// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --docs --derive=Default --derive=PartialEq --smart-derive-elision --filename crd-catalog/gpu-ninja/dex-operator/dex.gpu-ninja.com/v1alpha1/dexidentityproviders.yaml
// kopium version: 0.23.0
#[allow(unused_imports)]
mod prelude {
pub use kube::CustomResource;
pub use serde::{Serialize, Deserialize};
pub use std::collections::BTreeMap;
pub use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
}
use self::prelude::*;
/// DexIdentityProviderSpec defines the desired state of the Dex identity provider.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, PartialEq)]
#[kube(group = "dex.gpu-ninja.com", version = "v1alpha1", kind = "DexIdentityProvider", plural = "dexidentityproviders")]
#[kube(namespaced)]
#[kube(status = "DexIdentityProviderStatus")]
#[kube(schema = "disabled")]
#[kube(derive="PartialEq")]
pub struct DexIdentityProviderSpec {
/// ClientCertificateSecretRef is an optional reference to a secret containing a client certificate that the operator can use for connecting to the Dex API gRPC server.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCertificateSecretRef")]
pub client_certificate_secret_ref: Option<DexIdentityProviderClientCertificateSecretRef>,
/// Connectors holds configuration for connectors.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub connectors: Option<Vec<DexIdentityProviderConnectors>>,
/// Expiry holds configuration for tokens, signing keys, etc.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub expiry: Option<DexIdentityProviderExpiry>,
/// Frontend holds the web server's frontend templates and asset configuration.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub frontend: Option<DexIdentityProviderFrontend>,
/// GRPC holds configuration for the Dex API gRPC server.
pub grpc: DexIdentityProviderGrpc,
/// Image is the Dex image to use.
pub image: String,
/// Ingress is the optional ingress configuration for the Dex identity provider.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub ingress: Option<DexIdentityProviderIngress>,
/// Issuer is the base path of Dex and the external name of the OpenID Connect service. This is the canonical URL that all clients MUST use to refer to Dex.
pub issuer: String,
/// Logger holds configuration required to customize logging for dex.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub logger: Option<DexIdentityProviderLogger>,
/// Metrics holds configuration for metrics.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub metrics: Option<DexIdentityProviderMetrics>,
/// OAuth2 holds configuration for OAuth2.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub oauth2: Option<DexIdentityProviderOauth2>,
/// Replicas is the optional number of replicas of the Dex identity provider pod to run. Only supported if using postgresql storage.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub replicas: Option<i32>,
/// Resources allows specifying the resource requirements for the Dex identity provider container.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub resources: Option<DexIdentityProviderResources>,
/// Storage configures the storage for Dex.
pub storage: DexIdentityProviderStorage,
/// VolumeClaimTemplates are volume claim templates for the Dex identity provider pod.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeClaimTemplates")]
pub volume_claim_templates: Option<Vec<DexIdentityProviderVolumeClaimTemplates>>,
/// VolumeMounts are volume mounts for the Dex identity provider container.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeMounts")]
pub volume_mounts: Option<Vec<DexIdentityProviderVolumeMounts>>,
/// Web holds configuration for the web server.
pub web: DexIdentityProviderWeb,
}
/// ClientCertificateSecretRef is an optional reference to a secret containing a client certificate that the operator can use for connecting to the Dex API gRPC server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderClientCertificateSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// DexIdentityProviderConnectorSpec holds configuration for a connector.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct DexIdentityProviderConnectors {
/// ID is the connector ID.
pub id: String,
/// LDAP holds configuration for the LDAP connector.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub ldap: Option<DexIdentityProviderConnectorsLdap>,
/// Name is the connector name.
pub name: String,
/// OIDC holds configuration for the OIDC connector.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub oidc: Option<DexIdentityProviderConnectorsOidc>,
/// Type is the connector type to use.
#[serde(rename = "type")]
pub r#type: DexIdentityProviderConnectorsType,
}
/// LDAP holds configuration for the LDAP connector.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsLdap {
/// BindPasswordSecretRef is a reference to a secret containing the bind password. The connector uses these credentials to search for users and groups.
#[serde(rename = "bindPasswordSecretRef")]
pub bind_password_secret_ref: DexIdentityProviderConnectorsLdapBindPasswordSecretRef,
/// BindUsername is the DN of the user to bind with. The connector uses these credentials to search for users and groups.
#[serde(rename = "bindUsername")]
pub bind_username: String,
/// CASecretRef is an optional reference to a secret containing the CA certificate.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "caSecretRef")]
pub ca_secret_ref: Option<DexIdentityProviderConnectorsLdapCaSecretRef>,
/// ClientCertificateSecretRef is an optional reference to a secret containing the client certificate and key.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCertificateSecretRef")]
pub client_certificate_secret_ref: Option<DexIdentityProviderConnectorsLdapClientCertificateSecretRef>,
/// GroupSearch contains configuration for searching LDAP groups.
