{
  "description": "CephObjectStoreUser represents a Ceph Object Store Gateway User",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "ObjectStoreUserSpec represents the spec of a CephObjectStoreUser",
      "properties": {
        "accountRef": {
          "description": "AccountRef is a reference to a CephObjectStoreAccount to associate this user with.\nThe referenced account must be in the same namespace as the user.\nWhen set, the user is created as an account user with no default permissions,\nand resources created by this user are owned by the account.",
          "properties": {
            "name": {
              "description": "Name of the CephObjectStoreAccount CR",
              "maxLength": 2048,
              "minLength": 1,
              "pattern": "^[a-zA-Z0-9 ._-]+$",
              "type": "string"
            }
          },
          "required": [
            "name"
          ],
          "type": "object",
          "x-kubernetes-validations": [
            {
              "message": "accountRef is immutable",
              "rule": "self == oldSelf"
            }
          ],
          "additionalProperties": false
        },
        "capabilities": {
          "description": "Additional admin-level capabilities for the Ceph object store user",
          "nullable": true,
          "properties": {
            "accounts": {
              "description": "Add capabilities for user to manage accounts. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities\nNote: Only supported from Ceph Squid (v19.2.3) onwards",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "amz-cache": {
              "description": "Add capabilities for user to send request to RGW Cache API header. Documented in https://docs.ceph.com/en/latest/radosgw/rgw-cache/#cache-api",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "bilog": {
              "description": "Add capabilities for user to change bucket index logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "bucket": {
              "description": "Admin capabilities to read/write Ceph object store buckets. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "buckets": {
              "description": "Admin capabilities to read/write Ceph object store buckets. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "datalog": {
              "description": "Add capabilities for user to change data logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "info": {
              "description": "Admin capabilities to read/write information about the user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "mdlog": {
              "description": "Add capabilities for user to change metadata logging. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "metadata": {
              "description": "Admin capabilities to read/write Ceph object store metadata. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "oidc-provider": {
              "description": "Add capabilities for user to change oidc provider. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "ratelimit": {
              "description": "Add capabilities for user to set rate limiter for user and bucket. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "roles": {
              "description": "Admin capabilities to read/write roles for user. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "usage": {
              "description": "Admin capabilities to read/write Ceph object store usage. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "user": {
              "description": "Admin capabilities to read/write Ceph object store users. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "user-policy": {
              "description": "Add capabilities for user to change user policies. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "userInfoWithoutKeys": {
              "description": "Add capabilities for user to fetch user info without keys. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities\nNote: Only supported from Ceph Squid (v19.2.0) onwards",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "users": {
              "description": "Admin capabilities to read/write Ceph object store users. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            },
            "zone": {
              "description": "Admin capabilities to read/write Ceph object store zones. Documented in https://docs.ceph.com/en/latest/radosgw/admin/?#add-remove-admin-capabilities",
              "enum": [
                "*",
                "read",
                "write",
                "read, write"
              ],
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "clusterNamespace": {
          "description": "The namespace where the parent CephCluster and CephObjectStore are found",
          "type": "string"
        },
        "defaultPlacement": {
          "description": "DefaultPlacement sets the default pool placement target for buckets\ncreated by this user. It must name a placement target known to the\nzonegroup serving the referenced object store; RGW rejects unknown\ntargets. If this field is absent the controller does not manage the\nuser's placement: an existing value (set previously through this\nfield, or outside of Rook) is left in place.",
          "maxLength": 2048,
          "minLength": 1,
          "pattern": "^[a-zA-Z0-9._-]+$",
          "type": "string"
        },
        "defaultStorageClass": {
          "description": "DefaultStorageClass sets the default storage class for objects created\nby this user, within the placement set by DefaultPlacement (which must\nalso be set). The storage class must exist on that placement target;\nRGW rejects unknown storage classes. If this field is absent the\ncontroller does not manage the user's storage class: an existing value\nis preserved, except when DefaultPlacement changes, which resets the\nstorage class to the new target's default (STANDARD).",
