{ "description": "OpenSearch is the Schema for the opensearches API.\nInfo \"Exposes secret keys\": `OPENSEARCH_HOST`, `OPENSEARCH_PORT`, `OPENSEARCH_USER`, `OPENSEARCH_PASSWORD`", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "OpenSearchSpec defines the desired state of OpenSearch", "properties": { "authSecretRef": { "description": "Authentication reference to Aiven token in a secret", "properties": { "key": { "minLength": 1, "type": "string" }, "name": { "minLength": 1, "type": "string" } }, "required": [ "key", "name" ], "type": "object", "additionalProperties": false }, "cloudName": { "description": "Cloud the service runs in.", "maxLength": 256, "type": "string" }, "connInfoSecretTarget": { "description": "Secret configuration.", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Annotations added to the secret", "type": "object", "x-kubernetes-preserve-unknown-fields": true }, "labels": { "additionalProperties": { "type": "string" }, "description": "Labels added to the secret", "type": "object", "x-kubernetes-preserve-unknown-fields": true }, "name": { "description": "Name of the secret resource to be created. By default, it is equal to the resource name", "type": "string", "x-kubernetes-validations": [ { "message": "Value is immutable", "rule": "self == oldSelf" } ] }, "prefix": { "description": "Prefix for the secret's keys.\nAdded \"as is\" without any transformations.\nBy default, is equal to the kind name in uppercase + underscore, e.g. `KAFKA_`, `REDIS_`, etc.", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "connInfoSecretTargetDisabled": { "description": "When true, the secret containing connection information will not be created, defaults to false. This field cannot be changed after resource creation.", "type": "boolean", "x-kubernetes-validations": [ { "message": "connInfoSecretTargetDisabled is immutable.", "rule": "self == oldSelf" } ] }, "disk_space": { "description": "The disk space of the service, possible values depend on the service type, the cloud provider and the project.\nReducing will result in the service re-balancing.\nThe removal of this field does not change the value.", "pattern": "(?i)^[1-9][0-9]*(GiB|G)?$", "type": "string" }, "maintenanceWindowDow": { "description": "Day of week when maintenance operations should be performed. One monday, tuesday, wednesday, etc.", "enum": [ "monday", "tuesday", "wednesday", "thursday", "friday", "saturday", "sunday" ], "type": "string" }, "maintenanceWindowTime": { "description": "Time of day when maintenance operations should be performed. UTC time in HH:mm:ss format.", "maxLength": 8, "type": "string" }, "plan": { "description": "Subscription plan.", "maxLength": 128, "type": "string" }, "project": { "description": "Identifies the project this resource belongs to", "maxLength": 63, "pattern": "^[a-zA-Z0-9_-]+$", "type": "string", "x-kubernetes-validations": [ { "message": "Value is immutable", "rule": "self == oldSelf" } ] }, "projectVPCRef": { "description": "ProjectVPCRef reference to ProjectVPC resource to use its ID as ProjectVPCID automatically", "properties": { "name": { "minLength": 1, "type": "string" }, "namespace": { "minLength": 1, "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "projectVpcId": { "description": "Identifier of the VPC the service should be in, if any.", "maxLength": 36, "type": "string" }, "serviceIntegrations": { "description": "Service integrations to specify when creating a service. Not applied after initial service creation", "items": { "description": "Service integrations to specify when creating a service. Not applied after initial service creation", "properties": { "integrationType": { "enum": [ "read_replica" ], "type": "string" }, "sourceServiceName": { "maxLength": 64, "minLength": 1, "type": "string" } }, "required": [ "integrationType", "sourceServiceName" ], "type": "object", "additionalProperties": false }, "maxItems": 1, "type": "array", "x-kubernetes-validations": [ { "message": "Value is immutable", "rule": "self == oldSelf" } ] }, "tags": { "additionalProperties": { "type": "string" }, "description": "Tags are key-value pairs that allow you to categorize services.", "type": "object" }, "technicalEmails": { "description": "Defines the email addresses that will receive alerts about upcoming maintenance updates or warnings about service instability.", "items": { "properties": { "email": { "description": "Email