apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  creationTimestamp: null
  name: teleportprovisiontokens.resources.teleport.dev
spec:
  group: resources.teleport.dev
  names:
    kind: TeleportProvisionToken
    listKind: TeleportProvisionTokenList
    plural: teleportprovisiontokens
    shortNames:
    - provisiontoken
    - provisiontokens
    singular: teleportprovisiontoken
  scope: Namespaced
  versions:
  - name: v2
    schema:
      openAPIV3Schema:
        description: ProvisionToken is the Schema for the provisiontokens API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: ProvisionToken resource definition v2 from Teleport
            properties:
              allow:
                description: Allow is a list of TokenRules, nodes using this token
                  must match one allow rule to use this token.
                items:
                  properties:
                    aws_account:
                      description: AWSAccount is the AWS account ID.
                      type: string
                    aws_arn:
                      description: AWSARN is used for the IAM join method, the AWS
                        identity of joining nodes must match this ARN. Supports wildcards
                        "*" and "?".
                      type: string
                    aws_regions:
                      description: AWSRegions is used for the EC2 join method and
                        is a list of AWS regions a node is allowed to join from.
                      items:
                        type: string
                      nullable: true
                      type: array
                    aws_role:
                      description: AWSRole is used for the EC2 join method and is
                        the the ARN of the AWS role that the auth server will assume
                        in order to call the ec2 API.
                      type: string
                  type: object
                nullable: true
                type: array
              aws_iid_ttl:
                description: AWSIIDTTL is the TTL to use for AWS EC2 Instance Identity
                  Documents used to join the cluster with this token.
                format: duration
                type: string
              azure:
                description: Azure allows the configuration of options specific to
                  the "azure" join method.
                nullable: true
                properties:
                  allow:
                    description: Allow is a list of Rules, nodes using this token
                      must match one allow rule to use this token.
                    items:
                      properties:
                        resource_groups:
                          items:
                            type: string
                          nullable: true
                          type: array
                        subscription:
                          type: string
                      type: object
                    nullable: true
                    type: array
                type: object
              bot_name:
                description: BotName is the name of the bot this token grants access
                  to, if any
                type: string
              circleci:
                description: CircleCI allows the configuration of options specific
                  to the "circleci" join method.
                nullable: true
                properties:
                  allow:
                    description: Allow is a list of TokenRules, nodes using this token
                      must match one allow rule to use this token.
                    items:
                      properties:
                        context_id:
                          type: string
                        project_id:
                          type: string
                      type: object
                    nullable: true
                    type: array
                  organization_id:
                    type: string
                type: object
              gcp:
                description: GCP allows the configuration of options specific to the
                  "gcp" join method.
                nullable: true
                properties:
                  allow:
                    description: Allow is a list of Rules, nodes using this token
                      must match one allow rule to use this token.
                    items:
                      properties:
                        locations:
                          items:
                            type: string
                          nullable: true
                          type: array
                        project_ids:
                          items:
                            type: string
                          nullable: true
                          type: array
                        service_accounts:
                          items:
                            type: string
                          nullable: true
                          type: array
                      type: object
                    nullable: true
                    type: array
                type: object
              github:
                description: GitHub allows the configuration of options specific to
                  the "github" join method.
                nullable: true
                properties:
                  allow:
                    description: Allow is a list of TokenRules, nodes using this token
                      must match one allow rule to use this token.
                    items:
                      properties:
                        actor:
                          type: string
                        environment:
                          type: string
                        ref:
                          type: string
                        ref_type:
                          type: string
                        repository:
                          type: string
                        repository_owner:
                          type: string
                        sub:
                          type: string
                        workflow:
                          type: string
                      type: object
                    nullable: true
                    type: array
                  enterprise_server_host:
                    description: EnterpriseServerHost allows joining from runners
                      associated with a GitHub Enterprise Server instance. When unconfigured,
                      tokens will be validated against github.com, but when configured
                      to the host of a GHES instance, then the tokens will be validated
                      against host.  This value should be the hostname of the GHES
                      instance, and should not include the scheme or a path. The instance
                      must be accessible over HTTPS at this hostname and the certificate
                      must be trusted by the Auth Server.
