group: kamaji.clastix.io
names:
  kind: DataStore
  listKind: DataStoreList
  plural: datastores
  singular: datastore
scope: Cluster
versions:
  - additionalPrinterColumns:
      - description: Kamaji data store driver
        jsonPath: .spec.driver
        name: Driver
        type: string
      - description: DataStore validated and ready for use
        jsonPath: .status.ready
        name: Ready
        type: boolean
      - description: Age
        jsonPath: .metadata.creationTimestamp
        name: Age
        type: date
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: DataStore is the Schema for the datastores API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: DataStoreSpec defines the desired state of DataStore.
            properties:
              basicAuth:
                description: |-
                  In case of authentication enabled for the given data store, specifies the username and password pair.
                  This value is optional.
                properties:
                  password:
                    properties:
                      content:
                        description: |-
                          Bare content of the file, base64 encoded.
                          It has precedence over the SecretReference value.
                        format: byte
                        type: string
                      secretReference:
                        properties:
                          keyPath:
                            description: |-
                              Name of the key for the given Secret reference where the content is stored.
                              This value is mandatory.
                            minLength: 1
                            type: string
                          name:
                            description: name is unique within a namespace to reference a secret resource.
                            type: string
                          namespace:
                            description: namespace defines the space within which the secret name must be unique.
                            type: string
                        required:
                          - keyPath
                        type: object
                        x-kubernetes-map-type: atomic
                    type: object
                  username:
                    properties:
                      content:
                        description: |-
                          Bare content of the file, base64 encoded.
                          It has precedence over the SecretReference value.
                        format: byte
                        type: string
                      secretReference:
                        properties:
                          keyPath:
                            description: |-
                              Name of the key for the given Secret reference where the content is stored.
                              This value is mandatory.
                            minLength: 1
                            type: string
                          name:
                            description: name is unique within a namespace to reference a secret resource.
                            type: string
                          namespace:
                            description: namespace defines the space within which the secret name must be unique.
                            type: string
                        required:
                          - keyPath
                        type: object
                        x-kubernetes-map-type: atomic
                    type: object
                required:
                  - password
                  - username
                type: object
              driver:
                description: The driver to use to connect to the shared datastore.
                enum:
                  - etcd
                  - MySQL
                  - PostgreSQL
                  - NATS
                type: string
                x-kubernetes-validations:
                  - message: Datastore driver is immutable
                    rule: self == oldSelf
              endpoints:
                description: |-
                  List of the endpoints to connect to the shared datastore.
                  No need for protocol, just bare IP/FQDN and port.
                items:
                  type: string
                minItems: 1
                type: array
              tlsConfig:
                description: |-
                  Defines the TLS/SSL configuration required to connect to the data store in a secure way.
                  This value is optional.
                properties:
                  certificateAuthority:
                    description: |-
                      Retrieve the Certificate Authority certificate and private key, such as bare content of the file, or a SecretReference.
                      The key reference is required since etcd authentication is based on certificates, and Kamaji is responsible in creating this.
                    properties:
                      certificate:
                        properties:
                          content:
                            description: |-
                              Bare content of the file, base64 encoded.
                              It has precedence over the SecretReference value.
                            format: byte
                            type: string
                          secretReference:
                            properties:
                              keyPath:
                                description: |-
                                  Name of the key for the given Secret reference where the content is stored.
                                  This value is mandatory.
                                minLength: 1
                                type: string
                              name:
                                description: name is unique within a namespace to reference a secret resource.
                                type: string
                              namespace:
                                description: namespace defines the space within which the secret name must be unique.
                                type: string
                            required:
                              - keyPath
                            type: object
                            x-kubernetes-map-type: atomic
                        type: object
                      privateKey:
                        properties:
                          content:
                            description: |-
                              Bare content of the file, base64 encoded.
                              It has precedence over the SecretReference value.
                            format: byte
                            type: string
                          secretReference:
                            properties:
                              keyPath:
                                description: |-
                                  Name of the key for the given Secret reference where the content is stored.
                                  This value is mandatory.
                                minLength: 1
                                type: string
                              name:
                                description: name is unique within a namespace to reference a secret resource.
                                type: string
                              namespace:
                                description: namespace defines the space within which the secret name must be unique.
