| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -GroupMembership | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- GroupMembershipSpec defines the desired state of GroupMembership - |
- false | -
| status | -object | -
- GroupMembershipStatus defines the observed state of GroupMembership - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| groupRef | -object | -
- GroupRef is a reference to the Group.
-Group is a namespaced resource. - |
- true | -
| userRef | -object | -
- UserRef is a reference to the User that is a member of the Group.
-User is a cluster-scoped resource. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the Group being referenced. - |
- true | -
| namespace | -string | -
- Namespace of the referenced Group. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions represent the latest available observations of an object's current state. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -Group | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| status | -object | -
- GroupStatus defines the observed state of Group - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions represent the latest available observations of an object's current state. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -MachineAccount | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- MachineAccountSpec defines the desired state of MachineAccount - |
- false | -
| status | -object | -
- MachineAccountStatus defines the observed state of MachineAccount - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| state | -enum | -
- The state of the machine account. This state can be safely changed as needed.
-States:
- - Active: The machine account can be used to authenticate.
- - Inactive: The machine account is prohibited to be used to authenticate, and revokes all existing sessions. - - Enum: Active, Inactive - Default: Active - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the MachineAccount. - |
- false | -
| string | -
- The computed email of the machine account following the pattern:
-{metadata.name}@{metadata.namespace}.{project.metadata.name}.{global-suffix} - |
- false | -|
| state | -enum | -
- State represents the current activation state of the machine account from the auth provider.
-This field tracks the state from the previous generation and is updated when state changes
-are successfully propagated to the auth provider. It helps optimize performance by only
-updating the auth provider when a state change is detected. - - Enum: Active, Inactive - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -PlatformAccessApproval | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- PlatformAccessApprovalSpec defines the desired state of PlatformAccessApproval. - - Validations: |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| subjectRef | -object | -
- SubjectRef is the reference to the subject being approved. - - Validations: |
- true | -
| approverRef | -object | -
- ApproverRef is the reference to the approver being approved.
-If not specified, the approval was made by the system. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| string | -
- Email is the email of the user being approved.
-Use Email to approve an email address that is not associated with a created user. (e.g. when using PlatformInvitation)
-UserRef and Email are mutually exclusive. Exactly one of them must be specified. - |
- false | -|
| userRef | -object | -
- UserRef is the reference to the user being approved.
-UserRef and Email are mutually exclusive. Exactly one of them must be specified. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -PlatformAccessDenial | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- PlatformAccessDenialSpec defines the desired state of PlatformAccessDenial. - - Validations: |
- false | -
| status | -object | -
- - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| subjectRef | -object | -
- SubjectRef is the reference to the subject being approved. - - Validations: |
- true | -
| approverRef | -object | -
- ApproverRef is the reference to the approver being approved.
-If not specified, the approval was made by the system. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| string | -
- Email is the email of the user being approved.
-Use Email to approve an email address that is not associated with a created user. (e.g. when using PlatformInvitation)
-UserRef and Email are mutually exclusive. Exactly one of them must be specified. - |
- false | -|
| userRef | -object | -
- UserRef is the reference to the user being approved.
-UserRef and Email are mutually exclusive. Exactly one of them must be specified. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the PlatformAccessDenial. - - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Platform access approval reconciliation is pending reason:ReconcilePending status:Unknown type:Ready]] - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -PlatformAccessRejection | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- PlatformAccessRejectionSpec defines the desired state of PlatformAccessRejection. - - Validations: |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| reason | -string | -
- Reason is the reason for the rejection. - |
- true | -
| subjectRef | -object | -
- UserRef is the reference to the user being rejected. - |
- true | -
| rejecterRef | -object | -
- RejecterRef is the reference to the actor who issued the rejection.
-If not specified, the rejection was made by the system. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -PlatformInvitation | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- PlatformInvitationSpec defines the desired state of PlatformInvitation. - |
- false | -
| status | -object | -
- PlatformInvitationStatus defines the observed state of PlatformInvitation. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| string | -
- The email of the user being invited. - - Validations: |
- true | -|
| familyName | -string | -
- The family name of the user being invited. - |
- false | -
| givenName | -string | -
- The given name of the user being invited. - |
- false | -
| invitedBy | -object | -
- The user who created the platform invitation. A mutation webhook will default this field to the user who made the request. - - Validations: |
- false | -
| scheduleAt | -string | -
- The schedule at which the platform invitation will be sent.