address.", "pattern": "^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$", "type": "string" } }, "required": [ "email" ], "type": "object", "additionalProperties": false }, "maxItems": 10, "type": "array" }, "terminationProtection": { "description": "Prevent service from being deleted. It is recommended to have this enabled for all services.", "type": "boolean" }, "userConfig": { "description": "OpenSearch specific user configuration options", "properties": { "additional_backup_regions": { "description": "Additional Cloud Regions for Backup Replication", "items": { "type": "string" }, "maxItems": 1, "type": "array" }, "custom_domain": { "description": "Serve the web frontend using a custom CNAME pointing to the Aiven DNS name", "maxLength": 255, "type": "string" }, "disable_replication_factor_adjustment": { "description": "DEPRECATED: Disable automatic replication factor adjustment for multi-node services. By default, Aiven ensures all indexes are replicated at least to two nodes. Note: Due to potential data loss in case of losing a service node, this setting can no longer be activated.", "type": "boolean" }, "index_patterns": { "description": "Index patterns", "items": { "description": "Allows you to create glob style patterns and set a max number of indexes matching this pattern you want to keep. Creating indexes exceeding this value will cause the oldest one to get deleted. You could for example create a pattern looking like 'logs.?' and then create index logs.1, logs.2 etc, it will delete logs.1 once you create logs.6. Do note 'logs.?' does not apply to logs.10. Note: Setting max_index_count to 0 will do nothing and the pattern gets ignored.", "properties": { "max_index_count": { "description": "Maximum number of indexes to keep", "minimum": 0, "type": "integer" }, "pattern": { "description": "fnmatch pattern", "maxLength": 1024, "pattern": "^[A-Za-z0-9-_.*?]+$", "type": "string" }, "sorting_algorithm": { "description": "Deletion sorting algorithm", "enum": [ "alphabetical", "creation_date" ], "type": "string" } }, "required": [ "max_index_count", "pattern" ], "type": "object", "additionalProperties": false }, "maxItems": 512, "type": "array" }, "index_template": { "description": "Template settings for all new indexes", "properties": { "mapping_nested_objects_limit": { "description": "The maximum number of nested JSON objects that a single document can contain across all nested types. This limit helps to prevent out of memory errors when a document contains too many nested objects. Default is 10000.", "maximum": 100000, "minimum": 0, "type": "integer" }, "number_of_replicas": { "description": "The number of replicas each primary shard has.", "maximum": 29, "minimum": 0, "type": "integer" }, "number_of_shards": { "description": "The number of primary shards that an index should have.", "maximum": 1024, "minimum": 1, "type": "integer" } }, "type": "object", "additionalProperties": false }, "ip_filter": { "description": "Allow incoming connections from CIDR address block, e.g. '10.20.0.0/16'", "items": { "description": "CIDR address block, either as a string, or in a dict with an optional description field", "properties": { "description": { "description": "Description for IP filter list entry", "maxLength": 1024, "type": "string" }, "network": { "description": "CIDR address block", "maxLength": 43, "type": "string" } }, "required": [ "network" ], "type": "object", "additionalProperties": false }, "maxItems": 1024, "type": "array" }, "keep_index_refresh_interval": { "description": "Aiven automation resets index.refresh_interval to default value for every index to be sure that indices are always visible to search. If it doesn't fit your case, you can disable this by setting up this flag to true.", "type": "boolean" }, "max_index_count": { "description": "DEPRECATED: use index_patterns instead", "minimum": 0, "type": "integer" }, "openid": { "description": "OpenSearch OpenID Connect Configuration", "properties": { "client_id": { "description": "The ID of the OpenID Connect client configured in your IdP. Required.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "client_secret": { "description": "The client secret of the OpenID Connect client configured in your IdP. Required.