#[serde(rename = "groupSearch")]
pub group_search: DexIdentityProviderConnectorsLdapGroupSearch,
/// Host is the host and optional port of the LDAP server. If port isn't supplied, it will be guessed based on the TLS configuration.
pub host: String,
/// InsecureNoSSL is required to connect to a server without TLS.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "insecureNoSSL")]
pub insecure_no_ssl: Option<bool>,
/// InsecureSkipVerify allows connecting to a server without verifying the TLS certificate.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "insecureSkipVerify")]
pub insecure_skip_verify: Option<bool>,
/// StartTLS allows connecting to a server that supports the StartTLS command. If unsupplied secure connections will use the LDAPS protocol.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "startTLS")]
pub start_tls: Option<bool>,
/// UserSearch contains configuration for searching LDAP users.
#[serde(rename = "userSearch")]
pub user_search: DexIdentityProviderConnectorsLdapUserSearch,
/// UsernamePrompt allows users to override the username attribute (displayed in the username/password prompt). If unset, the handler will use "Username".
#[serde(default, skip_serializing_if = "Option::is_none", rename = "usernamePrompt")]
pub username_prompt: Option<String>,
}
/// BindPasswordSecretRef is a reference to a secret containing the bind password. The connector uses these credentials to search for users and groups.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsLdapBindPasswordSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// CASecretRef is an optional reference to a secret containing the CA certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsLdapCaSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// ClientCertificateSecretRef is an optional reference to a secret containing the client certificate and key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsLdapClientCertificateSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// GroupSearch contains configuration for searching LDAP groups.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsLdapGroupSearch {
/// BaseDN to start the search from. For example "cn=groups,dc=example,dc=com"
#[serde(rename = "baseDN")]
pub base_dn: String,
/// Filter is an optional filter to apply when searching the directory. For example "(objectClass=posixGroup)"
#[serde(default, skip_serializing_if = "Option::is_none")]
pub filter: Option<String>,
/// NameAttr is the attribute of the group that represents its name.
#[serde(rename = "nameAttr")]
pub name_attr: String,
/// Scope is the optional scope of the search (default "sub"). Can either be: * "sub" - search the whole sub tree * "one" - only search one level
#[serde(default, skip_serializing_if = "Option::is_none")]
pub scope: Option<DexIdentityProviderConnectorsLdapGroupSearchScope>,
/// UserMatchers is an array of the field pairs used to match a user to a group. See the "DexIdentityProviderConnectorLDAPGroupSearchUserMatcher" struct for the exact field names
/// Each pair adds an additional requirement to the filter that an attribute in the group match the user's attribute value. For example that the "members" attribute of a group matches the "uid" of the user. The exact filter being added is:
/// (userMatchers[n].<groupAttr>=userMatchers[n].<userAttr value>)
#[serde(rename = "userMatchers")]
pub user_matchers: Vec<DexIdentityProviderConnectorsLdapGroupSearchUserMatchers>,
}
/// GroupSearch contains configuration for searching LDAP groups.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum DexIdentityProviderConnectorsLdapGroupSearchScope {
#[serde(rename = "sub")]
Sub,
#[serde(rename = "one")]
One,
}
/// DexIdentityProviderConnectorLDAPGroupSearchUserMatcher holds information about user and group matching.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsLdapGroupSearchUserMatchers {
/// GroupAttr is the attribute to match against the group ID.
#[serde(rename = "groupAttr")]
pub group_attr: String,
/// UserAttr is the attribute to match against the user ID.
#[serde(rename = "userAttr")]
pub user_attr: String,
}
/// UserSearch contains configuration for searching LDAP users.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsLdapUserSearch {
/// BaseDN to start the search from. For example "cn=users,dc=example,dc=com"
#[serde(rename = "baseDN")]
pub base_dn: String,
/// EmailAttr is the attribute to use as the user email (default "mail").
#[serde(default, skip_serializing_if = "Option::is_none", rename = "emailAttr")]
pub email_attr: Option<String>,
/// EmailSuffix if set, will be appended to the idAttr to construct the email claim. This should not include the @ character.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "emailSuffix")]
pub email_suffix: Option<String>,
/// Filter is an optional filter to apply when searching the directory. For example "(objectClass=person)"
#[serde(default, skip_serializing_if = "Option::is_none")]
pub filter: Option<String>,
/// IDAttr is the attribute to use as the user ID (default "uid").