-It can only be updated before the platform invitation is sent. - - Format: date-time - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the PlatformInvitation. - - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Platform invitation reconciliation is pending reason:ReconcilePending status:Unknown type:Ready]] - |
- false | -
| object | -
- The email resource that was created for the platform invitation. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- The name of the email resource that was created for the platform invitation. - |
- false | -
| namespace | -string | -
- The namespace of the email resource that was created for the platform invitation. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -PolicyBinding | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- PolicyBindingSpec defines the desired state of PolicyBinding - |
- false | -
| status | -object | -
- PolicyBindingStatus defines the observed state of PolicyBinding - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| resourceSelector | -object | -
- ResourceSelector defines which resources the subjects in the policy binding
-should have the role applied to. Options within this struct are mutually
-exclusive. - - Validations: |
- true | -
| roleRef | -object | -
- RoleRef is a reference to the Role that is being bound.
-This can be a reference to a Role custom resource. - - Validations: |
- true | -
| subjects | -[]object | -
- Subjects holds references to the objects the role applies to. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| resourceKind | -object | -
- ResourceKind specifies that the policy binding should apply to all resources of a specific kind.
-Mutually exclusive with resourceRef. - |
- false | -
| resourceRef | -object | -
- ResourceRef provides a reference to a specific resource instance.
-Mutually exclusive with resourceKind. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind is the type of resource being referenced. - |
- true | -
| apiGroup | -string | -
- APIGroup is the group for the resource type being referenced. If APIGroup
-is not specified, the specified Kind must be in the core API group. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind is the type of resource being referenced. - |
- true | -
| name | -string | -
- Name is the name of resource being referenced. - |
- true | -
| uid | -string | -
- UID is the unique identifier of the resource being referenced. - |
- true | -
| apiGroup | -string | -
- APIGroup is the group for the resource being referenced.
-If APIGroup is not specified, the specified Kind must be in the core API group.
-For any other third-party types, APIGroup is required. - |
- false | -
| namespace | -string | -
- Namespace is the namespace of resource being referenced.
-Required for namespace-scoped resources. Omitted for cluster-scoped resources. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of resource being referenced - |
- true | -
| namespace | -string | -
- Namespace of the referenced Role. If empty, it is assumed to be in the PolicyBinding's namespace. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -enum | -
- Kind of object being referenced. Values defined in Kind constants. - - Enum: User, Group, MachineAccount - |
- true | -
| name | -string | -
- Name of the object being referenced. A special group name of
-"system:authenticated-users" can be used to refer to all authenticated
-users. - |
- true | -
| namespace | -string | -
- Namespace of the referenced object.
-If not specified for a Group, User or MachineAccount, it is ignored. - |
- false | -
| uid | -string | -
- UID of the referenced object. Optional for system groups (groups with names starting with "system:"). - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the PolicyBinding. - - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Waiting for control plane to reconcile reason:Unknown status:Unknown type:Ready]] - |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration is the most recent generation observed for this PolicyBinding by the controller. - - Format: int64 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -ProtectedResource | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- ProtectedResourceSpec defines the desired state of ProtectedResource - |
- false | -
| status | -object | -
- ProtectedResourceStatus defines the observed state of ProtectedResource - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- The kind of the resource.
-This will be in the format `Workload`. - |
- true | -
| permissions | -[]string | -
- A list of permissions that are associated with the resource. - |
- true | -
| plural | -string | -
- The plural form for the resource type, e.g. 'workloads'. Must follow
-camelCase format. - |
- true | -
| serviceRef | -object | -
- ServiceRef references the service definition this protected resource belongs to. - |
- true | -
| singular | -string | -
- The singular form for the resource type, e.g. 'workload'. Must follow
-camelCase format. - |
- true | -
| parentResources | -[]object | -
- A list of resources that are registered with the platform that may be a
-parent to the resource. Permissions may be bound to a parent resource so
-they can be inherited down the resource hierarchy. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the resource name of the service definition. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -string | -
- Kind is the type of resource being referenced. - |
- true | -
| apiGroup | -string | -
- APIGroup is the group for the resource being referenced.
-If APIGroup is not specified, the specified Kind must be in the core API group.
-For any other third-party types, APIGroup is required. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the ProtectedResource. - - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Waiting for control plane to reconcile reason:Unknown status:Unknown type:Ready]] - |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration is the most recent generation observed for this ProtectedResource. It corresponds to the
-ProtectedResource's generation, which is updated on mutation by the API Server. - - Format: int64 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -Role | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- RoleSpec defines the desired state of Role - |
- false | -
| status | -object | -
- RoleStatus defines the observed state of Role - - Default: map[conditions:[map[lastTransitionTime:1970-01-01T00:00:00Z message:Waiting for control plane to reconcile reason:Unknown status:Unknown type:Ready]]] - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| launchStage | -string | -
- Defines the launch stage of the IAM Role. Must be one of: Early Access,
-Alpha, Beta, Stable, Deprecated. - |
- true | -
| includedPermissions | -[]string | -
- The names of the permissions this role grants when bound in an IAM policy.
