---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.15.0
  name: keycloakclients.v1.edp.epam.com
spec:
  group: v1.edp.epam.com
  names:
    kind: KeycloakClient
    listKind: KeycloakClientList
    plural: keycloakclients
    singular: keycloakclient
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - description: Reconcilation status
      jsonPath: .status.value
      name: Status
      type: string
    name: v1
    schema:
      openAPIV3Schema:
        description: KeycloakClient is the Schema for the keycloak clients API.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: KeycloakClientSpec defines the desired state of KeycloakClient.
            properties:
              adminUrl:
                description: |-
                  AdminUrl is client admin url.
                  If empty - WebUrl will be used.
                type: string
              advancedProtocolMappers:
                description: AdvancedProtocolMappers is a flag to enable advanced
                  protocol mappers.
                type: boolean
              attributes:
                additionalProperties:
                  type: string
                default:
                  post.logout.redirect.uris: +
                description: Attributes is a map of client attributes.
                nullable: true
                type: object
              authenticationFlowBindingOverrides:
                description: AuthenticationFlowBindingOverrides client auth flow overrides
                properties:
                  browser:
                    type: string
                  directGrant:
                    type: string
                type: object
              authorization:
                description: Authorization is a client authorization configuration.
                nullable: true
                properties:
                  permissions:
                    items:
                      properties:
                        decisionStrategy:
                          default: UNANIMOUS
                          description: DecisionStrategy is a permission decision strategy.
                          enum:
                          - UNANIMOUS
                          - AFFIRMATIVE
                          - CONSENSUS
                          type: string
                        description:
                          description: Description is a permission description.
                          type: string
                        logic:
                          default: POSITIVE
                          description: Logic is a permission logic.
                          enum:
                          - POSITIVE
                          - NEGATIVE
                          type: string
                        name:
                          description: Name is a permission name.
                          type: string
                        policies:
                          description: |-
                            Policies is a list of policies names.
                            Specifies all the policies that must be applied to the scopes defined by this policy or permission.
                          example:
                          - policy1
                          - policy2
                          items:
                            type: string
                          nullable: true
                          type: array
                        resources:
                          description: |-
                            Resources is a list of resources names.
                            Specifies that this permission must be applied to all resource instances of a given type.
                          example:
                          - resource1
                          - resource2
                          items:
                            type: string
                          nullable: true
                          type: array
                        scopes:
                          description: |-
                            Scopes is a list of authorization scopes names.
                            Specifies that this permission must be applied to one or more scopes.
                          example:
                          - scope1
                          - scope2
                          items:
                            type: string
                          nullable: true
                          type: array
                        type:
                          description: Type is a permission type.
                          enum:
                          - resource
                          - scope
                          type: string
                      required:
                      - name
                      - type
                      type: object
                    type: array
                  policies:
                    items:
                      description: Policy represents a client authorization policy.
                      properties:
                        aggregatedPolicy:
                          description: AggregatedPolicy is an aggregated policy settings.
                          properties:
                            policies:
                              description: |-
                                Policies is a list of aggregated policies names.
                                Specifies all the policies that must be applied to the scopes defined by this policy or permission.
                              example:
                                policies:
                                - policy1
                                - policy2
                              items:
                                type: string
                              type: array
                          required:
                          - policies
                          type: object
                        clientPolicy:
                          description: ClientPolicy is a client policy settings.
                          properties:
                            clients:
                              description: Clients is a list of client names. Specifies
                                which client(s) are allowed by this policy.
                              example:
                              - clients1
                              - clients2
                              items:
                                type: string
                              type: array
                          required:
                          - clients
                          type: object
                        decisionStrategy:
                          default: UNANIMOUS
                          description: DecisionStrategy is a policy decision strategy.
                          enum:
                          - UNANIMOUS
                          - AFFIRMATIVE
                          - CONSENSUS
                          type: string
                        description:
                          description: Description is a policy description.