#[serde(default, skip_serializing_if = "Option::is_none", rename = "idAttr")]
pub id_attr: Option<String>,
/// NameAttr is the attribute to use as the display name for the user.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "nameAttr")]
pub name_attr: Option<String>,
/// PreferredUsernameAttr is the attribute to use as the preferred username for the user.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "preferredUsernameAttr")]
pub preferred_username_attr: Option<String>,
/// Scope is the optional scope of the search (default "sub"). Can either be: * "sub" - search the whole sub tree * "one" - only search one level
#[serde(default, skip_serializing_if = "Option::is_none")]
pub scope: Option<DexIdentityProviderConnectorsLdapUserSearchScope>,
/// Username is the attribute to match against the inputted username. This will be translated and combined with the other filter as "(<attr>=<username>)".
pub username: String,
}
/// UserSearch contains configuration for searching LDAP users.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum DexIdentityProviderConnectorsLdapUserSearchScope {
#[serde(rename = "sub")]
Sub,
#[serde(rename = "one")]
One,
}
/// OIDC holds configuration for the OIDC connector.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsOidc {
/// AcrValues (Authentication Context Class Reference Values) that specifies the Authentication Context Class Values within the Authentication Request that the Authorization Server is being requested to use for processing requests from this Client, with the values appearing in order of preference.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "acrValues")]
pub acr_values: Option<Vec<String>>,
/// BasicAuthUnsupported causes client_secret to be passed as POST parameters instead of basic auth. This is specifically "NOT RECOMMENDED" by the OAuth2 RFC, but some providers require it.
/// <https://tools.ietf.org/html/rfc6749#section-2.3.1>
#[serde(default, skip_serializing_if = "Option::is_none", rename = "basicAuthUnsupported")]
pub basic_auth_unsupported: Option<bool>,
/// CASecretRef is an optional reference to a secret containing the CA certificate. Only required if your provider uses a self-signed certificate.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "caSecretRef")]
pub ca_secret_ref: Option<DexIdentityProviderConnectorsOidcCaSecretRef>,
/// ClaimMapping is used to map non-standard claims to standard claims. Some providers return non-standard claims (eg. mail). <https://openid.net/specs/openid-connect-core-1_0.html#Claims>
#[serde(default, skip_serializing_if = "Option::is_none", rename = "claimMapping")]
pub claim_mapping: Option<DexIdentityProviderConnectorsOidcClaimMapping>,
/// ClientSecretRef is a reference to a secret containing the OAuth client id and secret.
#[serde(rename = "clientSecretRef")]
pub client_secret_ref: DexIdentityProviderConnectorsOidcClientSecretRef,
/// GetUserInfo uses the userinfo endpoint to get additional claims for the token. This is especially useful where upstreams return "thin" id tokens
#[serde(default, skip_serializing_if = "Option::is_none", rename = "getUserInfo")]
pub get_user_info: Option<bool>,
/// InsecureEnableGroups enables groups claims.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "insecureEnableGroups")]
pub insecure_enable_groups: Option<bool>,
/// InsecureSkipEmailVerified if set will override the value of email_verified to true in the returned claims.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "insecureSkipEmailVerified")]
pub insecure_skip_email_verified: Option<bool>,
/// InsecureSkipVerify disables TLS certificate verification.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "insecureSkipVerify")]
pub insecure_skip_verify: Option<bool>,
/// Issuer is the URL of the OIDC issuer.
pub issuer: String,
/// OverrideClaimMapping will be used to override the options defined in claimMappings. i.e. if there are 'email' and `preferred_email` claims available, by default Dex will always use the `email` claim independent of the ClaimMapping.EmailKey. This setting allows you to override the default behavior of Dex and enforce the mappings defined in `claimMapping`. Defaults to false.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "overrideClaimMapping")]
pub override_claim_mapping: Option<bool>,
/// PromptType will be used fot the prompt parameter (when offline_access, by default prompt=consent).
#[serde(default, skip_serializing_if = "Option::is_none", rename = "promptType")]
pub prompt_type: Option<String>,
/// RedirectURI is the OAuth redirect URI.
#[serde(rename = "redirectURI")]
pub redirect_uri: String,
/// Scopes is an optional list of scopes to request. If omitted, defaults to "profile" and "email".
#[serde(default, skip_serializing_if = "Option::is_none")]
pub scopes: Option<Vec<String>>,
/// UserIDKey is the claim key to use for the user ID (default sub).
#[serde(default, skip_serializing_if = "Option::is_none", rename = "userIDKey")]
pub user_id_key: Option<String>,
/// UserNameKey is the claim key to use for the username (default name).
#[serde(default, skip_serializing_if = "Option::is_none", rename = "userNameKey")]
pub user_name_key: Option<String>,
}
/// CASecretRef is an optional reference to a secret containing the CA certificate. Only required if your provider uses a self-signed certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsOidcCaSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// ClaimMapping is used to map non-standard claims to standard claims. Some providers return non-standard claims (eg. mail). <https://openid.net/specs/openid-connect-core-1_0.html#Claims>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsOidcClaimMapping {
/// EmailKey is the key which contains the email claims, defaults to "email".
#[serde(default, skip_serializing_if = "Option::is_none")]
pub email: Option<String>,
/// GroupsKey is the key which contains the groups claims, defaults to "groups".
#[serde(default, skip_serializing_if = "Option::is_none")]
pub groups: Option<String>,
/// PreferredUsernameKey is the key which contains the preferred username claims, defaults to "preferred_username".