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "connect_url": { "description": "The URL of your IdP where the Security plugin can find the OpenID Connect metadata/configuration settings.", "maxLength": 2048, "type": "string" }, "enabled": { "description": "Enables or disables OpenID Connect authentication for OpenSearch. When enabled, users can authenticate using OpenID Connect with an Identity Provider.", "type": "boolean" }, "header": { "description": "HTTP header name of the JWT token. Optional. Default is Authorization.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "jwt_header": { "description": "The HTTP header that stores the token. Typically the Authorization header with the Bearer schema: Authorization: Bearer . Optional. Default is Authorization.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "jwt_url_parameter": { "description": "If the token is not transmitted in the HTTP header, but as an URL parameter, define the name of the parameter here. Optional.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "refresh_rate_limit_count": { "description": "The maximum number of unknown key IDs in the time frame. Default is 10. Optional.", "minimum": 10, "type": "integer" }, "refresh_rate_limit_time_window_ms": { "description": "The time frame to use when checking the maximum number of unknown key IDs, in milliseconds. Optional.Default is 10000 (10 seconds).", "minimum": 10000, "type": "integer" }, "roles_key": { "description": "The key in the JSON payload that stores the user\u2019s roles. The value of this key must be a comma-separated list of roles. Required only if you want to use roles in the JWT", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "scope": { "description": "The scope of the identity token issued by the IdP. Optional. Default is openid profile email address phone.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "subject_key": { "description": "The key in the JSON payload that stores the user\u2019s name. If not defined, the subject registered claim is used. Most IdP providers use the preferred_username claim. Optional.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" } }, "required": [ "client_id", "client_secret", "connect_url", "enabled" ], "type": "object", "additionalProperties": false }, "opensearch": { "description": "OpenSearch settings", "properties": { "action_auto_create_index_enabled": { "description": "Explicitly allow or block automatic creation of indices. Defaults to true", "type": "boolean" }, "action_destructive_requires_name": { "description": "Require explicit index names when deleting", "type": "boolean" }, "auth_failure_listeners": { "description": "Opensearch Security Plugin Settings", "properties": { "internal_authentication_backend_limiting": { "properties": { "allowed_tries": { "description": "The number of login attempts allowed before login is blocked", "maximum": 2147483647, "minimum": 0, "type": "integer" }, "authentication_backend": { "description": "internal_authentication_backend_limiting.authentication_backend", "enum": [ "internal" ], "maxLength": 1024, "type": "string" }, "block_expiry_seconds": { "description": "The duration of time that login remains blocked after a failed login", "maximum": 2147483647, "minimum": 0, "type": "integer" }, "max_blocked_clients": { "description": "internal_authentication_backend_limiting.max_blocked_clients", "maximum": 2147483647, "minimum": 0, "type": "integer" }, "max_tracked_clients": { "description": "The maximum number of tracked IP addresses that have failed login", "maximum": 2147483647, "minimum": 0, "type": "integer" }, "time_window_seconds": { "description": "The window of time in which the value for `allowed_tries` is enforced", "maximum": 2147483647, "minimum": 0, "type": "integer" }, "type": { "description": "internal_authentication_backend_limiting.type", "enum": [ "username" ], "maxLength": 1024, "type": "string" } }, "type": "object", "additionalProperties": false }, "ip_rate_limiting": { "description": "IP address rate limiting settings", "properties": { "allowed_tries": { "description": "The number of login attempts allowed before login is blocked", "maximum": 2147483647, "minimum": 1, "type": "integer" }, "block_expiry_seconds": { "description": "The duration of time that login remains blocked after a failed login", "maximum": 36000, "minimum": 1, "type": "integer" }, "max_blocked_clients": { "description": "The maximum number of blocked IP addresses", "maximum": 2147483647, "minimum": 0, "type": "integer" }, "max_tracked_clients": { "description": "The