |-
                                  ClusterRoles granted to the promoted ServiceAccounts across the Tenant
                                  kubebuilder:validation:Minimum=1
                                items:
                                  type: string
                                type: array
                              selector:
                                description: |-
                                  Match ServiceAccounts which are promoted which are granted these additional ClusterRoles
                                  across the Tenant
                                properties:
                                  matchExpressions:
                                    description: matchExpressions is a list of label
                                      selector requirements. The requirements are
                                      ANDed.
                                    items:
                                      description: |-
                                        A label selector requirement is a selector that contains values, a key, and an operator that
                                        relates the key and values.
                                      properties:
                                        key:
                                          description: key is the label key that the
                                            selector applies to.
                                          type: string
                                        operator:
                                          description: |-
                                            operator represents a key's relationship to a set of values.
                                            Valid operators are In, NotIn, Exists and DoesNotExist.
                                          type: string
                                        values:
                                          description: |-
                                            values is an array of string values. If the operator is In or NotIn,
                                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                            the values array must be empty. This array is replaced during a strategic
                                            merge patch.
                                          items:
                                            type: string
                                          type: array
                                          x-kubernetes-list-type: atomic
                                      required:
                                      - key
                                      - operator
                                      type: object
                                    type: array
                                    x-kubernetes-list-type: atomic
                                  matchLabels:
                                    additionalProperties:
                                      type: string
                                    description: |-
                                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                      map is equivalent to an element of matchExpressions, whose key field is "key", the
                                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                                    type: object
                                type: object
                                x-kubernetes-map-type: atomic
                            type: object
                          type: array
                      type: object
                    quota:
                      description: |-
                        Quota contains native Kubernetes ResourceQuota specifications shared by
                        all namespaces selected by this rule. Unlike Enforce, quota accounting is
                        independent of the request audience.
                      items:
                        description: |-
                          ResourceQuotaRule defines a named ResourceQuota specification generated by a
                          Tenant rule. Name is the durable identity of the generated
                          GlobalResourceQuota and must be unique across all rules of a Tenant.
                        properties:
                          hard:
                            additionalProperties:
                              anyOf:
                              - type: integer
                              - type: string
                              pattern: ^(\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\+|-)?(([0-9]+(\.[0-9]*)?)|(\.[0-9]+))))?$
                              x-kubernetes-int-or-string: true
                            description: |-
                              hard is the set of desired hard limits for each named resource.
                              More info: https://kubernetes.io/docs/concepts/policy/resource-quotas/
                            type: object
                          name:
                            description: |-
                              Name is the stable identity of this quota within the Tenant. Changing the
                              name replaces the generated GlobalResourceQuota; changing the quota or its
                              namespace selector updates the existing object.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                          scopeSelector:
                            description: |-
                              scopeSelector is also a collection of filters like scopes that must match each object tracked by a quota
                              but expressed using ScopeSelectorOperator in combination with possible values.
                              For a resource to match, both scopes AND scopeSelector (if specified in spec), must be matched.
                            properties:
                              matchExpressions:
                                description: A list of scope selector requirements
                                  by scope of the resources.
                                items:
                                  description: |-
                                    A scoped-resource selector requirement is a selector that contains values, a scope name, and an operator
                                    that relates the scope name and values.
                                  properties:
                                    operator:
                                      description: |-
                                        Represents a scope's relationship to a set of values.
                                        Valid operators are In, NotIn, Exists, DoesNotExist.
                                      type: string
                                    scopeName:
                                      description: The name of the scope that the
                                        selector applies to.
                                      type: string
                                    values:
                                      description: |-
                                        An array of string values. If the operator is In or NotIn,
                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty.
                                        This array is replaced during a strategic merge patch.
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                  required:
                                  - operator
                                  - scopeName
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                            type: object
                            x-kubernetes-map-type: atomic
                          scopes:
                            description: |-
                              A collection of filters that must match each object tracked by a quota.
                              If not specified, the quota matches all objects.
                            items:
                              description: A ResourceQuotaScope defines a filter that
                                must match each object tracked by a quota
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - name
                        type: object
                      type: array
                      x-kubernetes-list-map-keys:
                      - name
                      x-kubernetes-list-type: map
                  type: object
                type: array
              runtimeClasses:
                description: |-
                  Specifies the allowed RuntimeClasses assigned to the Tenant.
                  Capsule assures that all Pods resources created in the Tenant can use only one of the allowed RuntimeClasses.
                  Optional.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                  default:
                    type: string
                  matchExpressions:
                    description: matchExpressions is a list of label selector requirements.
                      The requirements are ANDed.
                    items:
                      description: |-
                        A label selector requirement is a selector that contains values, a key, and an operator that
                        relates the key and values.
                      properties:
                        key:
                          description: key is the label key that the selector applies
                            to.
                          type: string
                        operator:
                          description: |-
                            operator represents a key's relationship to a set of values.
                            Valid operators are In, NotIn, Exists and DoesNotExist.