          "maxLength": 2048,
          "minLength": 1,
          "pattern": "^[a-zA-Z0-9._-]+$",
          "type": "string"
        },
        "displayName": {
          "description": "The display name for the ceph user.",
          "type": "string"
        },
        "keys": {
          "description": "Allows specifying credentials for the user. If not provided, the operator\nwill generate them.",
          "items": {
            "description": "ObjectUserKey defines a set of rgw user access credentials to be retrieved\nfrom secret resources.",
            "properties": {
              "accessKeyRef": {
                "description": "Secret key selector for the access_key (commonly referred to as AWS_ACCESS_KEY_ID).",
                "properties": {
                  "key": {
                    "description": "The key of the secret to select from.  Must be a valid secret key.",
                    "type": "string"
                  },
                  "name": {
                    "default": "",
                    "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
                    "type": "string"
                  },
                  "optional": {
                    "description": "Specify whether the Secret or its key must be defined",
                    "type": "boolean"
                  }
                },
                "required": [
                  "key"
                ],
                "type": "object",
                "x-kubernetes-map-type": "atomic",
                "additionalProperties": false
              },
              "secretKeyRef": {
                "description": "Secret key selector for the secret_key (commonly referred to as AWS_SECRET_ACCESS_KEY).",
                "properties": {
                  "key": {
                    "description": "The key of the secret to select from.  Must be a valid secret key.",
                    "type": "string"
                  },
                  "name": {
                    "default": "",
                    "description": "Name of the referent.\nThis field is effectively required, but due to backwards compatibility is\nallowed to be empty. Instances of this type with an empty value here are\nalmost certainly wrong.\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names",
                    "type": "string"
                  },
                  "optional": {
                    "description": "Specify whether the Secret or its key must be defined",
                    "type": "boolean"
                  }
                },
                "required": [
                  "key"
                ],
                "type": "object",
                "x-kubernetes-map-type": "atomic",
                "additionalProperties": false
              }
            },
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "opMask": {
          "description": "The op-mask of the user.",
          "items": {
            "description": "Internally, RGW labels \"operations\" on persistent state as `RGW_OP_TYPE_READ` (`read`), `RGW_OP_TYPE_WRITE` (`write`), or `RGW_OP_TYPE_DELETE` (`delete`). All RGW users have an \"operation mask\", which does not function as a mask or filter as is typically implied by the word \"mask\", but as a set of allowed or permissible \"operation\" types the user is able to perform. The \"operation mask\" is applied regardless of the bucket or IAM policy. For example, in order for an RGW user to be able to read an object from a bucket, that user must have **both** the `read` \"op mask\" bit and an IAM/bucket policy that allows `s3:GetObject`. The default operations allowed are `read`, `write`, and `delete`. Setting the value to `[]` (an empty YAML sequence) causes all \"operations\" in the mask to be removed, meaning that the user will not be able to perform any operations. These operation masks are supported: `read`, `write`, `delete`",
            "enum": [
              "read",
              "write",
              "delete"
            ],
            "type": "string"
          },
          "maxItems": 3,
          "minItems": 0,
          "type": "array",
          "x-kubernetes-list-type": "set"
        },
        "quotas": {
          "description": "ObjectUserQuotaSpec can be used to set quotas for the object store user to limit their usage. See the [Ceph docs](https://docs.ceph.com/en/latest/radosgw/admin/?#quota-management) for more",
          "nullable": true,
          "properties": {
            "maxBuckets": {
              "description": "Maximum bucket limit for the ceph user",
              "nullable": true,
              "type": "integer"
            },
            "maxObjects": {
              "description": "Maximum number of objects across all the user's buckets",
              "format": "int64",
              "nullable": true,
              "type": "integer"
            },
            "maxSize": {
              "anyOf": [
                {
                  "type": "integer"
                },
                {
                  "type": "string"
                }
              ],
              "description": "Maximum size limit of all objects across all the user's buckets\nSee https://pkg.go.dev/k8s.io/apimachinery/pkg/api/resource#Quantity for more info.",
              "nullable": true,
              "pattern": "^(\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))(([KMGTPE]i)|[numkMGTPE]|([eE](\\+|-)?(([0-9]+(\\.[0-9]*)?)|(\\.[0-9]+))))?$",
              "x-kubernetes-int-or-string": true
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "secretTemplate": {
          "description": "SecretTemplate defines labels and annotations to add to the Secret that\nholds this user's credentials, for example to opt the Secret in to a\ntool that copies Secrets into other namespaces. Anyone who can edit this\nCephObjectStoreUser can use it to hand the credentials to such a tool.\nThe labels app, user, rook_cluster and rook_object_store, which Rook\nsets on this Secret, are reserved.",