maximum number of tracked IP addresses that have failed login", "maximum": 2147483647, "minimum": 0, "type": "integer" }, "time_window_seconds": { "description": "The window of time in which the value for `allowed_tries` is enforced", "maximum": 36000, "minimum": 1, "type": "integer" }, "type": { "description": "The type of rate limiting", "enum": [ "ip" ], "maxLength": 1024, "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "cluster_max_shards_per_node": { "description": "Controls the number of shards allowed in the cluster per data node", "maximum": 10000, "minimum": 100, "type": "integer" }, "cluster_routing_allocation_node_concurrent_recoveries": { "description": "How many concurrent incoming/outgoing shard recoveries (normally replicas) are allowed to happen on a node. Defaults to 2.", "maximum": 16, "minimum": 2, "type": "integer" }, "email_sender_name": { "description": "Sender name placeholder to be used in Opensearch Dashboards and Opensearch keystore", "maxLength": 40, "pattern": "^[a-zA-Z0-9-_]+$", "type": "string" }, "email_sender_password": { "description": "Sender password for Opensearch alerts to authenticate with SMTP server", "maxLength": 1024, "pattern": "^[^\\x00-\\x1F]+$", "type": "string" }, "email_sender_username": { "description": "Sender username for Opensearch alerts", "maxLength": 320, "pattern": "^[^\\x00-\\x1F]+$", "type": "string" }, "enable_security_audit": { "description": "Enable/Disable security audit", "type": "boolean" }, "http_max_content_length": { "description": "Maximum content length for HTTP requests to the OpenSearch HTTP API, in bytes.", "maximum": 2147483647, "minimum": 1, "type": "integer" }, "http_max_header_size": { "description": "The max size of allowed headers, in bytes", "maximum": 262144, "minimum": 1024, "type": "integer" }, "http_max_initial_line_length": { "description": "The max length of an HTTP URL, in bytes", "maximum": 65536, "minimum": 1024, "type": "integer" }, "indices_fielddata_cache_size": { "description": "Relative amount. Maximum amount of heap memory used for field data cache. This is an expert setting; decreasing the value too much will increase overhead of loading field data; too much memory used for field data cache will decrease amount of heap available for other operations.", "maximum": 100, "minimum": 3, "type": "integer" }, "indices_memory_index_buffer_size": { "description": "Percentage value. Default is 10%. Total amount of heap used for indexing buffer, before writing segments to disk. This is an expert setting. Too low value will slow down indexing; too high value will increase indexing performance but causes performance issues for query performance.", "maximum": 40, "minimum": 3, "type": "integer" }, "indices_memory_max_index_buffer_size": { "description": "Absolute value. Default is unbound. Doesn't work without indices.memory.index_buffer_size. Maximum amount of heap used for query cache, an absolute indices.memory.index_buffer_size maximum hard limit.", "maximum": 2048, "minimum": 3, "type": "integer" }, "indices_memory_min_index_buffer_size": { "description": "Absolute value. Default is 48mb. Doesn't work without indices.memory.index_buffer_size. Minimum amount of heap used for query cache, an absolute indices.memory.index_buffer_size minimal hard limit.", "maximum": 2048, "minimum": 3, "type": "integer" }, "indices_queries_cache_size": { "description": "Percentage value. Default is 10%. Maximum amount of heap used for query cache. This is an expert setting. Too low value will decrease query performance and increase performance for other operations; too high value will cause issues with other OpenSearch functionality.", "maximum": 40, "minimum": 3, "type": "integer" }, "indices_query_bool_max_clause_count": { "description": "Maximum number of clauses Lucene BooleanQuery can have. The default value (1024) is relatively high, and increasing it may cause performance issues. Investigate other approaches first before increasing this value.", "maximum": 4096, "minimum": 64, "type": "integer" }, "indices_recovery_max_bytes_per_sec": { "description": "Limits total inbound and outbound recovery traffic for each node. Applies to both peer recoveries as well as snapshot recoveries (i.e., restores from a snapshot). Defaults to 40mb", "maximum": 400, "minimum": 40, "type": "integer" }, "indices_recovery_max_concurrent_file_chunks": { "description": "Number of