                          type: string
                        values:
                          description: |-
                            values is an array of string values. If the operator is In or NotIn,
                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
                            the values array must be empty. This array is replaced during a strategic
                            merge patch.
                          items:
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      required:
                      - key
                      - operator
                      type: object
                    type: array
                    x-kubernetes-list-type: atomic
                  matchLabels:
                    additionalProperties:
                      type: string
                    description: |-
                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                      map is equivalent to an element of matchExpressions, whose key field is "key", the
                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                    type: object
                type: object
                x-kubernetes-map-type: atomic
              serviceOptions:
                description: |-
                  Deprecated: Use Rules Metadata instead (https://projectcapsule.dev/docs/rules/enforcement/metadata/)

                  Specifies options for the Service, such as additional metadata or block of certain type of Services. Optional.
                properties:
                  additionalMetadata:
                    description: Specifies additional labels and annotations the Capsule
                      operator places on any Service resource in the Tenant. Optional.
                    properties:
                      annotations:
                        additionalProperties:
                          type: string
                        type: object
                      labels:
                        additionalProperties:
                          type: string
                        type: object
                    type: object
                  allowedServices:
                    description: Block or deny certain type of Services. Optional.
                    properties:
                      externalName:
                        default: true
                        description: Specifies if ExternalName service type resources
                          are allowed for the Tenant. Default is true. Optional.
                        type: boolean
                      loadBalancer:
                        default: true
                        description: Specifies if LoadBalancer service type resources
                          are allowed for the Tenant. Default is true. Optional.
                        type: boolean
                      nodePort:
                        default: true
                        description: Specifies if NodePort service type resources
                          are allowed for the Tenant. Default is true. Optional.
                        type: boolean
                    type: object
                  externalIPs:
                    description: Specifies the external IPs that can be used in Services
                      with type ClusterIP. An empty list means no IPs are allowed.
                      Optional.
                    properties:
                      allowed:
                        items:
                          pattern: ^([0-9]{1,3}.){3}[0-9]{1,3}(/([0-9]|[1-2][0-9]|3[0-2]))?$
                          type: string
                        type: array
                    required:
                    - allowed
                    type: object
                  forbiddenAnnotations:
                    description: Define the annotations that a Tenant Owner cannot
                      set for their Service resources.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                  forbiddenLabels:
                    description: Define the labels that a Tenant Owner cannot set
                      for their Service resources.
                    properties:
                      denied:
                        items:
                          type: string
                        type: array
                      deniedRegex:
                        type: string
                    type: object
                type: object
              storageClasses:
                description: |-
                  Specifies the allowed StorageClasses assigned to the Tenant.
                  Capsule assures that all PersistentVolumeClaim resources created in the Tenant can use only one of the allowed StorageClasses.
                  A default value can be specified, and all the PersistentVolumeClaim resources created will inherit the declared class.
                  Optional.
                properties:
                  allowed:
                    description: Match exact elements which are allowed as class names
                      within this tenant
                    items:
                      type: string
                    type: array
                  allowedRegex:
                    description: |-
                      Deprecated: will be removed in a future release

                      Match elements by regex.
                    type: string
                  default:
                    type: string
                  matchExpressions:
                    description: matchExpressions is a list of label selector requirements.
                      The requirements are ANDed.
                    items:
                      description: |-
                        A label selector requirement is a selector that contains values, a key, and an operator that
                        relates the key and values.
                      properties:
                        key:
                          description: key is the label key that the selector applies
                            to.
                          type: string
                        operator:
                          description: |-
                            operator represents a key's relationship to a set of values.
                            Valid operators are In, NotIn, Exists and DoesNotExist.
                          type: string
                        values:
                          description: |-
                            values is an array of string values. If the operator is In or NotIn,
                            the values array must be non-empty. If the operator is Exists or DoesNotExist,
                            the values array must be empty. This array is replaced during a strategic
                            merge patch.
                          items:
                            type: string
                          type: array
                          x-kubernetes-list-type: atomic
                      required:
                      - key
                      - operator
                      type: object
                    type: array
                    x-kubernetes-list-type: atomic
                  matchLabels:
                    additionalProperties:
                      type: string
                    description: |-
                      matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                      map is equivalent to an element of matchExpressions, whose key field is "key", the
                      operator is "In", and the values array contains only "value". The requirements are ANDed.
                    type: object
                type: object
                x-kubernetes-map-type: atomic
            type: object
          status:
            description: Returns the observed state of the Tenant.
            properties:
              classes:
                description: Available Class Types within Tenant
                properties:
                  device:
                    description: Available DeviceClasses
                    items:
                      type: string
                    type: array
                  gateway:
                    description: Available GatewayClasses
                    items:
                      type: string
                    type: array
                  priority:
                    description: Available PriorityClasses
                    items:
                      type: string
                    type: array
                  runtime:
                    description: Available StorageClasses
                    items:
                      type: string
                    type: array
                  storage:
                    description: Available Storageclasses (Only collected if any matching
                      condition is specified)
                    items:
                      type: string
                    type: array
                type: object
              conditions:
                description: Tenant Condition
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              namespaces:
                description: List of namespaces assigned to the Tenant. (Deprecated)
                items:
                  type: string
                type: array
              observedGeneration:
                description: ObservedGeneration is the most recent generation the
                  controller has observed.