#[serde(default, skip_serializing_if = "Option::is_none")]
pub preferred_username: Option<String>,
}
/// ClientSecretRef is a reference to a secret containing the OAuth client id and secret.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderConnectorsOidcClientSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// DexIdentityProviderConnectorSpec holds configuration for a connector.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum DexIdentityProviderConnectorsType {
#[serde(rename = "ldap")]
Ldap,
#[serde(rename = "oidc")]
Oidc,
}
/// Expiry holds configuration for tokens, signing keys, etc.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderExpiry {
/// AuthRequests defines the duration of time for which the AuthRequests will be valid.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "authRequests")]
pub auth_requests: Option<String>,
/// DeviceRequests defines the duration of time for which the DeviceRequests will be valid.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "deviceRequests")]
pub device_requests: Option<String>,
/// IDTokens defines the duration of time for which the IdTokens will be valid.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "idTokens")]
pub id_tokens: Option<String>,
/// RefreshTokens defines refresh tokens expiry policy.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "refreshTokens")]
pub refresh_tokens: Option<DexIdentityProviderExpiryRefreshTokens>,
/// SigningKeys defines the duration of time after which the SigningKeys will be rotated.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "signingKeys")]
pub signing_keys: Option<String>,
}
/// RefreshTokens defines refresh tokens expiry policy.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderExpiryRefreshTokens {
/// AbsoluteLifetime defines the duration of time after which a refresh token will expire.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "absoluteLifetime")]
pub absolute_lifetime: Option<String>,
/// DisableRotation disables refresh token rotation.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "disableRotation")]
pub disable_rotation: Option<bool>,
/// ReuseInterval defines the duration of time after which a refresh token can be reused.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "reuseInterval")]
pub reuse_interval: Option<String>,
/// ValidIfNotUsedFor defines the duration of time after which a refresh token will expire if not used.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "validIfNotUsedFor")]
pub valid_if_not_used_for: Option<String>,
}
/// Frontend holds the web server's frontend templates and asset configuration.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderFrontend {
/// Dir is a file path to static web assets.
/// It is expected to contain the following directories: * static - Static static served at "( issuer URL )/static". * templates - HTML templates controlled by dex. * themes/(theme) - Static static served at "( issuer URL )/theme".
#[serde(default, skip_serializing_if = "Option::is_none")]
pub dir: Option<String>,
/// Issuer is the name of the issuer, used in the HTML templates. Defaults to "dex".
#[serde(default, skip_serializing_if = "Option::is_none")]
pub issuer: Option<String>,
/// LogoURL is the URL of the logo to use in the HTML templates. Defaults to "( issuer URL )/theme/logo.png"
#[serde(default, skip_serializing_if = "Option::is_none", rename = "logoURL")]
pub logo_url: Option<String>,
/// Theme is the name of the theme to use. Defaults to "light".
#[serde(default, skip_serializing_if = "Option::is_none")]
pub theme: Option<String>,
}
/// GRPC holds configuration for the Dex API gRPC server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderGrpc {
/// Annotations is an optional map of additional annotations to add to the Dex API gRPC service.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub annotations: Option<BTreeMap<String, String>>,
/// CertificateSecretRef is an optional reference to a secret containing the TLS certificate and key to use for the Dex API gRPC server.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "certificateSecretRef")]
pub certificate_secret_ref: Option<DexIdentityProviderGrpcCertificateSecretRef>,
/// ClientCASecretRef is an optional reference to a secret containing the client CA.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCASecretRef")]
pub client_ca_secret_ref: Option<DexIdentityProviderGrpcClientCaSecretRef>,
/// Reflection enables gRPC server reflection.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub reflection: Option<bool>,
}
/// CertificateSecretRef is an optional reference to a secret containing the TLS certificate and key to use for the Dex API gRPC server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderGrpcCertificateSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// ClientCASecretRef is an optional reference to a secret containing the client CA.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderGrpcClientCaSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// Ingress is the optional ingress configuration for the Dex identity provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderIngress {
/// Annotations is an optional map of additional annotations to add to the ingress.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub annotations: Option<BTreeMap<String, String>>,
/// Enabled enables ingress for the Dex identity provider.
pub enabled: bool,
/// Hosts is a list of hosts and paths to route traffic to the Dex identity provider.
pub hosts: Vec<DexIdentityProviderIngressHosts>,
/// IngressClassName is the optional ingress class to use for the Dex identity provider.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "ingressClassName")]
pub ingress_class_name: Option<String>,
/// TLS is an optional list of TLS configurations for the ingress.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub tls: Option<Vec<DexIdentityProviderIngressTls>>,
}
/// DexIdentityProviderIngressHostSpec is the ingress host configuration for a Dex identity provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderIngressHosts {
/// Host is the host to route traffic to the Dex identity provider.
pub host: String,
/// Paths is a list of paths to route traffic to the Dex identity provider.
pub paths: Vec<DexIdentityProviderIngressHostsPaths>,
}
/// DexIdentityProviderIngressPathSpec is the ingress path configuration for a Dex identity provider.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct DexIdentityProviderIngressHostsPaths {
/// Path is matched against the path of an incoming request.
pub path: String,
/// PathType determines the interpretation of the Path matching.