file chunks sent in parallel for each recovery. Defaults to 2.", "maximum": 5, "minimum": 2, "type": "integer" }, "ism_enabled": { "description": "Specifies whether ISM is enabled or not", "type": "boolean" }, "ism_history_enabled": { "description": "Specifies whether audit history is enabled or not. The logs from ISM are automatically indexed to a logs document.", "type": "boolean" }, "ism_history_max_age": { "description": "The maximum age before rolling over the audit history index in hours", "maximum": 2147483647, "minimum": 1, "type": "integer" }, "ism_history_max_docs": { "description": "The maximum number of documents before rolling over the audit history index.", "minimum": 1, "type": "integer" }, "ism_history_rollover_check_period": { "description": "The time between rollover checks for the audit history index in hours.", "maximum": 2147483647, "minimum": 1, "type": "integer" }, "ism_history_rollover_retention_period": { "description": "How long audit history indices are kept in days.", "maximum": 2147483647, "minimum": 1, "type": "integer" }, "override_main_response_version": { "description": "Compatibility mode sets OpenSearch to report its version as 7.10 so clients continue to work. Default is false", "type": "boolean" }, "plugins_alerting_filter_by_backend_roles": { "description": "Enable or disable filtering of alerting by backend roles. Requires Security plugin. Defaults to false", "type": "boolean" }, "reindex_remote_whitelist": { "description": "Whitelisted addresses for reindexing. Changing this value will cause all OpenSearch instances to restart.", "items": { "type": "string" }, "maxItems": 32, "type": "array" }, "script_max_compilations_rate": { "description": "Script compilation circuit breaker limits the number of inline script compilations within a period of time. Default is use-context", "maxLength": 1024, "type": "string" }, "search_max_buckets": { "description": "Maximum number of aggregation buckets allowed in a single response. OpenSearch default value is used when this is not defined.", "maximum": 1000000, "minimum": 1, "type": "integer" }, "thread_pool_analyze_queue_size": { "description": "Size for the thread pool queue. See documentation for exact details.", "maximum": 2000, "minimum": 10, "type": "integer" }, "thread_pool_analyze_size": { "description": "Size for the thread pool. See documentation for exact details. Do note this may have maximum value depending on CPU count - value is automatically lowered if set to higher than maximum value.", "maximum": 128, "minimum": 1, "type": "integer" }, "thread_pool_force_merge_size": { "description": "Size for the thread pool. See documentation for exact details. Do note this may have maximum value depending on CPU count - value is automatically lowered if set to higher than maximum value.", "maximum": 128, "minimum": 1, "type": "integer" }, "thread_pool_get_queue_size": { "description": "Size for the thread pool queue. See documentation for exact details.", "maximum": 2000, "minimum": 10, "type": "integer" }, "thread_pool_get_size": { "description": "Size for the thread pool. See documentation for exact details. Do note this may have maximum value depending on CPU count - value is automatically lowered if set to higher than maximum value.", "maximum": 128, "minimum": 1, "type": "integer" }, "thread_pool_search_queue_size": { "description": "Size for the thread pool queue. See documentation for exact details.", "maximum": 2000, "minimum": 10, "type": "integer" }, "thread_pool_search_size": { "description": "Size for the thread pool. See documentation for exact details. Do note this may have maximum value depending on CPU count - value is automatically lowered if set to higher than maximum value.", "maximum": 128, "minimum": 1, "type": "integer" }, "thread_pool_search_throttled_queue_size": { "description": "Size for the thread pool queue. See documentation for exact details.", "maximum": 2000, "minimum": 10, "type": "integer" }, "thread_pool_search_throttled_size": { "description": "Size for the thread pool. See documentation for exact details. Do note this may have maximum value depending on CPU count - value is automatically lowered if set to higher than maximum value.", "maximum": 128, "minimum": 1, "type": "integer" }, "thread_pool_write_queue_size": { "description": "Size for the thread pool queue. See documentation for exact details.", "maximum": 