-All permissions must be in the format: `{service}.{resource}.{action}`
-(e.g. compute.workloads.create). - |
- false | -
| inheritedRoles | -[]object | -
- The list of roles from which this role inherits permissions.
-Each entry must be a valid role resource name. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name of the referenced Role. - |
- true | -
| namespace | -string | -
- Namespace of the referenced Role.
-If not specified, it defaults to the namespace of the resource containing this reference. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the Role. - |
- false | -
| effectivePermissions | -[]string | -
- EffectivePermissions is the complete flattened list of all permissions
-granted by this role, including permissions from inheritedRoles and
-directly specified includedPermissions. This is computed by the controller
-and provides a single source of truth for all permissions this role grants. - |
- false | -
| observedGeneration | -integer | -
- ObservedGeneration is the most recent generation observed by the controller. - - Format: int64 - |
- false | -
| parent | -string | -
- The resource name of the parent the role was created under. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -UserDeactivation | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- UserDeactivationSpec defines the desired state of UserDeactivation - |
- false | -
| status | -object | -
- UserDeactivationStatus defines the observed state of UserDeactivation - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| deactivatedBy | -string | -
- DeactivatedBy indicates who initiated the deactivation. - |
- true | -
| reason | -string | -
- Reason is the internal reason for deactivation. - |
- true | -
| userRef | -object | -
- UserRef is a reference to the User being deactivated.
-User is a cluster-scoped resource. - |
- true | -
| description | -string | -
- Description provides detailed internal description for the deactivation. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions represent the latest available observations of an object's current state. - - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Waiting for control plane to reconcile reason:Unknown status:Unknown type:Ready]] - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -UserInvitation | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- UserInvitationSpec defines the desired state of UserInvitation - |
- false | -
| status | -object | -
- UserInvitationStatus defines the observed state of UserInvitation - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| string | -
- The email of the user being invited. - - Validations: |
- true | -|
| organizationRef | -object | -
- OrganizationRef is a reference to the Organization that the user is invoted to. - - Validations: |
- true | -
| roles | -[]object | -
- The roles that will be assigned to the user when they accept the invitation. - - Validations: |
- true | -
| state | -enum | -
- State is the state of the UserInvitation. In order to accept the invitation, the invited user
-must set the state to Accepted. - - Validations: - |
- true | -
| expirationDate | -string | -
- ExpirationDate is the date and time when the UserInvitation will expire.
-If not specified, the UserInvitation will never expire. - - Validations: - |
- false | -
| familyName | -string | -
- The last name of the user being invited. - - Validations: |
- false | -
| givenName | -string | -
- The first name of the user being invited. - - Validations: |
- false | -
| invitedBy | -object | -
- InvitedBy is the user who invited the user. A mutation webhook will default this field to the user who made the request. - - Validations: |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of resource being referenced - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of resource being referenced - |
- true | -
| namespace | -string | -
- Namespace of the referenced Role. If empty, it is assumed to be in the PolicyBinding's namespace. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the User being referenced. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the UserInvitation. - - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Waiting for control plane to reconcile reason:Unknown status:Unknown type:Unknown]] - |
- false | -
| inviteeUser | -object | -
- InviteeUser contains information about the invitee user in the invitation.
-This value may be nil if the invitee user has not been created yet. - |
- false | -
| inviterUser | -object | -
- InviterUser contains information about the user who invited the user in the invitation. - |
- false | -
| organization | -object | -
- Organization contains information about the organization in the invitation. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. - - Format: date-time - |
- true | -
| message | -string | -
- message is a human readable message indicating details about the transition.
-This may be an empty string. - |
- true | -
| reason | -string | -
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown - |
- true | -
| type | -string | -
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| name | -string | -
- Name is the name of the invitee user in the invitation.