#[serde(rename = "pathType")]
pub path_type: DexIdentityProviderIngressHostsPathsPathType,
}
/// DexIdentityProviderIngressPathSpec is the ingress path configuration for a Dex identity provider.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum DexIdentityProviderIngressHostsPathsPathType {
Exact,
Prefix,
ImplementationSpecific,
}
/// IngressTLS describes the transport layer security associated with an ingress.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderIngressTls {
/// hosts is a list of hosts included in the TLS certificate. The values in this list must match the name/s used in the tlsSecret. Defaults to the wildcard host setting for the loadbalancer controller fulfilling this Ingress, if left unspecified.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub hosts: Option<Vec<String>>,
/// secretName is the name of the secret used to terminate TLS traffic on port 443. Field is left optional to allow TLS routing based on SNI hostname alone. If the SNI host in a listener conflicts with the "Host" header field used by an IngressRule, the SNI host is used for termination and value of the "Host" header is used for routing.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "secretName")]
pub secret_name: Option<String>,
}
/// Logger holds configuration required to customize logging for dex.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderLogger {
/// Format specifies the format to be used for logging.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub format: Option<String>,
/// Level sets logging level severity.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub level: Option<String>,
}
/// Metrics holds configuration for metrics.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderMetrics {
/// Enabled enables Prometheus metric scraping.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub enabled: Option<bool>,
/// Interval at which metrics should be scraped If not specified Prometheus' global scrape interval is used.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub interval: Option<String>,
}
/// OAuth2 holds configuration for OAuth2.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderOauth2 {
/// AlwaysShowLoginScreen, if specified, show the connector selection screen even if there's only one.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "alwaysShowLoginScreen")]
pub always_show_login_screen: Option<bool>,
/// GrantTypes is a list of allowed grant types, defaults to all supported types.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "grantTypes")]
pub grant_types: Option<Vec<String>>,
/// PasswordConnector is a specific connector to user for password grants.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "passwordConnector")]
pub password_connector: Option<String>,
/// ResponseTypes is a list of allowed response types, defaults to all supported types.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "responseTypes")]
pub response_types: Option<Vec<String>>,
/// SkipApprovalScreen, if specified, do not prompt the user to approve client authorization. The act of logging in implies authorization.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "skipApprovalScreen")]
pub skip_approval_screen: Option<bool>,
}
/// Resources allows specifying the resource requirements for the Dex identity provider container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderResources {
/// Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
/// This is an alpha field and requires enabling the DynamicResourceAllocation feature gate.
/// This field is immutable. It can only be set for containers.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub claims: Option<Vec<DexIdentityProviderResourcesClaims>>,
/// Limits describes the maximum amount of compute resources allowed. More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub limits: Option<BTreeMap<String, IntOrString>>,
/// Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub requests: Option<BTreeMap<String, IntOrString>>,
}
/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderResourcesClaims {
/// Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
pub name: String,
}
/// Storage configures the storage for Dex.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct DexIdentityProviderStorage {
/// Postgres holds the configuration for the postgres storage type.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub postgres: Option<DexIdentityProviderStoragePostgres>,
/// Sqlite3 holds the configuration for the sqlite3 storage type.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub sqlite3: Option<DexIdentityProviderStorageSqlite3>,
/// Type is the storage type to use.
#[serde(rename = "type")]
pub r#type: DexIdentityProviderStorageType,
}
/// Postgres holds the configuration for the postgres storage type.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStoragePostgres {
/// ConnMaxLifetime is the maximum amount of time a connection may be reused (default forever).
#[serde(default, skip_serializing_if = "Option::is_none", rename = "connMaxLifetime")]
pub conn_max_lifetime: Option<String>,
/// ConnectionTimeout is the maximum amount of time to wait for a connection to become available.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "connectionTimeout")]
pub connection_timeout: Option<String>,
/// CredentialsSecretRef is a reference to a secret containing the username and password to use for authentication.
#[serde(rename = "credentialsSecretRef")]
pub credentials_secret_ref: DexIdentityProviderStoragePostgresCredentialsSecretRef,
/// Database is the name of the database to connect to.
pub database: String,
/// Host is the host to connect to.
pub host: String,
/// MaxIdleConns is the maximum number of connections in the idle connection pool (default 5).
#[serde(default, skip_serializing_if = "Option::is_none", rename = "maxIdleConns")]
pub max_idle_conns: Option<i64>,
/// MaxOpenConns is the maximum number of open connections to the database (default 5).
