{
  "description": "Tenant is the Schema for the tenants API",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "TenantSpec defines the desired state of Tenant",
      "properties": {
        "groups": {
          "items": {
            "description": "Group defines the state of group",
            "properties": {
              "desc": {
                "type": "string"
              },
              "name": {
                "type": "string"
              },
              "secretEngine": {
                "description": "SecretEngine defines the state of vault secret engine",
                "properties": {
                  "kind": {
                    "type": "string"
                  },
                  "path": {
                    "type": "string"
                  }
                },
                "type": "object",
                "additionalProperties": false
              },
              "users": {
                "items": {
                  "type": "string"
                },
                "type": "array"
              }
            },
            "required": [
              "name",
              "users"
            ],
            "type": "object",
            "additionalProperties": false
          },
          "type": "array"
        },
        "secretOperator": {
          "description": "SecretOperator defines the desired state of SecretOperator",
          "properties": {
            "enabled": {
              "type": "boolean"
            },
            "secrets": {
              "items": {
                "description": "SecretIO defines the list of secrets in the tenant cluster",
                "properties": {
                  "input": {
                    "description": "Secret defines secret properties",
                    "properties": {
                      "config": {
                        "description": "SecretConfig reserves for now",
                        "type": "object"
                      },
                      "name": {
                        "type": "string"
                      },
                      "namespace": {
                        "type": "string"
                      },
                      "namespaceSelector": {
                        "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
                        "properties": {
                          "matchExpressions": {
                            "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
                            "items": {
                              "description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
                              "properties": {
                                "key": {
                                  "description": "key is the label key that the selector applies to.",
                                  "type": "string"
                                },
                                "operator": {
                                  "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
                                  "type": "string"
                                },
                                "values": {
                                  "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
                                  "items": {
                                    "type": "string"
                                  },
                                  "type": "array"
                                }
                              },
                              "required": [
                                "key",
                                "operator"
                              ],
                              "type": "object",
                              "additionalProperties": false
                            },
                            "type": "array"
                          },
                          "matchLabels": {
                            "additionalProperties": {
                              "type": "string"
                            },
                            "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
                            "type": "object"
                          }
                        },
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": {
                        "type": "string"
                      }
                    },
                    "required": [
                      "name",
                      "type"
                    ],
                    "type": "object",
                    "additionalProperties": false
                  },
                  "output": {
                    "description": "Secret defines secret properties",
                    "properties": {
                      "config": {
                        "description": "SecretConfig reserves for now",
                        "type": "object"
                      },
                      "name": {
                        "type": "string"
                      },
                      "namespace": {
                        "type": "string"
                      },
                      "namespaceSelector": {
                        "description": "A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.",
                        "properties": {
                          "matchExpressions": {
                            "description": "matchExpressions is a list of label selector requirements. The requirements are ANDed.",
                            "items": {
                              "description": "A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.",
                              "properties": {
                                "key": {
                                  "description": "key is the label key that the selector applies to.",
                                  "type": "string"
                                },
                                "operator": {
                                  "description": "operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.",
                                  "type": "string"
                                },
                                "values": {
                                  "description": "values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.",
                                  "items": {
                                    "type": "string"
                                  },
                                  "type": "array"
                                }
                              },
                              "required": [
                                "key",
                                "operator"
                              ],
                              "type": "object",
                              "additionalProperties": false
                            },
                            "type": "array"
                          },
                          "matchLabels": {
                            "additionalProperties": {
                              "type": "string"
                            },
                            "description": "matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed.",
                            "type": "object"
                          }
                        },
                        "type": "object",
                        "additionalProperties": false
                      },
                      "type": {
                        "type": "string"
                      }
                    },
                    "required": [
                      "name",
                      "type"
                    ],
                    "type": "object",
                    "additionalProperties": false
                  }
                },
                "required": [
                  "input",
                  "output"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "type": "array"
            }
          },
          "required": [
            "enabled",
            "secrets"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "services": {
          "description": "Services includes services",
          "properties": {
            "sso": {
              "description": "SSO defines the state of IdP server",
              "properties": {
                "defaultRealm": {
                  "type": "string"
                },
                "enabled": {
                  "type": "boolean"
                },
                "endpoint": {
                  "description": "Endpoint defines the connection string for endpoint",
                  "properties": {
                    "password": {
                      "type": "string"
                    },
                    "token": {
                      "type": "string"
                    },
                    "url": {
                      "type": "string"
                    },
                    "username": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ],
                  "type": "object",
                  "additionalProperties": false
                }
              },
              "required": [
                "defaultRealm",
                "endpoint"
              ],
              "type": "object",
              "additionalProperties": false
            },
            "vault": {
              "description": "Vault defines the state of vault server",
              "properties": {
                "defaultEngine": {
                  "type": "string"
                },
                "enabled": {
                  "type": "boolean"
                },
                "endpoint": {
                  "description": "Endpoint defines the connection string for endpoint",
                  "properties": {
                    "password": {
                      "type": "string"
                    },
                    "token": {
                      "type": "string"
                    },
                    "url": {
                      "type": "string"
                    },
                    "username": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "url"
                  ],
                  "type": "object",
                  "additionalProperties": false
                },
                "path": {
                  "type": "string"
                },
                "ssoAccessorID": {
                  "type": "string"
                },
                "ssoClientName": {
                  "type": "string"
                }
              },
              "required": [
                "defaultEngine",
                "endpoint",
                "ssoAccessorID"
              ],
              "type": "object",
              "additionalProperties": false
            }
          },
          "type": "object",
          "additionalProperties": false
        }
      },
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "TenantStatus defines the observed state of Tenant",
      "type": "object"
    }
  },
  "type": "object"
}