---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cert-manager.io/inject-ca-from: kamaji-system/kamaji-serving-cert
    controller-gen.kubebuilder.io/version: v0.20.0
  name: datastores.kamaji.clastix.io
spec:
  group: kamaji.clastix.io
  names:
    kind: DataStore
    listKind: DataStoreList
    plural: datastores
    singular: datastore
  scope: Cluster
  versions:
    - additionalPrinterColumns:
        - description: Kamaji data store driver
          jsonPath: .spec.driver
          name: Driver
          type: string
        - description: DataStore validated and ready for use
          jsonPath: .status.ready
          name: Ready
          type: boolean
        - description: Age
          jsonPath: .metadata.creationTimestamp
          name: Age
          type: date
      name: v1alpha1
      schema:
        openAPIV3Schema:
          description: DataStore is the Schema for the datastores API.
          properties:
            apiVersion:
              description: |-
                APIVersion defines the versioned schema of this representation of an object.
                Servers should convert recognized schemas to the latest internal value, and
                may reject unrecognized values.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
              type: string
            kind:
              description: |-
                Kind is a string value representing the REST resource this object represents.
                Servers may infer this from the endpoint the client submits requests to.
                Cannot be updated.
                In CamelCase.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
              type: string
            metadata:
              type: object
            spec:
              description: DataStoreSpec defines the desired state of DataStore.
              properties:
                basicAuth:
                  description: |-
                    In case of authentication enabled for the given data store, specifies the username and password pair.
                    This value is optional.
                  properties:
                    password:
                      properties:
                        content:
                          description: |-
                            Bare content of the file, base64 encoded.
                            It has precedence over the SecretReference value.
                          format: byte
                          type: string
                        secretReference:
                          properties:
                            keyPath:
                              description: |-
                                Name of the key for the given Secret reference where the content is stored.
                                This value is mandatory.
                              minLength: 1
                              type: string
                            name:
                              description: name is unique within a namespace to reference a secret resource.
                              type: string
                            namespace:
                              description: namespace defines the space within which the secret name must be unique.
                              type: string
                          required:
                            - keyPath
                          type: object
                          x-kubernetes-map-type: atomic
                      type: object
                    username:
                      properties:
                        content:
                          description: |-
                            Bare content of the file, base64 encoded.
                            It has precedence over the SecretReference value.
                          format: byte
                          type: string
                        secretReference:
                          properties:
                            keyPath:
                              description: |-
                                Name of the key for the given Secret reference where the content is stored.
                                This value is mandatory.
                              minLength: 1
                              type: string
                            name:
                              description: name is unique within a namespace to reference a secret resource.
                              type: string
                            namespace:
                              description: namespace defines the space within which the secret name must be unique.
                              type: string
                          required:
                            - keyPath
                          type: object
                          x-kubernetes-map-type: atomic
                      type: object
                  required:
                    - password
                    - username
                  type: object
                driver:
                  description: The driver to use to connect to the shared datastore.
                  enum:
                    - etcd
                    - MySQL
                    - PostgreSQL
                    - NATS
                  type: string
                  x-kubernetes-validations:
                    - message: Datastore driver is immutable
                      rule: self == oldSelf
                endpoints:
                  description: |-
                    List of the endpoints to connect to the shared datastore.
                    No need for protocol, just bare IP/FQDN and port.
                  items:
                    type: string
                  minItems: 1
                  type: array
                tlsConfig:
                  description: |-
                    Defines the TLS/SSL configuration required to connect to the data store in a secure way.
                    This value is optional.
                  properties:
                    certificateAuthority:
                      description: |-
                        Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference.
                        The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
                      properties:
                        certificate:
                          properties:
                            content:
                              description: |-
                                Bare content of the file, base64 encoded.
                                It has precedence over the SecretReference value.
                              format: byte
                              type: string
                            secretReference:
                              properties:
                                keyPath:
                                  description: |-
                                    Name of the key for the given Secret reference where the content is stored.
                                    This value is mandatory.
                                  minLength: 1
                                  type: string
                                name:
                                  description: name is unique within a namespace to reference a secret resource.
                                  type: string
                                namespace:
                                  description: namespace defines the space within which the secret name must be unique.
                                  type: string
                              required:
                                - keyPath
                              type: object
                              x-kubernetes-map-type: atomic
                          type: object
                        privateKey:
                          properties:
                            content:
                              description: |-
                                Bare content of the file, base64 encoded.
                                It has precedence over the SecretReference value.
                              format: byte
                              type: string
                            secretReference:
                              properties:
                                keyPath:
                                  description: |-
                                    Name of the key for the given Secret reference where the content is stored.
                                    This value is mandatory.
                                  minLength: 1
                                  type: string
                                name:
                                  description: name is unique within a namespace to reference a secret resource.
                                  type: string
                                namespace:
                                  description: namespace defines the space within which the secret name must be unique.