                          type: string
                        groupPolicy:
                          description: GroupPolicy is a group policy settings.
                          properties:
                            groups:
                              description: Groups is a list of group names. Specifies
                                which group(s) are allowed by this policy.
                              example: '{"groups":[{"name":"group1","extendChildren":true},{"name":"group2"}]}'
                              items:
                                description: GroupDefinition represents a group in
                                  a GroupPolicyData.
                                properties:
                                  extendChildren:
                                    description: ExtendChildren is a flag that specifies
                                      whether to extend children.
                                    type: boolean
                                  name:
                                    description: Name is a group name.
                                    example: group1
                                    type: string
                                required:
                                - name
                                type: object
                              type: array
                            groupsClaim:
                              description: |-
                                GroupsClaim is a group claim.
                                If defined, the policy will fetch user's groups from the given claim
                                within an access token or ID token representing the identity asking permissions.
                                If not defined, user's groups are obtained from your realm configuration.
                              type: string
                          type: object
                        logic:
                          default: POSITIVE
                          description: Logic is a policy logic.
                          enum:
                          - POSITIVE
                          - NEGATIVE
                          type: string
                        name:
                          description: Name is a policy name.
                          type: string
                        rolePolicy:
                          description: RolePolicy is a role policy settings.
                          properties:
                            roles:
                              description: Roles is a list of role.
                              example:
                                roles:
                                - name: role1
                                  required: true
                                - name: role2
                              items:
                                description: RoleDefinition represents a role in a
                                  RolePolicyData.
                                properties:
                                  name:
                                    description: Name is a role name.
                                    example: role1
                                    type: string
                                  required:
                                    description: Required is a flag that specifies
                                      whether the role is required.
                                    type: boolean
                                required:
                                - name
                                type: object
                              type: array
                          required:
                          - roles
                          type: object
                        timePolicy:
                          description: ScopePolicy is a scope policy settings.
                          properties:
                            dayMonth:
                              description: |-
                                Day defines the month which the policy MUST be granted.
                                You can also provide a range by filling the dayMonthEnd field.
                                In this case, permission is granted only if current month is between or equal to the two values you provided.
                              example: "1"
                              type: string
                            dayMonthEnd:
                              example: "2"
                              type: string
                            hour:
                              description: |-
                                Hour defines the hour when the policy MUST be granted.
                                You can also provide a range by filling the hourEnd.
                                In this case, permission is granted only if current hour is between or equal to the two values you provided.
                              example: "1"
                              type: string
                            hourEnd:
                              example: "2"
                              type: string
                            minute:
                              description: |-
                                Minute defines the minute when the policy MUST be granted.
                                You can also provide a range by filling the minuteEnd field.
                                In this case, permission is granted only if current minute is between or equal to the two values you provided.
                              example: "1"
                              type: string
                            minuteEnd:
                              example: "2"
                              type: string
                            month:
                              description: |-
                                Month defines the month which the policy MUST be granted.
                                You can also provide a range by filling the monthEnd.
                                In this case, permission is granted only if current month is between or equal to the two values you provided.
                              example: "1"
                              type: string
                            monthEnd:
                              example: "2"
                              type: string
                            notBefore:
                              description: |-
                                NotBefore defines the time before which the policy MUST NOT be granted.
                                Only granted if current date/time is after or equal to this value.
                              example: "2024-03-03 00:00:00"
                              type: string
                            notOnOrAfter:
                              description: |-
                                NotOnOrAfter defines the time after which the policy MUST NOT be granted.
                                Only granted if current date/time is before or equal to this value.
                              example: "2024-04-04 00:00:00"
                              type: string
                          required:
                          - notBefore
                          - notOnOrAfter
                          type: object
                        type:
                          description: Type is a policy type.
                          enum:
                          - aggregate
                          - client
                          - group
                          - role
                          - time
                          - user
                          type: string
                        userPolicy:
                          description: UserPolicy is a user policy settings.