2000, "minimum": 10, "type": "integer" }, "thread_pool_write_size": { "description": "Size for the thread pool. See documentation for exact details. Do note this may have maximum value depending on CPU count - value is automatically lowered if set to higher than maximum value.", "maximum": 128, "minimum": 1, "type": "integer" } }, "type": "object", "additionalProperties": false }, "opensearch_dashboards": { "description": "OpenSearch Dashboards settings", "properties": { "enabled": { "description": "Enable or disable OpenSearch Dashboards", "type": "boolean" }, "max_old_space_size": { "description": "Limits the maximum amount of memory (in MiB) the OpenSearch Dashboards process can use. This sets the max_old_space_size option of the nodejs running the OpenSearch Dashboards. Note: the memory reserved by OpenSearch Dashboards is not available for OpenSearch.", "maximum": 2048, "minimum": 64, "type": "integer" }, "opensearch_request_timeout": { "description": "Timeout in milliseconds for requests made by OpenSearch Dashboards towards OpenSearch", "maximum": 120000, "minimum": 5000, "type": "integer" } }, "type": "object", "additionalProperties": false }, "opensearch_version": { "description": "OpenSearch major version", "enum": [ "1", "2" ], "type": "string" }, "private_access": { "description": "Allow access to selected service ports from private networks", "properties": { "opensearch": { "description": "Allow clients to connect to opensearch with a DNS name that always resolves to the service's private IP addresses. Only available in certain network locations", "type": "boolean" }, "opensearch_dashboards": { "description": "Allow clients to connect to opensearch_dashboards with a DNS name that always resolves to the service's private IP addresses. Only available in certain network locations", "type": "boolean" }, "prometheus": { "description": "Allow clients to connect to prometheus with a DNS name that always resolves to the service's private IP addresses. Only available in certain network locations", "type": "boolean" } }, "type": "object", "additionalProperties": false }, "privatelink_access": { "description": "Allow access to selected service components through Privatelink", "properties": { "opensearch": { "description": "Enable opensearch", "type": "boolean" }, "opensearch_dashboards": { "description": "Enable opensearch_dashboards", "type": "boolean" }, "prometheus": { "description": "Enable prometheus", "type": "boolean" } }, "type": "object", "additionalProperties": false }, "project_to_fork_from": { "description": "Name of another project to fork a service from. This has effect only when a new service is being created.", "maxLength": 63, "pattern": "^[a-z][-a-z0-9]{0,63}$|^$", "type": "string", "x-kubernetes-validations": [ { "message": "Value is immutable", "rule": "self == oldSelf" } ] }, "public_access": { "description": "Allow access to selected service ports from the public Internet", "properties": { "opensearch": { "description": "Allow clients to connect to opensearch from the public internet for service nodes that are in a project VPC or another type of private network", "type": "boolean" }, "opensearch_dashboards": { "description": "Allow clients to connect to opensearch_dashboards from the public internet for service nodes that are in a project VPC or another type of private network", "type": "boolean" }, "prometheus": { "description": "Allow clients to connect to prometheus from the public internet for service nodes that are in a project VPC or another type of private network", "type": "boolean" } }, "type": "object", "additionalProperties": false }, "recovery_basebackup_name": { "description": "Name of the basebackup to restore in forked service", "maxLength": 128, "pattern": "^[a-zA-Z0-9-_:.]+$", "type": "string" }, "saml": { "description": "OpenSearch SAML configuration", "properties": { "enabled": { "description": "Enables or disables SAML-based authentication for OpenSearch. When enabled, users can authenticate using SAML with an Identity Provider.", "type": "boolean" }, "idp_entity_id": { "description": "The unique identifier for the Identity Provider (IdP) entity that is used for SAML authentication. This value is typically provided by the IdP.