-Name is a cluster-scoped resource, so Namespace is not needed. - |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| displayName | -string | -
- DisplayName is the display name of the user who invited the user in the invitation. - |
- false | -
| emailAddress | -string | -
- EmailAddress is the email address of the user who invited the user in the invitation. - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| displayName | -string | -
- DisplayName is the display name of the organization in the invitation. - |
- false | -
| kind | string | -UserPreference | +ServiceAccount | true |
| Refer to the Kubernetes API documentation for the fields of the `metadata` field. | true | |||
| spec | +spec | object |
- UserPreferenceSpec defines the desired state of UserPreference + ServiceAccountSpec defines the desired state of ServiceAccount |
false |
| status | +status | object |
- UserPreferenceStatus defines the observed state of UserPreference + ServiceAccountStatus defines the observed state of ServiceAccount |
false |
| userRef | -object | -
- Reference to the user these preferences belong to. - |
- true | -|
| theme | +state | enum |
- The user's theme preference. + The state of the service account. This state can be safely changed as needed. +States: + - Active: The service account can be used to authenticate. + - Inactive: The service account is prohibited to be used to authenticate, and revokes all existing sessions. - Enum: light, dark, system - Default: system + Enum: Active, Inactive + Default: Active |
false |
| name | +conditions | +[]object | +
+ Conditions provide conditions that represent the current status of the ServiceAccount. + |
+ false | +
| string |
- Name is the name of the User being referenced. + The computed email of the service account following the pattern: +{metadata.name}@{metadata.namespace}.{project.metadata.name}.{global-suffix} |
- true | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| conditions | -[]object | +false | +|
| state | +enum |
- Conditions provide conditions that represent the current status of the UserPreference. + State represents the current activation state of the service account from the auth provider. +This field tracks the state from the previous generation and is updated when state changes +are successfully propagated to the auth provider. It helps optimize performance by only +updating the auth provider when a state change is detected. - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Waiting for control plane to reconcile reason:Unknown status:Unknown type:Ready]] + Enum: Active, Inactive |
false |
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| apiVersion | -string | -iam.miloapis.com/v1alpha1 | -true | -
| kind | -string | -User | -true | -
| metadata | -object | -Refer to the Kubernetes API documentation for the fields of the `metadata` field. | -true | -
| spec | -object | -
- UserSpec defines the desired state of User - |
- false | -
| status | -object | -
- UserStatus defines the observed state of User - |
- false | -
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| string | -
- The email of the user. - |
- true | -|
| familyName | -string | -
- The last name of the user. - |
- false | -
| givenName | -string | -
- The first name of the user. - |
- false | -
| avatarUrl | -string | -
- AvatarURL points to the avatar image associated with the user. This value is
-populated by the auth provider or any service that provides a user avatar URL. - - Format: uri - |
- false | -|
| conditions | -[]object | -
- Conditions provide conditions that represent the current status of the User. - - Default: [map[lastTransitionTime:1970-01-01T00:00:00Z message:Waiting for control plane to reconcile reason:Unknown status:Unknown type:Ready]] - |
- false | -|
| lastLoginProvider | -string | -
- LastLoginProvider records the identity provider that was most recently used by the
-user to log in (e.g., "github" or "google"). This field is set by the auth provider
-based on authentication events. - |
- false | -|
| registrationApproval | -enum | -
- RegistrationApproval represents the administrator’s decision on the user’s registration request.
-States:
- - Pending: The user is awaiting review by an administrator.
- - Approved: The user registration has been approved.
- - Rejected: The user registration has been rejected.
-The User resource is always created regardless of this value, but the
-ability for the person to sign into the platform and access resources is
-governed by this status: only *Approved* users are granted access, while
-*Pending* and *Rejected* users are prevented for interacting with resources. - - Enum: Pending, Approved, Rejected - |
- false | -|
| state | +kind | enum |
- State represents the current activation state of the user account from the
-auth provider. This field is managed exclusively by the UserDeactivation CRD
-and cannot be changed directly by the user. When a UserDeactivation resource
-is created for the user, the user is deactivated in the auth provider; when
-the UserDeactivation is deleted, the user is reactivated.
-States:
- - Active: The user can be used to authenticate.
- - Inactive: The user is prohibited to be used to authenticate, and revokes all existing sessions. - - Enum: Active, Inactive - Default: Active - |
- false | -
| Name | -Type | -Description | -Required | -|
|---|---|---|---|---|
| lastTransitionTime | -string | -
- lastTransitionTime is the last time the condition transitioned from one status to another.
-This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + Kind of object being referenced. Values defined in Kind constants. - Format: date-time + Enum: User, Group, ServiceAccount |
true | |
| message | +name | string |
- message is a human readable message indicating details about the transition.
-This may be an empty string. + Name of the object being referenced. A special group name of +"system:authenticated-users" can be used to refer to all authenticated +users. |
true |
| reason | +namespace | string |
- reason contains a programmatic identifier indicating the reason for the condition's last transition.
-Producers of specific condition types may define expected values and meanings for this field,
-and whether the values are considered a guaranteed API.