                          properties:
                            users:
                              description: Users is a list of usernames. Specifies
                                which user(s) are allowed by this policy.
                              example:
                              - users1
                              - users2
                              items:
                                type: string
                              type: array
                          required:
                          - users
                          type: object
                      required:
                      - name
                      - type
                      type: object
                    type: array
                  resources:
                    items:
                      properties:
                        attributes:
                          additionalProperties:
                            items:
                              type: string
                            type: array
                          description: Attributes is a map of resource attributes.
                          nullable: true
                          type: object
                        displayName:
                          description: DisplayName for Identity Providers.
                          type: string
                        iconUri:
                          description: IconURI pointing to an icon.
                          type: string
                        name:
                          description: Name is unique resource name.
                          type: string
                        ownerManagedAccess:
                          description: OwnerManagedAccess if enabled, the access to
                            this resource can be managed by the resource owner.
                          type: boolean
                        scopes:
                          description: |-
                            Scopes requested or assigned in advance to the client to determine whether the policy is applied to this client.
                            Condition is evaluated during OpenID Connect authorization request and/or token request.
                          items:
                            type: string
                          nullable: true
                          type: array
                        type:
                          description: Type of this resource. It can be used to group
                            different resource instances with the same type.
                          type: string
                        uris:
                          description: URIs which are protected by resource.
                          items:
                            type: string
                          nullable: true
                          type: array
                      required:
                      - displayName
                      - name
                      type: object
                    type: array
                  scopes:
                    items:
                      type: string
                    type: array
                type: object
              authorizationServicesEnabled:
                description: ServiceAccountsEnabled enable/disable fine-grained authorization
                  support for a client.
                type: boolean
              bearerOnly:
                description: BearerOnly is a flag to enable bearer-only.
                type: boolean
              clientAuthenticatorType:
                default: client-secret
                description: ClientAuthenticatorType is a client authenticator type.
                type: string
              clientId:
                description: ClientId is a unique keycloak client ID referenced in
                  URI and tokens.
                type: string
              clientRoles:
                description: ClientRoles is a list of client roles names assigned
                  to client.
                items:
                  type: string
                nullable: true
                type: array
              consentRequired:
                description: ConsentRequired is a flag to enable consent.
                type: boolean
              defaultClientScopes:
                description: DefaultClientScopes is a list of default client scopes
                  assigned to client.
                items:
                  type: string
                nullable: true
                type: array
              description:
                description: Description is a client description.
                type: string
              directAccess:
                description: DirectAccess is a flag to set client as direct access.
                type: boolean
              enabled:
                default: true
                description: Enabled is a flag to enable client.
                type: boolean
              frontChannelLogout:
                description: FrontChannelLogout is a flag to enable front channel
                  logout.
                type: boolean
              fullScopeAllowed:
                default: true
                description: FullScopeAllowed is a flag to enable full scope.
                type: boolean
              homeUrl:
                description: HomeUrl is a client home url.
                type: string
              implicitFlowEnabled:
                description: ImplicitFlowEnabled is a flag to enable support for OpenID
                  Connect redirect based authentication without authorization code.
                type: boolean
              name:
                description: Name is a client name.
                type: string
              optionalClientScopes:
                description: OptionalClientScopes is a list of optional client scopes
                  assigned to client.
                items:
                  type: string
                nullable: true
                type: array
              protocol:
                description: Protocol is a client protocol.
                nullable: true
                type: string
              protocolMappers:
                description: ProtocolMappers is a list of protocol mappers assigned
                  to client.
                items:
                  properties:
                    config:
                      additionalProperties:
                        type: string
                      description: Config is a map of protocol mapper configuration.
                      nullable: true
                      type: object
                    name:
                      description: Name is a protocol mapper name.
                      type: string
                    protocol:
                      description: Protocol is a protocol name.
                      type: string
                    protocolMapper:
                      description: ProtocolMapper is a protocol mapper name.