                                type: string
                            required:
                              - keyPath
                            type: object
                            x-kubernetes-map-type: atomic
                        type: object
                    required:
                      - certificate
                    type: object
                  clientCertificate:
                    description: Specifies the SSL/TLS key and private key pair used to connect to the data store.
                    properties:
                      certificate:
                        properties:
                          content:
                            description: |-
                              Bare content of the file, base64 encoded.
                              It has precedence over the SecretReference value.
                            format: byte
                            type: string
                          secretReference:
                            properties:
                              keyPath:
                                description: |-
                                  Name of the key for the given Secret reference where the content is stored.
                                  This value is mandatory.
                                minLength: 1
                                type: string
                              name:
                                description: name is unique within a namespace to reference a secret resource.
                                type: string
                              namespace:
                                description: namespace defines the space within which the secret name must be unique.
                                type: string
                            required:
                              - keyPath
                            type: object
                            x-kubernetes-map-type: atomic
                        type: object
                      privateKey:
                        properties:
                          content:
                            description: |-
                              Bare content of the file, base64 encoded.
                              It has precedence over the SecretReference value.
                            format: byte
                            type: string
                          secretReference:
                            properties:
                              keyPath:
                                description: |-
                                  Name of the key for the given Secret reference where the content is stored.
                                  This value is mandatory.
                                minLength: 1
                                type: string
                              name:
                                description: name is unique within a namespace to reference a secret resource.
                                type: string
                              namespace:
                                description: namespace defines the space within which the secret name must be unique.
                                type: string
                            required:
                              - keyPath
                            type: object
                            x-kubernetes-map-type: atomic
                        type: object
                    required:
                      - certificate
                      - privateKey
                    type: object
                required:
                  - certificateAuthority
                type: object
            required:
              - driver
              - endpoints
            type: object
            x-kubernetes-validations:
              - message: certificateAuthority privateKey must have secretReference or content when driver is etcd
                rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.certificateAuthority.privateKey.secretReference) || has(self.tlsConfig.certificateAuthority.privateKey.content))) : true'
              - message: clientCertificate must have secretReference or content when driver is etcd
                rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content))) : true'
              - message: clientCertificate privateKey must have secretReference or content when driver is etcd
                rule: '(self.driver == "etcd") ? (self.tlsConfig != null && (has(self.tlsConfig.clientCertificate.privateKey.secretReference) || has(self.tlsConfig.clientCertificate.privateKey.content))) : true'
              - message: When driver is not etcd and tlsConfig exists, clientCertificate must be null or contain valid content
                rule: '(self.driver != "etcd" && has(self.tlsConfig) && has(self.tlsConfig.clientCertificate)) ? (((has(self.tlsConfig.clientCertificate.certificate.secretReference) || has(self.tlsConfig.clientCertificate.certificate.content)))) : true'
              - message: When driver is not etcd and basicAuth exists, username must have secretReference or content
                rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.username.secretReference) || has(self.basicAuth.username.content))) : true'
              - message: When driver is not etcd and basicAuth exists, password must have secretReference or content
                rule: '(self.driver != "etcd" && has(self.basicAuth)) ? ((has(self.basicAuth.password.secretReference) || has(self.basicAuth.password.content))) : true'
              - message: When driver is not etcd, either tlsConfig or basicAuth must be provided
                rule: '(self.driver != "etcd") ? (has(self.tlsConfig) || has(self.basicAuth)) : true'
              - message: driver is immutable and cannot be changed after creation
                rule: oldSelf == null || self.driver == oldSelf.driver
          status:
            description: DataStoreStatus defines the observed state of DataStore.
            properties:
              conditions:
                description: Conditions contains the validation conditions for the given Datastore.
                items:
                  description: Condition contains details for one aspect of the current state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                        - "True"
                        - "False"
                        - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                    - lastTransitionTime
                    - message
                    - reason
                    - status
                    - type
                  type: object
                type: array
              observedGeneration:
                description: ObservedGeneration represents the .metadata.generation that was last reconciled.
                format: int64
                type: integer
              ready:
                description: |-
                  Ready returns if the DataStore is accepted and ready to get used:
                  Kamaji will ensure certificates are available, or correctly referenced.
                type: boolean
              usedBy:
                description: List of the Tenant Control Planes, namespaced named, using this data store.
                items:
                  type: string
                type: array
            required:
              - ready
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