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "idp_metadata_url": { "description": "The URL of the SAML metadata for the Identity Provider (IdP). This is used to configure SAML-based authentication with the IdP.", "maxLength": 2048, "minLength": 1, "type": "string" }, "idp_pemtrustedcas_content": { "description": "This parameter specifies the PEM-encoded root certificate authority (CA) content for the SAML identity provider (IdP) server verification. The root CA content is used to verify the SSL/TLS certificate presented by the server.", "maxLength": 16384, "type": "string" }, "roles_key": { "description": "Optional. Specifies the attribute in the SAML response where role information is stored, if available. Role attributes are not required for SAML authentication, but can be included in SAML assertions by most Identity Providers (IdPs) to determine user access levels or permissions.", "maxLength": 256, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "sp_entity_id": { "description": "The unique identifier for the Service Provider (SP) entity that is used for SAML authentication. This value is typically provided by the SP.", "maxLength": 1024, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" }, "subject_key": { "description": "Optional. Specifies the attribute in the SAML response where the subject identifier is stored. If not configured, the NameID attribute is used by default.", "maxLength": 256, "minLength": 1, "pattern": "^[^\\r\\n]*$", "type": "string" } }, "required": [ "enabled", "idp_entity_id", "idp_metadata_url", "sp_entity_id" ], "type": "object", "additionalProperties": false }, "service_log": { "description": "Store logs for the service so that they are available in the HTTP API and console.", "type": "boolean" }, "service_to_fork_from": { "description": "Name of another service to fork from. This has effect only when a new service is being created.", "maxLength": 64, "pattern": "^[a-z][-a-z0-9]{0,63}$|^$", "type": "string", "x-kubernetes-validations": [ { "message": "Value is immutable", "rule": "self == oldSelf" } ] }, "static_ips": { "description": "Use static public IP addresses", "type": "boolean" } }, "type": "object", "additionalProperties": false } }, "required": [ "plan", "project" ], "type": "object", "x-kubernetes-validations": [ { "message": "connInfoSecretTargetDisabled can only be set during resource creation.", "rule": "has(oldSelf.connInfoSecretTargetDisabled) == has(self.connInfoSecretTargetDisabled)" } ], "additionalProperties": false }, "status": { "description": "ServiceStatus defines the observed state of service", "properties": { "conditions": { "description": "Conditions represent the latest available observations of a service state", "items": { "description": "Condition contains details for one aspect of the current state of this API Resource.\n---\nThis struct is intended for direct use as an array at the field path .status.conditions. For example,\n\n\n\ttype FooStatus struct{\n\t // Represents the observations of a foo's current state.\n\t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t // other fields\n\t}", "properties": { "lastTransitionTime": { "description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.", "format": "date-time", "type": "string" }, "message": { "description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.", "maxLength": 32768, "type": "string" }, "observedGeneration": { "description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.", "format": "int64", "minimum": 0, "type": "integer" }, "reason": { "description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.", "maxLength": 1024, "minLength": 1, "pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$", "type": "string" }, "status": { "description": "status of the condition, one of True, False, Unknown.", "enum": [ "True", "False", "Unknown" ], "type": "string" }, "type": { "description": "type of condition in CamelCase or in foo.example.com/CamelCase.\n---\nMany .condition.type values are consistent across resources like Available, but because arbitrary conditions can be\nuseful (see .node.status.conditions), the ability to deconflict is important.\nThe regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)", "maxLength": 316, "pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$", "type": "string" } }, "required": [ "lastTransitionTime", "message", "reason", "status", "type" ], "type": "object", "additionalProperties": false }, "type": "array" }, "state": { "description": "Service state", "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object" }