#[serde(default, skip_serializing_if = "Option::is_none", rename = "maxOpenConns")]
pub max_open_conns: Option<i64>,
/// Port is the port to connect to.
pub port: i64,
/// SSL holds optional TLS configuration for postgres.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub ssl: Option<DexIdentityProviderStoragePostgresSsl>,
}
/// CredentialsSecretRef is a reference to a secret containing the username and password to use for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStoragePostgresCredentialsSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// SSL holds optional TLS configuration for postgres.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStoragePostgresSsl {
/// CASecretRef is an optional reference to a secret containing the CA certificate.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "caSecretRef")]
pub ca_secret_ref: Option<DexIdentityProviderStoragePostgresSslCaSecretRef>,
/// ClientCertificateSecretRef is an optional reference to a secret containing the client certificate and key.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCertificateSecretRef")]
pub client_certificate_secret_ref: Option<DexIdentityProviderStoragePostgresSslClientCertificateSecretRef>,
/// Mode is the SSL mode to use.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub mode: Option<String>,
/// ServerName ensures that the certificate matches the given hostname the client is connecting to.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "serverName")]
pub server_name: Option<String>,
}
/// CASecretRef is an optional reference to a secret containing the CA certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStoragePostgresSslCaSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// ClientCertificateSecretRef is an optional reference to a secret containing the client certificate and key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStoragePostgresSslClientCertificateSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// Sqlite3 holds the configuration for the sqlite3 storage type.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStorageSqlite3 {
/// File is the path to the sqlite3 database file.
pub file: String,
}
/// Storage configures the storage for Dex.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum DexIdentityProviderStorageType {
#[serde(rename = "memory")]
Memory,
#[serde(rename = "sqlite3")]
Sqlite3,
#[serde(rename = "postgres")]
Postgres,
}
/// PersistentVolumeClaim is a user's request for and claim to a persistent volume
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplates {
/// APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources>
#[serde(default, skip_serializing_if = "Option::is_none", rename = "apiVersion")]
pub api_version: Option<String>,
/// Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub kind: Option<String>,
/// Standard object's metadata. More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub metadata: Option<DexIdentityProviderVolumeClaimTemplatesMetadata>,
/// spec defines the desired characteristics of a volume requested by a pod author. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub spec: Option<DexIdentityProviderVolumeClaimTemplatesSpec>,
/// status represents the current information/status of a persistent volume claim. Read-only. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub status: Option<DexIdentityProviderVolumeClaimTemplatesStatus>,
}
/// Standard object's metadata. More info: <https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesMetadata {
#[serde(default, skip_serializing_if = "Option::is_none")]
pub annotations: Option<BTreeMap<String, String>>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub finalizers: Option<Vec<String>>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub labels: Option<BTreeMap<String, String>>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub name: Option<String>,
#[serde(default, skip_serializing_if = "Option::is_none")]
pub namespace: Option<String>,
}
/// spec defines the desired characteristics of a volume requested by a pod author. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesSpec {
/// accessModes contains the desired access modes the volume should have. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1>
#[serde(default, skip_serializing_if = "Option::is_none", rename = "accessModes")]
pub access_modes: Option<Vec<String>>,
/// dataSource field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSource")]
pub data_source: Option<DexIdentityProviderVolumeClaimTemplatesSpecDataSource>,
/// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the dataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, when namespace isn't specified in dataSourceRef, both fields (dataSource and dataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. When namespace is specified in dataSourceRef, dataSource isn't set to the same value and must be empty. There are three important differences between dataSource and dataSourceRef: * While dataSource only allows two specific types of objects, dataSourceRef allows any non-core object, as well as PersistentVolumeClaim objects. * While dataSource ignores disallowed values (dropping them), dataSourceRef preserves all values, and generates an error if a disallowed value is specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "dataSourceRef")]
pub data_source_ref: Option<DexIdentityProviderVolumeClaimTemplatesSpecDataSourceRef>,
/// resources represents the minimum resources the volume should have. If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub resources: Option<DexIdentityProviderVolumeClaimTemplatesSpecResources>,
/// selector is a label query over volumes to consider for binding.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub selector: Option<DexIdentityProviderVolumeClaimTemplatesSpecSelector>,
/// storageClassName is the name of the StorageClass required by the claim. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#class-1>
#[serde(default, skip_serializing_if = "Option::is_none", rename = "storageClassName")]
pub storage_class_name: Option<String>,
/// volumeMode defines what type of volume is required by the claim. Value of Filesystem is implied when not included in claim spec.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeMode")]
pub volume_mode: Option<String>,
/// volumeName is the binding reference to the PersistentVolume backing this claim.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "volumeName")]
pub volume_name: Option<String>,
}
/// dataSource field can be used to specify either: * An existing VolumeSnapshot object (snapshot.storage.k8s.io/VolumeSnapshot) * An existing PVC (PersistentVolumeClaim) If the provisioner or an external controller can support the specified data source, it will create a new volume based on the contents of the specified data source. When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified. If the namespace is specified, then dataSourceRef will not be copied to dataSource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesSpecDataSource {
/// APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
pub api_group: Option<String>,