                                  type: string
                              required:
                                - keyPath
                              type: object
                              x-kubernetes-map-type: atomic
                          type: object
                      required:
                        - certificate
                      type: object
                    clientCertificate:
                      description: Specifies the SSL/TLS key and private key pair used to connect to the data store.
                      properties:
                        certificate:
                          properties:
                            content:
                              description: |-
                                Bare content of the file, base64 encoded.
                                It has precedence over the SecretReference value.
                              format: byte
                              type: string
                            secretReference:
                              properties:
                                keyPath:
                                  description: |-
                                    Name of the key for the given Secret reference where the content is stored.
                                    This value is mandatory.
                                  minLength: 1
                                  type: string
                                name:
                                  description: name is unique within a namespace to reference a secret resource.
                                  type: string
                                namespace:
                                  description: namespace defines the space within which the secret name must be unique.
                                  type: string
                              required:
                                - keyPath
                              type: object
                              x-kubernetes-map-type: atomic
                          type: object
                        privateKey:
                          properties:
                            content:
                              description: |-
                                Bare content of the file, base64 encoded.
                                It has precedence over the SecretReference value.
                              format: byte
                              type: string
                            secretReference:
                              properties:
                                keyPath:
                                  description: |-
                                    Name of the key for the given Secret reference where the content is stored.
                                    This value is mandatory.
                                  minLength: 1
                                  type: string
                                name:
                                  description: name is unique within a namespace to reference a secret resource.
                                  type: string
                                namespace:
                                  description: namespace defines the space within which the secret name must be unique.
                                  type: string
                              required:
                                - keyPath
                              type: object
                              x-kubernetes-map-type: atomic
                          type: object
                      required:
                        - certificate
                        - privateKey
                      type: object
                  required:
                    - certificateAuthority
                  type: object
              required:
                - driver
                - endpoints
              type: object
              x-kubernetes-validations:
                - message: certificateAuthority privateKey must have secretReference or content when driver is etcd
                  rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.certificateAuthority.privateKey.secretReference) || has(self.tlsConfig.certificateAuthority.privateKey.content))) : true'
                - message: clientCertificate must have secretReference or content when driver is etcd
                  rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content))) : true'
                - message: clientCertificate privateKey must have secretReference or content when driver is etcd
                  rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.privateKey.secretReference) || has(self.tlsConfig.clientCertificate.privateKey.content))) : true'
                - message: When driver is not etcd and tlsConfig exists, clientCertificate must be null or contain valid content
                  rule: '(self.driver != "etcd" && has(self.tlsConfig) && has(self.tlsConfig.clientCertificate)) ? (((has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content)))) : true'
                - message: When driver is not etcd and basicAuth exists, username must have secretReference or content
                  rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.username.secretReference) || has(self.basicAuth.username.content))) : true'
                - message: When driver is not etcd and basicAuth exists, password must have secretReference or content
                  rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
                - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                  rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
                - message: driver is immutable and cannot be changed after creation
                  rule: oldSelf == null || self.driver == oldSelf.driver
            status:
              description: DataStoreStatus defines the observed state of DataStore.
              properties:
                conditions:
                  description: Conditions contains the validation conditions for the given Datastore.
                  items:
                    description: Condition contains details for one aspect of the current state of this API Resource.
                    properties:
                      lastTransitionTime:
                        description: |-
                          lastTransitionTime is the last time the condition transitioned from one status to another.
                          This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                        format: date-time
                        type: string
                      message:
                        description: |-
                          message is a human readable message indicating details about the transition.
                          This may be an empty string.
                        maxLength: 32768
                        type: string
                      observedGeneration:
                        description: |-
                          observedGeneration represents the .metadata.generation that the condition was set based upon.
                          For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                          with respect to the current state of the instance.
                        format: int64
                        minimum: 0
                        type: integer
                      reason:
                        description: |-
                          reason contains a programmatic identifier indicating the reason for the condition's last transition.
                          Producers of specific condition types may define expected values and meanings for this field,
                          and whether the values are considered a guaranteed API.
                          The value should be a CamelCase string.
                          This field may not be empty.
                        maxLength: 1024
                        minLength: 1
                        pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                        type: string
                      status:
                        description: status of the condition, one of True, False, Unknown.
                        enum:
                          - "True"
                          - "False"
                          - Unknown
                        type: string
                      type:
                        description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        maxLength: 316
                        pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                        type: string
                    required:
                      - lastTransitionTime
                      - message
                      - reason
                      - status
                      - type
                    type: object
                  type: array
                observedGeneration:
                  description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                  format: int64
                  type: integer
                ready:
                  description: |-
                    Ready returns if the DataStore is accepted and ready to get used:
                    Kamaji will ensure certificates are available, or correctly referenced.
                  type: boolean
                usedBy:
                  description: List of the Tenant Control Planes, namespaced named, using this data store.
                  items:
                    type: string
                  type: array
              required:
                - ready
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}
