apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.9.0
  creationTimestamp: null
  labels:
    app.kubernetes.io/name: pomerium
  name: pomerium.ingress.pomerium.io
spec:
  group: ingress.pomerium.io
  names:
    kind: Pomerium
    listKind: PomeriumList
    plural: pomerium
    singular: pomerium
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: Pomerium define runtime-configurable Pomerium settings that do
          not fall into the category of deployment parameters
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: PomeriumSpec defines Pomerium-specific configuration parameters.
            properties:
              authenticate:
                description: Authenticate sets authenticate service parameters
                properties:
                  callbackPath:
                    description: "CallbackPath sets the path at which the authenticate
                      service receives callback responses from your identity provider.
                      The value must exactly match one of the authorized redirect
                      URIs for the OAuth 2.0 client. \n <p>This value is referred
                      to as the redirect_url in the OpenIDConnect and OAuth2 specs.</p>
                      <p>Defaults to <code>/oauth2/callback</code></p>"
                    type: string
                  url:
                    description: "AuthenticateURL is a dedicated domain URL the non-authenticated
                      persons would be referred to. \n <p><ul> <li>You do not need
                      to create a dedicated <code>Ingress</code> for this virtual
                      route, as it is handled by Pomerium internally. </li> <li>You
                      do need create a secret with corresponding TLS certificate for
                      this route and reference it via <a href=\"#prop-certificates\"><code>certificates</code></a>.
                      If you use <code>cert-manager</code> with <code>HTTP01</code>
                      challenge, you may use <code>pomerium</code> <code>ingressClass</code>
                      to solve it.</li> </ul></p>"
                    format: uri
                    pattern: ^https://
                    type: string
                required:
                - url
                type: object
              certificates:
                description: Certificates is a list of secrets of type TLS to use
                format: namespace/name
                items:
                  type: string
                type: array
              cookie:
                description: Cookie defines Pomerium session cookie options.
                properties:
                  domain:
                    description: Domain defaults to the same host that set the cookie.
                      If you specify the domain explicitly, then subdomains would
                      also be included.
                    type: string
                  expire:
                    description: Expire sets cookie and Pomerium session expiration
                      time. Once session expires, users would have to re-login. If
                      you change this parameter, existing sessions are not affected.
                      <p>See <a href="https://www.pomerium.com/docs/enterprise/about#session-management">Session
                      Management</a> (Enterprise) for a more fine-grained session
                      controls.</p> <p>Defaults to 14 hours.</p>
                    format: duration
                    type: string
                  httpOnly:
                    description: HTTPOnly if set to <code>false</code>, the cookie
                      would be accessible from within the JavaScript. Defaults to
                      <code>true</code>.
                    type: boolean
                  name:
                    description: Name sets the Pomerium session cookie name. Defaults
                      to <code>_pomerium</code>
                    type: string
                  secure:
                    description: Secure if set to false, would make a cookie accessible
                      over insecure protocols (HTTP). Defaults to <code>true</code>.
                    type: boolean
                type: object
              identityProvider:
                description: IdentityProvider configure single-sign-on authentication
                  and user identity details by integrating with your <a href="https://www.pomerium.com/docs/identity-providers/">Identity
                  Provider</a>
                properties:
                  provider:
                    description: Provider is the short-hand name of a built-in OpenID
                      Connect (oidc) identity provider to be used for authentication.
                      To use a generic provider, set to <code>oidc</code>.
                    enum:
                    - auth0
                    - azure
                    - google
                    - okta
                    - onelogin
                    - oidc
                    - ping
                    - github
                    type: string
                  refreshDirectory:
                    description: RefreshDirectory is no longer supported, please see
                      <a href="https://docs.pomerium.com/docs/overview/upgrading#idp-directory-sync">Upgrade
                      Guide</a>.
                    properties:
                      interval:
                        description: interval is the time that pomerium will sync
                          your IDP directory.
                        format: duration
                        type: string
                      timeout:
                        description: timeout is the maximum time allowed each run.
                        format: duration
                        type: string
                    required:
                    - interval
                    - timeout
                    type: object
                  requestParams:
                    additionalProperties:
                      type: string
                    description: RequestParams to be added as part of a signin request
                      using OAuth2 code flow.
                    format: namespace/name
                    type: object
                  requestParamsSecret:
                    description: RequestParamsSecret is a reference to a secret for
                      additional parameters you'd prefer not to provide in plaintext.
                    format: namespace/name
                    type: string
                  scopes:
                    description: Scopes Identity provider scopes correspond to access
                      privilege scopes as defined in Section 3.3 of OAuth 2.0 RFC6749.
                    items:
                      type: string
                    type: array
                  secret:
                    description: Secret containing IdP provider specific parameters.
                      and must contain at least <code>client_id</code> and <code>client_secret</code>
                      values.
                    format: namespace/name
                    minLength: 1
                    type: string
                  serviceAccountFromSecret:
                    description: ServiceAccountFromSecret is no longer supported,
                      see <a href="https://docs.pomerium.com/docs/overview/upgrading#idp-directory-sync">Upgrade
                      Guide</a>.
                    type: string
                  url:
                    description: URL is the base path to an identity provider's OpenID
                      connect discovery document. See <a href="https://pomerium.com/docs/identity-providers">Identity
                      Providers</a> guides for details.
                    format: uri
                    pattern: ^https://
                    type: string
                required:
                - provider
                - secret
                type: object
              jwtClaimHeaders:
                additionalProperties:
                  type: string
                description: JWTClaimHeaders convert claims from the assertion token
                  into HTTP headers and adds them into JWT assertion header. Please
                  make sure to read <a href="https://www.pomerium.com/docs/topics/getting-users-identity">
                  Getting User Identity</a> guide.
