k8s-crds-cloud-native-pg 1.30.0

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium -f databaseroles.yml --schema=derived --docs -b --derive=Default --derive=PartialEq --smart-derive-elision
// kopium version: 0.23.0

#[allow(unused_imports)]
mod prelude {
    pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
    pub use kube_derive::CustomResource;
    #[cfg(feature = "schemars")]
    pub use schemars::JsonSchema;
    pub use serde::{Deserialize, Serialize};
    #[cfg(feature = "builder")]
    pub use typed_builder::TypedBuilder;
}

use self::prelude::*;

/// Specification of the desired DatabaseRole.
/// More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status>
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[cfg_attr(feature = "builder", derive(TypedBuilder))]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
#[cfg_attr(not(feature = "schemars"), kube(schema = "disabled"))]
#[kube(
    group = "postgresql.cnpg.io",
    version = "v1",
    kind = "DatabaseRole",
    plural = "databaseroles"
)]
#[kube(namespaced)]
#[kube(status = "DatabaseRoleStatus")]
#[kube(derive = "Default")]
#[kube(derive = "PartialEq")]
pub struct DatabaseRoleSpec {
    /// Whether a role bypasses every row-level security (RLS) policy.
    /// Default is `false`.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub bypassrls: Option<bool>,
    /// ClientCertificate configures the operator to generate and renew a TLS client
    /// certificate for this role, signed by the cluster's client CA. The certificate
    /// is stored in a Secret named `<databaserole-name>-client-cert`.
    /// Requires login to be true.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "clientCertificate"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub client_certificate: Option<DatabaseRoleClientCertificate>,
    /// The corresponding cluster
    pub cluster: DatabaseRoleCluster,
    /// Description of the role
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub comment: Option<String>,
    /// If the role can log in, this specifies how many concurrent
    /// connections the role can make. `-1` (the default) means no limit.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "connectionLimit"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub connection_limit: Option<i64>,
    /// When set to `true`, the role being defined will be allowed to create
    /// new databases. Specifying `false` (default) will deny a role the
    /// ability to create databases.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub createdb: Option<bool>,
    /// Whether the role will be permitted to create, alter, drop, comment
    /// on, change the security label for, and grant or revoke membership in
    /// other roles. Default is `false`.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub createrole: Option<bool>,
    /// The policy for end-of-life maintenance of this role
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "databaseRoleReclaimPolicy"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub database_role_reclaim_policy: Option<DatabaseRoleDatabaseRoleReclaimPolicy>,
    /// DisablePassword indicates that a role's password should be set to NULL in Postgres
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "disablePassword"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub disable_password: Option<bool>,
    /// Ensure the role is `present` or `absent` - defaults to "present"
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub ensure: Option<DatabaseRoleEnsure>,
    /// List of one or more existing roles to which this role will be
    /// immediately added as a new member. Default empty.
    /// Changes to the list are applied to an existing role through
    /// `GRANT` and `REVOKE` statements, not only at role creation.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "inRoles")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub in_roles: Option<Vec<String>>,
    /// Whether a role "inherits" the privileges of roles it is a member of.
    /// Default is `true`.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub inherit: Option<bool>,
    /// Whether the role is allowed to log in. A role having the `login`
    /// attribute can be thought of as a user. Roles without this attribute
    /// are useful for managing database privileges, but are not users in
    /// the usual sense of the word. Default is `false`.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub login: Option<bool>,
    /// Name of the role
    pub name: String,
    /// Secret containing the password of the role (if present).
    /// If null, the password will be ignored unless DisablePassword is set.
    /// When set, the secret must follow the `kubernetes.io/basic-auth` format
    /// and contain both a `username` and a `password` field.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "passwordSecret"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub password_secret: Option<DatabaseRolePasswordSecret>,
    /// Whether a role is a replication role. A role must have this
    /// attribute (or be a superuser) in order to be able to connect to the
    /// server in replication mode (physical or logical replication) and in
    /// order to be able to create or drop replication slots. A role having
    /// the `replication` attribute is a very highly privileged role, and
    /// should only be used on roles actually used for replication. Default
    /// is `false`.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub replication: Option<bool>,
    /// Whether the role is a `superuser` who can override all access
    /// restrictions within the database - superuser status is dangerous and
    /// should be used only when really needed. You must yourself be a
    /// superuser to create a new superuser. Defaults is `false`.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub superuser: Option<bool>,
    /// Date and time after which the role's password is no longer valid.
    /// When omitted, the password will never expire (default).
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "validUntil"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub valid_until: Option<String>,
}