                format: int64
                type: integer
              owners:
                description: Collected owners for this tenant
                items:
                  properties:
                    clusterRoles:
                      default:
                      - admin
                      - capsule-namespace-deleter
                      description: Defines additional cluster-roles for the specific
                        Owner.
                      items:
                        type: string
                      type: array
                    kind:
                      description: Kind of entity. Possible values are "User", "Group",
                        and "ServiceAccount"
                      enum:
                      - User
                      - Group
                      - ServiceAccount
                      type: string
                    name:
                      description: Name of the entity.
                      type: string
                  required:
                  - kind
                  - name
                  type: object
                type: array
              promotions:
                description: Promoted ServiceAccounts across the Tenant
                items:
                  properties:
                    clusterRoles:
                      default:
                      - admin
                      - capsule-namespace-deleter
                      description: Defines additional cluster-roles for the specific
                        Owner.
                      items:
                        type: string
                      type: array
                    kind:
                      description: Kind of entity. Possible values are "User", "Group",
                        and "ServiceAccount"
                      enum:
                      - User
                      - Group
                      - ServiceAccount
                      type: string
                    name:
                      description: Name of the entity.
                      type: string
                    targets:
                      description: Defines additional cluster-roles for the specific
                        Owner.
                      items:
                        type: string
                      type: array
                  required:
                  - kind
                  - name
                  type: object
                type: array
              size:
                description: How many namespaces are assigned to the Tenant.
                type: integer
              spaces:
                description: Tracks state for the namespaces associated with this
                  tenant
                items:
                  properties:
                    conditions:
                      description: Conditions
                      items:
                        description: Condition contains details for one aspect of
                          the current state of this API Resource.
                        properties:
                          lastTransitionTime:
                            description: |-
                              lastTransitionTime is the last time the condition transitioned from one status to another.
                              This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                            format: date-time
                            type: string
                          message:
                            description: |-
                              message is a human readable message indicating details about the transition.
                              This may be an empty string.
                            maxLength: 32768
                            type: string
                          observedGeneration:
                            description: |-
                              observedGeneration represents the .metadata.generation that the condition was set based upon.
                              For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                              with respect to the current state of the instance.
                            format: int64
                            minimum: 0
                            type: integer
                          reason:
                            description: |-
                              reason contains a programmatic identifier indicating the reason for the condition's last transition.
                              Producers of specific condition types may define expected values and meanings for this field,
                              and whether the values are considered a guaranteed API.
                              The value should be a CamelCase string.
                              This field may not be empty.
                            maxLength: 1024
                            minLength: 1
                            pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                            type: string
                          status:
                            description: status of the condition, one of True, False,
                              Unknown.
                            enum:
                            - "True"
                            - "False"
                            - Unknown
                            type: string
                          type:
                            description: type of condition in CamelCase or in foo.example.com/CamelCase.
                            maxLength: 316
                            pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                            type: string
                        required:
                        - lastTransitionTime
                        - message
                        - reason
                        - status
                        - type
                        type: object
                      type: array
                    enforce:
                      description: Managed Metadata
                      properties:
                        registry:
                          description: Registries which are allowed within this namespace
                          items:
                            properties:
                              exact:
                                description: Exact matches one of the provided values
                                  exactly.
                                items:
                                  type: string
                                minItems: 1
                                type: array
                              exp:
                                description: Exp matches regular expression.
                                minLength: 1
                                type: string
                              negate:
                                default: false
                                description: Negate regular Expression
                                type: boolean
                              policy:
                                description: Allowed PullPolicy for the given registry.
                                  Supplying no value allows all policies.
                                items:
                                  description: PullPolicy describes a policy for if/when
                                    to pull a container image
                                  type: string
                                type: array
                            type: object
                            x-kubernetes-validations:
                            - message: at least one of exact or exp must be set
                              rule: has(self.exact) || has(self.exp)
                          type: array
                      type: object
                    metadata:
                      description: Managed Metadata
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          description: Managed Annotations
                          type: object
                        labels:
                          additionalProperties:
                            type: string
                          description: Managed Labels
                          type: object
                      type: object
                    name:
                      description: Namespace Name
                      type: string
                    uid:
                      description: Namespace UID
                      type: string
                  required:
                  - conditions
                  - name
                  type: object
                type: array
              state:
                default: Active
                description: The operational state of the Tenant. Possible values
                  are "Active", "Cordoned" or "Terminating".
                enum:
                - Cordoned
                - Active
                - Terminating
                type: string
            required:
            - conditions
            - size
            - state
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