/// Kind is the type of resource being referenced
pub kind: String,
/// Name is the name of resource being referenced
pub name: String,
}
/// dataSourceRef specifies the object from which to populate the volume with data, if a non-empty volume is desired. This may be any object from a non-empty API group (non core object) or a PersistentVolumeClaim object. When this field is specified, volume binding will only succeed if the type of the specified object matches some installed volume populator or dynamic provisioner. This field will replace the functionality of the dataSource field and as such if both fields are non-empty, they must have the same value. For backwards compatibility, when namespace isn't specified in dataSourceRef, both fields (dataSource and dataSourceRef) will be set to the same value automatically if one of them is empty and the other is non-empty. When namespace is specified in dataSourceRef, dataSource isn't set to the same value and must be empty. There are three important differences between dataSource and dataSourceRef: * While dataSource only allows two specific types of objects, dataSourceRef allows any non-core object, as well as PersistentVolumeClaim objects. * While dataSource ignores disallowed values (dropping them), dataSourceRef preserves all values, and generates an error if a disallowed value is specified. * While dataSource only allows local objects, dataSourceRef allows objects in any namespaces. (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled. (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesSpecDataSourceRef {
/// APIGroup is the group for the resource being referenced. If APIGroup is not specified, the specified Kind must be in the core API group. For any other third-party types, APIGroup is required.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "apiGroup")]
pub api_group: Option<String>,
/// Kind is the type of resource being referenced
pub kind: String,
/// Name is the name of resource being referenced
pub name: String,
/// Namespace is the namespace of resource being referenced Note that when a namespace is specified, a gateway.networking.k8s.io/ReferenceGrant object is required in the referent namespace to allow that namespace's owner to accept the reference. See the ReferenceGrant documentation for details. (Alpha) This field requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub namespace: Option<String>,
}
/// resources represents the minimum resources the volume should have. If RecoverVolumeExpansionFailure feature is enabled users are allowed to specify resource requirements that are lower than previous value but must still be higher than capacity recorded in the status field of the claim. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#resources>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesSpecResources {
/// Claims lists the names of resources, defined in spec.resourceClaims, that are used by this container.
/// This is an alpha field and requires enabling the DynamicResourceAllocation feature gate.
/// This field is immutable. It can only be set for containers.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub claims: Option<Vec<DexIdentityProviderVolumeClaimTemplatesSpecResourcesClaims>>,
/// Limits describes the maximum amount of compute resources allowed. More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub limits: Option<BTreeMap<String, IntOrString>>,
/// Requests describes the minimum amount of compute resources required. If Requests is omitted for a container, it defaults to Limits if that is explicitly specified, otherwise to an implementation-defined value. Requests cannot exceed Limits. More info: <https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/>
#[serde(default, skip_serializing_if = "Option::is_none")]
pub requests: Option<BTreeMap<String, IntOrString>>,
}
/// ResourceClaim references one entry in PodSpec.ResourceClaims.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesSpecResourcesClaims {
/// Name must match the name of one entry in pod.spec.resourceClaims of the Pod where this field is used. It makes that resource available inside a container.
pub name: String,
}
/// selector is a label query over volumes to consider for binding.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesSpecSelector {
/// matchExpressions is a list of label selector requirements. The requirements are ANDed.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
pub match_expressions: Option<Vec<DexIdentityProviderVolumeClaimTemplatesSpecSelectorMatchExpressions>>,
/// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
pub match_labels: Option<BTreeMap<String, String>>,
}
/// A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesSpecSelectorMatchExpressions {
/// key is the label key that the selector applies to.
pub key: String,
/// operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
pub operator: String,
/// values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub values: Option<Vec<String>>,
}
/// status represents the current information/status of a persistent volume claim. Read-only. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeClaimTemplatesStatus {
/// accessModes contains the actual access modes the volume backing the PVC has. More info: <https://kubernetes.io/docs/concepts/storage/persistent-volumes#access-modes-1>
#[serde(default, skip_serializing_if = "Option::is_none", rename = "accessModes")]
pub access_modes: Option<Vec<String>>,
/// allocatedResourceStatuses stores status of resource being resized for the given PVC. Key names follow standard Kubernetes label syntax. Valid values are either: * Un-prefixed keys: - storage - the capacity of the volume. * Custom resources must use implementation-defined prefixed names such as "example.com/my-custom-resource" Apart from above values - keys that are unprefixed or have kubernetes.io prefix are considered reserved and hence may not be used.
/// ClaimResourceStatus can be in any of following states: - ControllerResizeInProgress: State set when resize controller starts resizing the volume in control-plane. - ControllerResizeFailed: State set when resize has failed in resize controller with a terminal error. - NodeResizePending: State set when resize controller has finished resizing the volume but further resizing of volume is needed on the node. - NodeResizeInProgress: State set when kubelet starts resizing the volume. - NodeResizeFailed: State set when resizing has failed in kubelet with a terminal error. Transient errors don't set NodeResizeFailed. For example: if expanding a PVC for more capacity - this field can be one of the following states: - pvc.status.allocatedResourceStatus['storage'] = "ControllerResizeInProgress" - pvc.status.allocatedResourceStatus['storage'] = "ControllerResizeFailed" - pvc.status.allocatedResourceStatus['storage'] = "NodeResizePending" - pvc.status.allocatedResourceStatus['storage'] = "NodeResizeInProgress" - pvc.status.allocatedResourceStatus['storage'] = "NodeResizeFailed" When this field is not set, it means that no resize operation is in progress for the given PVC.