-The value should be a CamelCase string.
-This field may not be empty. - |
- true | -
| status | -enum | -
- status of the condition, one of True, False, Unknown. - - Enum: True, False, Unknown + Namespace of the referenced object. +If not specified for a Group, User or ServiceAccount, it is ignored. |
- true | +false |
| type | +uid | string |
- type of condition in CamelCase or in foo.example.com/CamelCase. - |
- true | -
| observedGeneration | -integer | -
- observedGeneration represents the .metadata.generation that the condition was set based upon.
-For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-with respect to the current state of the instance. - - Format: int64 - Minimum: 0 + UID of the referenced object. Optional for system groups (groups with names starting with "system:"). |
false |
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| apiVersion | +string | +iam.miloapis.com/v1alpha1 | +true | +
| kind | +string | +GroupMembership | +true | +
| metadata | +object | +Refer to the Kubernetes API documentation for the fields of the `metadata` field. | +true | +
| spec | +object | +
+ GroupMembershipSpec defines the desired state of GroupMembership + |
+ false | +
| status | +object | +
+ GroupMembershipStatus defines the observed state of GroupMembership + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| groupRef | +object | +
+ GroupRef is a reference to the Group.
+Group is a namespaced resource. + |
+ true | +
| userRef | +object | +
+ UserRef is a reference to the User that is a member of the Group.
+User is a cluster-scoped resource. + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name is the name of the Group being referenced. + |
+ true | +
| namespace | +string | +
+ Namespace of the referenced Group. + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| name | +string | +
+ Name is the name of the User being referenced. + |
+ true | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| conditions | +[]object | +
+ Conditions represent the latest available observations of an object's current state. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| lastTransitionTime | +string | +
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + + Format: date-time + |
+ true | +
| message | +string | +
+ message is a human readable message indicating details about the transition.
+This may be an empty string. + |
+ true | +
| reason | +string | +
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+Producers of specific condition types may define expected values and meanings for this field,
+and whether the values are considered a guaranteed API.
+The value should be a CamelCase string.
+This field may not be empty. + |
+ true | +
| status | +enum | +
+ status of the condition, one of True, False, Unknown. + + Enum: True, False, Unknown + |
+ true | +
| type | +string | +
+ type of condition in CamelCase or in foo.example.com/CamelCase. + |
+ true | +
| observedGeneration | +integer | +
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+with respect to the current state of the instance. + + Format: int64 + Minimum: 0 + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| apiVersion | +string | +iam.miloapis.com/v1alpha1 | +true | +
| kind | +string | +Group | +true | +
| metadata | +object | +Refer to the Kubernetes API documentation for the fields of the `metadata` field. | +true | +
| status | +object | +
+ GroupStatus defines the observed state of Group + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| conditions | +[]object | +
+ Conditions represent the latest available observations of an object's current state. + |
+ false | +
| Name | +Type | +Description | +Required | +
|---|---|---|---|
| lastTransitionTime | +string | +
+ lastTransitionTime is the last time the condition transitioned from one status to another.
+This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. + + Format: date-time + |
+ true | +
| message | +string | +
+ message is a human readable message indicating details about the transition.
+This may be an empty string. + |
+ true | +
| reason | +string | +
+ reason contains a programmatic identifier indicating the reason for the condition's last transition.
+Producers of specific condition types may define expected values and meanings for this field,
+and whether the values are considered a guaranteed API.
+The value should be a CamelCase string.
+This field may not be empty. + |
+ true | +
| status | +enum | +
+ status of the condition, one of True, False, Unknown. + + Enum: True, False, Unknown + |
+ true | +
| type | +string | +
+ type of condition in CamelCase or in foo.example.com/CamelCase. + |
+ true | +
| observedGeneration | +integer | +
+ observedGeneration represents the .metadata.generation that the condition was set based upon.
+For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+with respect to the current state of the instance. + + Format: int64 + Minimum: 0 + |
+ false | +
| Name | -Type | -Description | -Required | -
|---|---|---|---|
| kind | -enum | -
- Kind of object being referenced. Values defined in Kind constants. - - Enum: User, Group, ServiceAccount - |
- true | -
| name | -string | -
- Name of the object being referenced. A special group name of
-"system:authenticated-users" can be used to refer to all authenticated
-users. - |
- true | -
| namespace | -string | -
- Namespace of the referenced object.
-If not specified for a Group, User or ServiceAccount, it is ignored. - |
- false | -
| uid | -string | -
- UID of the referenced object. Optional for system groups (groups with names starting with "system:"). - |
- false | -