          "minProperties": 1,
          "properties": {
            "annotations": {
              "additionalProperties": {
                "description": "AnnotationValue is a Kubernetes annotation value of at most 256 KiB. Its\nlength is also capped at 262144 characters, the most a 256 KiB value can\nhold, because the API server needs that bound to accept the CEL rules that\ncheck a template's annotations.",
                "maxLength": 262144,
                "type": "string",
                "x-kubernetes-validations": [
                  {
                    "message": "annotation values must be at most 256 KiB",
                    "rule": "size(bytes(self)) <= 262144"
                  }
                ]
              },
              "description": "Annotations to add to the Secret, at most 256 KiB in total. The key\ncephx-keyring, and keys with a rook.io or *.rook.io prefix, are reserved.",
              "maxProperties": 32,
              "minProperties": 1,
              "type": "object",
              "x-kubernetes-validations": [
                {
                  "message": "annotation keys must be valid Kubernetes annotation keys",
                  "rule": "self.all(k, !format.qualifiedName().validate(k.lowerAscii()).hasValue())"
                },
                {
                  "message": "annotation key cephx-keyring is reserved by Rook",
                  "rule": "self.all(k, k != 'cephx-keyring')"
                },
                {
                  "message": "annotation keys with a rook.io prefix are reserved by Rook",
                  "rule": "self.all(k, !k.matches('^([^/]*[.])?rook[.]io/'))"
                },
                {
                  "message": "annotations must total at most 256 KiB",
                  "rule": "self.map(k, size(bytes(k)) + size(bytes(self[k]))).sum() <= 262144"
                }
              ]
            },
            "labels": {
              "additionalProperties": {
                "description": "LabelValue is a Kubernetes label value: at most 63 characters, empty or\nalphanumeric at both ends, with '-', '_' and '.' allowed in between.",
                "maxLength": 63,
                "pattern": "^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])?$",
                "type": "string"
              },
              "description": "Labels to add to the Secret. The key do_not_reconcile, and keys with a\nrook.io or *.rook.io prefix, are reserved.",
              "maxProperties": 32,
              "minProperties": 1,
              "type": "object",
              "x-kubernetes-validations": [
                {
                  "message": "label keys must be valid Kubernetes label keys",
                  "rule": "self.all(k, !format.qualifiedName().validate(k).hasValue())"
                },
                {
                  "message": "label key do_not_reconcile is reserved by Rook",
                  "rule": "self.all(k, k != 'do_not_reconcile')"
                },
                {
                  "message": "label keys with a rook.io prefix are reserved by Rook",
                  "rule": "self.all(k, !k.matches('^([^/]*[.])?rook[.]io/'))"
                }
              ]
            }
          },
          "type": "object",
          "x-kubernetes-validations": [
            {
              "message": "label keys app, user, rook_cluster and rook_object_store are reserved by Rook",
              "rule": "!has(self.labels) || self.labels.all(k, !(k in ['app', 'user', 'rook_cluster', 'rook_object_store']))"
            }
          ],
          "additionalProperties": false
        },
        "store": {
          "description": "The store the user will be created in",
          "type": "string"
        }
      },
      "type": "object",
      "x-kubernetes-validations": [
        {
          "message": "defaultStorageClass requires defaultPlacement",
          "rule": "!has(self.defaultStorageClass) || has(self.defaultPlacement)"
        }
      ],
      "additionalProperties": false
    },
    "status": {
      "description": "ObjectStoreUserStatus represents the status Ceph Object Store Gateway User",
      "properties": {
        "info": {
          "additionalProperties": {
            "type": "string"
          },
          "nullable": true,
          "type": "object"
        },
        "keys": {
          "items": {
            "properties": {
              "name": {
                "description": "name is unique within a namespace to reference a secret resource.",
                "type": "string"
              },
              "namespace": {
                "description": "namespace defines the space within which the secret name must be unique.",
                "type": "string"
              },
              "resourceVersion": {
                "type": "string"
              },
              "uid": {
                "description": "UID is a type that holds unique ID values, including UUIDs.  Because we\ndon't ONLY use UUIDs, this is an alias to string.  Being a type captures\nintent and helps make sure that UIDs and names do not get conflated.",
                "type": "string"
              }
            },
            "type": "object",
            "x-kubernetes-map-type": "atomic",
            "additionalProperties": false
          },
          "nullable": true,
          "type": "array"
        },
        "observedGeneration": {
          "description": "ObservedGeneration is the latest generation observed by the controller.",
          "format": "int64",
          "type": "integer"
        },
        "phase": {
          "type": "string"
        }
      },
      "type": "object",
      "x-kubernetes-preserve-unknown-fields": true,
      "additionalProperties": false
    }
  },
  "required": [
    "metadata",
    "spec"
  ],
  "type": "object"
}