apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  creationTimestamp: null
  name: teleportoidcconnectors.resources.teleport.dev
spec:
  group: resources.teleport.dev
  names:
    kind: TeleportOIDCConnector
    listKind: TeleportOIDCConnectorList
    plural: teleportoidcconnectors
    shortNames:
    - oidcconnector
    - oidcconnectors
    singular: teleportoidcconnector
  scope: Namespaced
  versions:
  - name: v3
    schema:
      openAPIV3Schema:
        description: OIDCConnector is the Schema for the oidcconnectors API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: OIDCConnector resource definition v3 from Teleport
            properties:
              acr_values:
                description: ACR is an Authentication Context Class Reference value.
                  The meaning of the ACR value is context-specific and varies for
                  identity providers.
                type: string
              allow_unverified_email:
                description: AllowUnverifiedEmail tells the connector to accept OIDC
                  users with unverified emails.
                type: boolean
              claims_to_roles:
                description: ClaimsToRoles specifies a dynamic mapping from claims
                  to roles.
                items:
                  properties:
                    claim:
                      description: Claim is a claim name.
                      type: string
                    roles:
                      description: Roles is a list of static teleport roles to match.
                      items:
                        type: string
                      nullable: true
                      type: array
                    value:
                      description: Value is a claim value to match.
                      type: string
                  type: object
                type: array
              client_id:
                description: ClientID is the id of the authentication client (Teleport
                  Auth server).
                type: string
              client_secret:
                description: ClientSecret is used to authenticate the client.
                type: string
              display:
                description: Display is the friendly name for this provider.
                type: string
              google_admin_email:
                description: GoogleAdminEmail is the email of a google admin to impersonate.
                type: string
              google_service_account:
                description: GoogleServiceAccount is a string containing google service
                  account credentials.
                type: string
              google_service_account_uri:
                description: GoogleServiceAccountURI is a path to a google service
                  account uri.
                type: string
              issuer_url:
                description: IssuerURL is the endpoint of the provider, e.g. https://accounts.google.com.
                type: string
              max_age:
                description: MaxAge is the amount of time that user logins are valid
                  for. If a user logs in, but then does not login again within this
                  time period, they will be forced to re-authenticate.
                format: duration
                type: string
              prompt:
                description: Prompt is an optional OIDC prompt. An empty string omits
                  prompt. If not specified, it defaults to select_account for backwards
                  compatibility.
                type: string
              provider:
                description: Provider is the external identity provider.
                type: string
              redirect_url:
                description: RedirectURLs is a list of callback URLs which the identity
                  provider can use to redirect the client back to the Teleport Proxy
                  to complete authentication. This list should match the URLs on the
                  provider's side. The URL used for a given auth request will be chosen
                  to match the requesting Proxy's public address. If there is no match,
                  the first url in the list will be used.
                items:
                  type: string
                type: array
              scope:
                description: Scope specifies additional scopes set by provider.
                items:
                  type: string
                nullable: true
                type: array
              username_claim:
                description: UsernameClaim specifies the name of the claim from the
                  OIDC connector to be used as the user's username.
                type: string
            type: object
          status:
            description: TeleportOIDCConnectorStatus defines the observed state of
              TeleportOIDCConnector
            properties:
              conditions:
                description: Conditions represent the latest available observations
                  of an object's state
                items:
                  description: "Condition contains details for one aspect of the current
                    state of this API Resource. --- This struct is intended for direct
                    use as an array at the field path .status.conditions.  For example,
                    \n type FooStatus struct{ // Represents the observations of a
                    foo's current state. // Known .status.conditions.type are: \"Available\",
                    \"Progressing\", and \"Degraded\" // +patchMergeKey=type // +patchStrategy=merge
                    // +listType=map // +listMapKey=type Conditions []metav1.Condition
                    `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\"
                    protobuf:\"bytes,1,rep,name=conditions\"` \n // other fields }"
                  properties:
                    lastTransitionTime:
                      description: lastTransitionTime is the last time the condition
                        transitioned from one status to another. This should be when
                        the underlying condition changed.  If that is not known, then
                        using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: message is a human readable message indicating
                        details about the transition. This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: observedGeneration represents the .metadata.generation
                        that the condition was set based upon. For instance, if .metadata.generation
                        is currently 12, but the .status.conditions[x].observedGeneration
                        is 9, the condition is out of date with respect to the current
                        state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: reason contains a programmatic identifier indicating
                        the reason for the condition's last transition. Producers
                        of specific condition types may define expected values and
                        meanings for this field, and whether the values are considered
                        a guaranteed API. The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                        --- Many .condition.type values are consistent across resources
                        like Available, but because arbitrary conditions can be useful
                        (see .node.status.conditions), the ability to deconflict is
                        important. The regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              teleportResourceID:
                format: int64
                type: integer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: null
  storedVersions: null