                type: object
              secrets:
                description: "Secrets references a Secret with Pomerium bootstrap
                  parameters. \n <p> <ul> <li><a href=\"https://pomerium.com/docs/reference/shared-secret\"><code>shared_secret</code></a>
                  - secures inter-Pomerium service communications. </li> <li><a href=\"https://pomerium.com/docs/reference/cookie-secret\"><code>cookie_secret</code></a>
                  - encrypts Pomerium session browser cookie. See also other <a href=\"#cookie\">Cookie</a>
                  parameters. </li> <li><a href=\"https://pomerium.com/docs/reference/signing-key\"><code>signing_key</code></a>
                  signs Pomerium JWT assertion header. See <a href=\"https://www.pomerium.com/docs/topics/getting-users-identity\">Getting
                  the user's identity</a> guide. </li> </ul> </p> <p> In a default
                  Pomerium installation manifest, they would be generated via a <a
                  href=\"https://github.com/pomerium/ingress-controller/blob/main/config/gen_secrets/job.yaml\">one-time
                  job</a> and stored in a <code>pomerium/bootstrap</code> Secret.
                  You may re-run the job to rotate the secrets, or update the Secret
                  values manually. </p>"
                format: namespace/name
                minLength: 1
                type: string
              storage:
                description: Storage defines persistent storage for sessions and other
                  data. See <a href="https://www.pomerium.com/docs/topics/data-storage">Storage</a>
                  for details. If no storage is specified, Pomerium would use a transient
                  in-memory storage (not recommended for production).
                properties:
                  postgres:
                    description: Postgres specifies PostgreSQL database connection
                      parameters
                    properties:
                      caSecret:
                        description: CASecret should refer to a k8s secret with key
                          <code>ca.crt</code> containing CA certificate that, if specified,
                          would be used to populate <code>sslrootcert</code> parameter
                          of the connection string.
                        format: namespace/name
                        minLength: 1
                        type: string
                      secret:
                        description: Secret specifies a name of a Secret that must
                          contain <code>connection</code> key. See <a href="https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-CONNSTRING">DSN
                          Format and Parameters</a>. Do not set <code>sslrootcert</code>,
                          <code>sslcert</code> and <code>sslkey</code> via connection
                          string, use <code>tlsCecret</code> and <code>caSecret</code>
                          CRD options instead.
                        format: namespace/name
                        minLength: 1
                        type: string
                      tlsSecret:
                        description: TLSSecret should refer to a k8s secret of type
                          <code>kubernetes.io/tls</code> and allows to specify an
                          optional client certificate and key, by constructing <code>sslcert</code>
                          and <code>sslkey</code> connection string <a href="https://www.postgresql.org/docs/current/libpq-connect.html#LIBPQ-PARAMKEYWORDS">
                          parameter values</a>.
                        format: namespace/name
                        minLength: 1
                        type: string
                    required:
                    - secret
                    type: object
                  redis:
                    description: Redis defines REDIS connection parameters
                    properties:
                      caSecret:
                        description: CASecret should refer to a k8s secret with key
                          <code>ca.crt</code> that must be a PEM-encoded certificate
                          authority to use when connecting to the databroker storage
                          engine.
                        format: namespace/name
                        type: string
                      secret:
                        description: Secret specifies a name of a Secret that must
                          contain <code>connection</code> key.
                        format: namespace/name
                        minLength: 1
                        type: string
                      tlsSecret:
                        description: TLSSecret should refer to a k8s secret of type
                          <code>kubernetes.io/tls</code> that would be used to perform
                          TLS connection to REDIS.
                        format: namespace/name
                        minLength: 1
                        type: string
                      tlsSkipVerify:
                        description: TLSSkipVerify disables TLS certificate chain
                          validation.
                        type: boolean
                    required:
                    - secret
                    type: object
                type: object
            required:
            - authenticate
            - identityProvider
            - secrets
            type: object
          status:
            description: PomeriumStatus represents configuration and Ingress status.
            properties:
              ingress:
                additionalProperties:
                  description: ResourceStatus represents the outcome of the latest
                    attempt to reconcile relevant Kubernetes resource with Pomerium.
                  properties:
                    error:
                      description: Error that prevented latest observedGeneration
                        to be synchronized with Pomerium.
                      type: string
                    observedAt:
                      description: ObservedAt is when last reconciliation attempt
                        was made.
                      format: date-time
                      type: string
                    observedGeneration:
                      description: ObservedGeneration represents the <code>.metadata.generation</code>
                        that was last presented to Pomerium.
                      format: int64
                      type: integer
                    reconciled:
                      description: Reconciled is whether this object generation was
                        successfully synced with pomerium.
                      type: boolean
                    warnings:
                      description: Warnings while parsing the resource.
                      items:
                        type: string
                      type: array
                  required:
                  - reconciled
                  type: object
                description: Routes provide per-Ingress status.
                type: object
              settingsStatus:
                description: SettingsStatus represent most recent main configuration
                  reconciliation status.
                properties:
                  error:
                    description: Error that prevented latest observedGeneration to
                      be synchronized with Pomerium.
                    type: string
                  observedAt:
                    description: ObservedAt is when last reconciliation attempt was
                      made.
                    format: date-time
                    type: string
                  observedGeneration:
                    description: ObservedGeneration represents the <code>.metadata.generation</code>
                      that was last presented to Pomerium.
                    format: int64
                    type: integer
                  reconciled:
                    description: Reconciled is whether this object generation was
                      successfully synced with pomerium.
                    type: boolean
                  warnings:
                    description: Warnings while parsing the resource.
                    items:
                      type: string
                    type: array
                required:
                - reconciled
                type: object
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}