                      type: string
                  type: object
                nullable: true
                type: array
              public:
                description: Public is a flag to set client as public.
                type: boolean
              realmRef:
                description: RealmRef is reference to Realm custom resource.
                properties:
                  kind:
                    description: Kind specifies the kind of the Keycloak resource.
                    enum:
                    - KeycloakRealm
                    - ClusterKeycloakRealm
                    type: string
                  name:
                    description: Name specifies the name of the Keycloak resource.
                    type: string
                type: object
              realmRoles:
                description: RealmRoles is a list of realm roles assigned to client.
                items:
                  properties:
                    composite:
                      description: Composite is a realm composite role name.
                      type: string
                    name:
                      description: Name is a realm role name.
                      type: string
                  required:
                  - composite
                  type: object
                nullable: true
                type: array
              reconciliationStrategy:
                description: ReconciliationStrategy is a strategy to reconcile client.
                enum:
                - full
                - addOnly
                type: string
              redirectUris:
                description: |-
                  RedirectUris is a list of valid URI pattern a browser can redirect to after a successful login.
                  Simple wildcards are allowed such as 'https://example.com/*'.
                  Relative path can be specified too, such as /my/relative/path/*. Relative paths are relative to the client root URL.
                  If not specified, spec.webUrl + "/*" will be used.
                example:
                - https://example.com/*
                - /my/relative/path/*
                items:
                  type: string
                nullable: true
                type: array
              secret:
                description: |-
                  Secret is kubernetes secret name where the client's secret will be stored.
                  Secret should have the following format: $secretName:secretKey.
                  If not specified, a client secret will be generated and stored in a secret with the name keycloak-client-{metadata.name}-secret.
                  If keycloak client is public, secret property will be ignored.
                example: $keycloak-secret:client_secret
                type: string
              serviceAccount:
                description: ServiceAccount is a service account configuration.
                nullable: true
                properties:
                  attributes:
                    additionalProperties:
                      type: string
                    description: Attributes is a map of service account attributes.
                    nullable: true
                    type: object
                  clientRoles:
                    description: ClientRoles is a list of client roles assigned to
                      service account.
                    items:
                      properties:
                        clientId:
                          description: ClientID is a client ID.
                          type: string
                        roles:
                          description: Roles is a list of client roles names assigned
                            to service account.
                          items:
                            type: string
                          nullable: true
                          type: array
                      required:
                      - clientId
                      type: object
                    nullable: true
                    type: array
                  enabled:
                    description: Enabled is a flag to enable service account.
                    type: boolean
                  realmRoles:
                    description: RealmRoles is a list of realm roles assigned to service
                      account.
                    items:
                      type: string
                    nullable: true
                    type: array
                type: object
              standardFlowEnabled:
                default: true
                description: StandardFlowEnabled is a flag to enable standard flow.
                type: boolean
              surrogateAuthRequired:
                description: SurrogateAuthRequired is a flag to enable surrogate auth.
                type: boolean
              targetRealm:
                description: |-
                  Deprecated: use RealmRef instead.
                  TargetRealm is a realm name where client will be created.
                  It has higher priority than RealmRef for backward compatibility.
                  If both TargetRealm and RealmRef are specified, TargetRealm will be used for client creation.
                type: string
              webOrigins:
                description: |-
                  WebOrigins is a list of allowed CORS origins.
                  To permit all origins of Valid Redirect URIs, add '+'. This does not include the '*' wildcard though.
                  To permit all origins, explicitly add '*'.
                  If not specified, the value from `WebUrl` is used
                example:
                - https://example.com/*
                items:
                  type: string
                nullable: true
                type: array
              webUrl:
                description: WebUrl is a client web url.
                type: string
            required:
            - clientId
            type: object
          status:
            description: KeycloakClientStatus defines the observed state of KeycloakClient.
            properties:
              clientId:
                type: string
              failureCount:
                format: int64
                type: integer
              value:
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