/// A controller that receives PVC update with previously unknown resourceName or ClaimResourceStatus should ignore the update for the purpose it was designed. For example - a controller that only is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid resources associated with PVC.
/// This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "allocatedResourceStatuses")]
pub allocated_resource_statuses: Option<BTreeMap<String, String>>,
/// allocatedResources tracks the resources allocated to a PVC including its capacity. Key names follow standard Kubernetes label syntax. Valid values are either: * Un-prefixed keys: - storage - the capacity of the volume. * Custom resources must use implementation-defined prefixed names such as "example.com/my-custom-resource" Apart from above values - keys that are unprefixed or have kubernetes.io prefix are considered reserved and hence may not be used.
/// Capacity reported here may be larger than the actual capacity when a volume expansion operation is requested. For storage quota, the larger value from allocatedResources and PVC.spec.resources is used. If allocatedResources is not set, PVC.spec.resources alone is used for quota calculation. If a volume expansion capacity request is lowered, allocatedResources is only lowered if there are no expansion operations in progress and if the actual volume capacity is equal or lower than the requested capacity.
/// A controller that receives PVC update with previously unknown resourceName should ignore the update for the purpose it was designed. For example - a controller that only is responsible for resizing capacity of the volume, should ignore PVC updates that change other valid resources associated with PVC.
/// This is an alpha field and requires enabling RecoverVolumeExpansionFailure feature.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "allocatedResources")]
pub allocated_resources: Option<BTreeMap<String, IntOrString>>,
/// capacity represents the actual resources of the underlying volume.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub capacity: Option<BTreeMap<String, IntOrString>>,
/// conditions is the current Condition of persistent volume claim. If underlying persistent volume is being resized then the Condition will be set to 'ResizeStarted'.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub conditions: Option<Vec<Condition>>,
/// phase represents the current phase of PersistentVolumeClaim.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub phase: Option<String>,
}
/// VolumeMount describes a mounting of a Volume within a container.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderVolumeMounts {
/// Path within the container at which the volume should be mounted. Must not contain ':'.
#[serde(rename = "mountPath")]
pub mount_path: String,
/// mountPropagation determines how mounts are propagated from the host to container and the other way around. When not set, MountPropagationNone is used. This field is beta in 1.10.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "mountPropagation")]
pub mount_propagation: Option<String>,
/// This must match the Name of a Volume.
pub name: String,
/// Mounted read-only if true, read-write otherwise (false or unspecified). Defaults to false.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "readOnly")]
pub read_only: Option<bool>,
/// Path within the volume from which the container's volume should be mounted. Defaults to "" (volume's root).
#[serde(default, skip_serializing_if = "Option::is_none", rename = "subPath")]
pub sub_path: Option<String>,
/// Expanded path within the volume from which the container's volume should be mounted. Behaves similarly to SubPath but environment variable references $(VAR_NAME) are expanded using the container's environment. Defaults to "" (volume's root). SubPathExpr and SubPath are mutually exclusive.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "subPathExpr")]
pub sub_path_expr: Option<String>,
}
/// Web holds configuration for the web server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderWeb {
/// AllowedOrigins is a list of allowed origins for CORS requests.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "allowedOrigins")]
pub allowed_origins: Option<Vec<String>>,
/// Annotations is an optional map of additional annotations to add to the web service.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub annotations: Option<BTreeMap<String, String>>,
/// CertificateSecretRef is an optional reference to a secret containing the TLS certificate and key to use for HTTPS.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "certificateSecretRef")]
pub certificate_secret_ref: Option<DexIdentityProviderWebCertificateSecretRef>,
}
/// CertificateSecretRef is an optional reference to a secret containing the TLS certificate and key to use for HTTPS.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderWebCertificateSecretRef {
/// Name is the name of the secret.
pub name: String,
}
/// DexIdentityProviderStatus defines the observed state of the Dex identity provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStatus {
/// ClientRefs is a list of clients that are using this DexIdentityProvider.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "clientRefs")]
pub client_refs: Option<Vec<DexIdentityProviderStatusClientRefs>>,
/// Conditions represents the latest available observations of an DexIdentityProvider's current state.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub conditions: Option<Vec<Condition>>,
/// ObservedGeneration is the most recent generation observed for this DexIdentityProvider by the controller.
#[serde(default, skip_serializing_if = "Option::is_none", rename = "observedGeneration")]
pub observed_generation: Option<i64>,
/// Phase is the current state of the Dex identity provider.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub phase: Option<String>,
}
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct DexIdentityProviderStatusClientRefs {
/// Name of the referenced DexOAuth2Client.
pub name: String,
/// Namespace is the optional namespace of the referenced DexOAuth2Client.
#[serde(default, skip_serializing_if = "Option::is_none")]
pub namespace: Option<String>,
}