                    type: string
                  enterprise_slug:
                    description: EnterpriseSlug allows the slug of a GitHub Enterprise
                      organisation to be included in the expected issuer of the OIDC
                      tokens. This is for compatibility with the `include_enterprise_slug`
                      option in GHE.  This field should be set to the slug of your
                      enterprise if this is enabled. If this is not enabled, then
                      this field must be left empty. This field cannot be specified
                      if `enterprise_server_host` is specified.  See https://docs.github.com/en/enterprise-cloud@latest/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect#customizing-the-issuer-value-for-an-enterprise
                      for more information about customised issuer values.
                    type: string
                type: object
              gitlab:
                description: GitLab allows the configuration of options specific to
                  the "gitlab" join method.
                nullable: true
                properties:
                  allow:
                    description: Allow is a list of TokenRules, nodes using this token
                      must match one allow rule to use this token.
                    items:
                      properties:
                        ci_config_ref_uri:
                          type: string
                        ci_config_sha:
                          type: string
                        deployment_tier:
                          type: string
                        environment:
                          type: string
                        environment_protected:
                          type: boolean
                        namespace_path:
                          type: string
                        pipeline_source:
                          type: string
                        project_path:
                          type: string
                        project_visibility:
                          type: string
                        ref:
                          type: string
                        ref_protected:
                          type: boolean
                        ref_type:
                          type: string
                        sub:
                          type: string
                        user_email:
                          type: string
                        user_id:
                          type: string
                        user_login:
                          type: string
                      type: object
                    nullable: true
                    type: array
                  domain:
                    description: Domain is the domain of your GitLab instance. This
                      will default to `gitlab.com` - but can be set to the domain
                      of your self-hosted GitLab e.g `gitlab.example.com`.
                    type: string
                type: object
              join_method:
                description: JoinMethod is the joining method required in order to
                  use this token. Supported joining methods include "token", "ec2",
                  and "iam".
                type: string
              kubernetes:
                description: Kubernetes allows the configuration of options specific
                  to the "kubernetes" join method.
                nullable: true
                properties:
                  allow:
                    description: Allow is a list of Rules, nodes using this token
                      must match one allow rule to use this token.
                    items:
                      properties:
                        service_account:
                          type: string
                      type: object
                    nullable: true
                    type: array
                  static_jwks:
                    description: StaticJWKS is the configuration specific to the `static_jwks`
                      type.
                    nullable: true
                    properties:
                      jwks:
                        type: string
                    type: object
                  type:
                    description: 'Type controls which behavior should be used for
                      validating the Kubernetes Service Account token. Support values:
                      - `in_cluster` - `static_jwks` If unset, this defaults to `in_cluster`.'
                    type: string
                type: object
              roles:
                description: Roles is a list of roles associated with the token, that
                  will be converted to metadata in the SSH and X509 certificates issued
                  to the user of the token
                items:
                  type: string
                nullable: true
                type: array
              spacelift:
                description: Spacelift allows the configuration of options specific
                  to the "spacelift" join method.
                nullable: true
                properties:
                  allow:
                    description: Allow is a list of Rules, nodes using this token
                      must match one allow rule to use this token.
                    items:
                      properties:
                        caller_id:
                          type: string
                        caller_type:
                          type: string
                        scope:
                          type: string
                        space_id:
                          type: string
                      type: object
                    nullable: true
                    type: array
                  hostname:
                    description: Hostname is the hostname of the Spacelift tenant
                      that tokens will originate from. E.g `example.app.spacelift.io`
                    type: string
                type: object
              suggested_agent_matcher_labels:
                additionalProperties:
                  x-kubernetes-preserve-unknown-fields: true
                description: SuggestedAgentMatcherLabels is a set of labels to be
                  used by agents to match on resources. When an agent uses this token,
                  the agent should monitor resources that match those labels. For
                  databases, this means adding the labels to `db_service.resources.labels`.
                  Currently, only node-join scripts create a configuration according
                  to the suggestion.
                type: object
              suggested_labels:
                additionalProperties:
                  x-kubernetes-preserve-unknown-fields: true
                description: SuggestedLabels is a set of labels that resources should
                  set when using this token to enroll themselves in the cluster. Currently,
                  only node-join scripts create a configuration according to the suggestion.
                type: object
            type: object
          status:
            description: TeleportProvisionTokenStatus defines the observed state of
              TeleportProvisionToken
            properties:
              conditions:
                description: Conditions represent the latest available observations
                  of an object's state
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              teleportResourceID:
                format: int64
                type: integer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