/// ClientCertificate configures the operator to generate and renew a TLS client
/// certificate for this role, signed by the cluster's client CA. The certificate
/// is stored in a Secret named `<databaserole-name>-client-cert`.
/// Requires login to be true.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[cfg_attr(feature = "builder", derive(TypedBuilder))]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
pub struct DatabaseRoleClientCertificate {
    /// Enabled turns on client certificate issuance for this role. When true,
    /// the role must have login enabled. Defaults to true when the block is present.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub enabled: Option<bool>,
}

/// The corresponding cluster
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[cfg_attr(feature = "builder", derive(TypedBuilder))]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
pub struct DatabaseRoleCluster {
    /// Name of the referent.
    /// This field is effectively required, but due to backwards compatibility is
    /// allowed to be empty. Instances of this type with an empty value here are
    /// almost certainly wrong.
    /// More info: <https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub name: Option<String>,
}

/// Specification of the desired DatabaseRole.
/// More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
pub enum DatabaseRoleDatabaseRoleReclaimPolicy {
    #[serde(rename = "delete")]
    Delete,
    #[serde(rename = "retain")]
    Retain,
}

/// Specification of the desired DatabaseRole.
/// More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
pub enum DatabaseRoleEnsure {
    #[serde(rename = "present")]
    Present,
    #[serde(rename = "absent")]
    Absent,
}

/// Secret containing the password of the role (if present).
/// If null, the password will be ignored unless DisablePassword is set.
/// When set, the secret must follow the `kubernetes.io/basic-auth` format
/// and contain both a `username` and a `password` field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[cfg_attr(feature = "builder", derive(TypedBuilder))]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
pub struct DatabaseRolePasswordSecret {
    /// Name of the referent.
    pub name: String,
}

/// Most recently observed status of the DatabaseRole. This data may not be up
/// to date. Populated by the system. Read-only.
/// More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[cfg_attr(feature = "builder", derive(TypedBuilder))]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
pub struct DatabaseRoleStatus {
    /// Applied is true if the role was reconciled correctly
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub applied: Option<bool>,
    /// ClientCertificate holds the observed state of the generated TLS client
    /// certificate, when client certificate issuance is enabled.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "clientCertificate"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub client_certificate: Option<DatabaseRoleStatusClientCertificate>,
    /// Conditions for the DatabaseRole object
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub conditions: Option<Vec<Condition>>,
    /// Message is the reconciliation error message
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub message: Option<String>,
    /// A sequence number representing the latest
    /// desired state that was synchronized
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "observedGeneration"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub observed_generation: Option<i64>,
    /// SecretResourceVersion is the resource version of the password secret
    /// last applied to the role; a change to it triggers reconciliation.
    #[serde(
        default,
        skip_serializing_if = "Option::is_none",
        rename = "secretResourceVersion"
    )]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub secret_resource_version: Option<String>,
}

/// ClientCertificate holds the observed state of the generated TLS client
/// certificate, when client certificate issuance is enabled.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[cfg_attr(feature = "builder", derive(TypedBuilder))]
#[cfg_attr(feature = "schemars", derive(JsonSchema))]
pub struct DatabaseRoleStatusClientCertificate {
    /// Expiration is the expiration time of the generated client certificate, in RFC3339 format.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub expiration: Option<String>,
    /// Message contains a human-readable explanation of the current certificate status,
    /// such as why issuance was skipped or why an existing Secret was left untouched.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    #[cfg_attr(feature = "builder", builder(default, setter(strip_option)))]
    pub message: Option<String>,
}