{
"description": "A databaseuser, managed by the MongoDB Kubernetes Atlas Operator.",
"properties": {
"spec": {
"description": "Specification of the databaseuser supporting the following versions:\n\n- v20250312\n\nAt most one versioned spec can be specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
"properties": {
"connectionSecretRef": {
"description": "SENSITIVE FIELD\n\nReference to a secret containing the credentials to setup the connection to Atlas.",
"properties": {
"name": {
"description": "Name of the secret containing the Atlas credentials.",
"type": "string"
}
},
"type": "object",
"additionalProperties": false
},
"v20250312": {
"description": "The spec of the databaseuser resource for version v20250312.",
"properties": {
"entry": {
"description": "The entry fields of the databaseuser resource spec. These fields can be set for creating and updating databaseusers.",
"properties": {
"awsIAMType": {
"description": "Human-readable label that indicates whether the new database user authenticates with the Amazon Web Services (AWS) Identity and Access Management (IAM) credentials associated with the user or the user's role.",
"type": "string"
},
"databaseName": {
"description": "The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.",
"type": "string"
},
"deleteAfterDate": {
"description": "Date and time when MongoDB Cloud deletes the user. This parameter expresses its value in the ISO 8601 timestamp format in UTC and can include the time zone designation. You must specify a future date that falls within one week of making the Application Programming Interface (API) request.",
"type": "string"
},
"description": {
"description": "Description of this database user.",
"type": "string"
},
"labels": {
"description": "List that contains the key-value pairs for tagging and categorizing the MongoDB database user. The labels that you define do not appear in the console.",
"items": {
"description": "Human-readable labels applied to this MongoDB Cloud component.",
"properties": {
"key": {
"description": "Key applied to tag and categorize this component.",
"type": "string"
},
"value": {
"description": "Value set to the Key applied to tag and categorize this component.",
"type": "string"
}
},
"title": "Component Label",
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"ldapAuthType": {
"description": "Part of the Lightweight Directory Access Protocol (LDAP) record that the database uses to authenticate this database user on the LDAP host.",
"type": "string"
},
"oidcAuthType": {
"description": "Human-readable label that indicates whether the new database user or group authenticates with OIDC federated authentication. To create a federated authentication user, specify the value of USER in this field. To create a federated authentication group, specify the value of `IDP_GROUP` in this field.",
"type": "string"
},
"passwordSecretRef": {
"description": "SENSITIVE FIELD\n\nReference to a secret containing data for the \"password\" field:\n\nAlphanumeric string that authenticates this database user against the database specified in `databaseName`. To authenticate with SCRAM-SHA, you must specify this parameter. This parameter doesn't appear in this response.",
"properties": {
"key": {
"default": "password",
"description": "Key of the secret data containing the sensitive field value, defaults to \"password\".",
"type": "string"
},
"name": {
"description": "Name of the secret containing the sensitive field value.",
"type": "string"
}
},
"required": [
"name"
],
"type": "object",
"additionalProperties": false
},
"roles": {
"description": "List that provides the pairings of one role with one applicable database.",
"items": {
"description": "Range of resources available to this database user.",
"properties": {
"collectionName": {
"description": "Collection on which this role applies.",
"type": "string"
},
"databaseName": {
"description": "Database to which the user is granted access privileges.",
"type": "string"
},
"roleName": {
"description": "Human-readable label that identifies a group of privileges assigned to a database user. This value can either be a built-in role or a custom role.",
"type": "string"
}
},
"required": [
"databaseName",
"roleName"
],
"title": "Database User Role",
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"scopes": {
"description": "List that contains clusters, MongoDB Atlas Data Lakes, and MongoDB Atlas Streams Workspaces that this database user can access. If omitted, MongoDB Cloud grants the database user access to all the clusters, MongoDB Atlas Data Lakes, and MongoDB Atlas Streams Workspaces in the project.",
"items": {
"description": "Range of resources available to this database user.",
"properties": {
"name": {
"description": "Human-readable label that identifies the cluster or MongoDB Atlas Data Lake that this database user can access.",
"type": "string"
},
"type": {
"description": "Category of resource that this database user can access.",
"type": "string"
}
},
"required": [
"name",
"type"
],
"title": "Database User Scope",
"type": "object",
"additionalProperties": false
},
"type": "array"
},
"username": {
"description": "Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:\n\n| Authentication Method | Parameter Needed | Parameter Value | username Format |\n|---|---|---|---|\n| AWS IAM | `awsIAMType` | `ROLE` | ARN |\n| AWS IAM | `awsIAMType` | `USER` | ARN |\n| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP group name |\n| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP user name |\n| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |\n",
"type": "string"
},
"x509Type": {
"description": "X.509 method that MongoDB Cloud uses to authenticate the database user.\n\n- For application-managed X.509, specify `MANAGED`.\n- For self-managed X.509, specify `CUSTOMER`.\n\nUsers created with the `CUSTOMER` method require a Common Name (CN) in the **username** parameter. You must create externally authenticated users on the `$external` database.",
"type": "string"
}
},
"required": [
"databaseName",
"roles",
"username"
],
"type": "object",
"additionalProperties": false
},
"groupId": {
"description": "Unique 24-hexadecimal digit string that identifies your project. Use the [/groups](#tag/Projects/operation/listProjects) endpoint to retrieve all projects to which the authenticated user has access.\n\n**NOTE**: Groups and projects are synonymous terms. Your group id is the same as your project id. For existing groups, your group/project id remains the same. The resource and corresponding endpoints use the term groups.",
"example": "32b6e34b3d91647abb20e7b8",
"type": "string",
"x-kubernetes-validations": [
{
"message": "groupId cannot be modified after creation",
"rule": "self == oldSelf"
}
]
},
"groupRef": {
"description": "A reference to a \"Group\" resource.\nThe value of \"$.status.v20250312.id\" will be used to set \"groupId\".\nMutually exclusive with the \"groupId\" property.",
"properties": {
"name": {
"description": "Name of the \"Group\" resource.",
"type": "string"
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object",
"x-kubernetes-validations": [
{
"message": "groupId and groupRef are mutually exclusive; only one of them can be set",
"rule": "(has(self.groupId) && !has(self.groupRef)) || (!has(self.groupId) && has(self.groupRef))"
}
],
"additionalProperties": false
}
},
"type": "object",
"x-kubernetes-validations": [
{
"message": "spec.connectionSecretRef must be set if spec.v20250312.groupId is set.",
"rule": "(has(self.v20250312.groupId) && has(self.connectionSecretRef)) || (!has(self.v20250312.groupId))"
}
],
"additionalProperties": false
},
"status": {
"description": "Most recently observed read-only status of the databaseuser for the specified resource version. This data may not be up to date and is populated by the system. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status",
"properties": {
"conditions": {
"description": "Represents the latest available observations of a resource's current state.",
"items": {
"properties": {
"lastTransitionTime": {
"description": "Last time the condition transitioned from one status to another.",
"format": "date-time",
"type": "string"
},
"message": {
"description": "A human readable message indicating details about the transition.",
"type": "string"
},
"observedGeneration": {
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.",
"type": "integer"
},
"reason": {
"description": "The reason for the condition's last transition.",
"type": "string"
},
"status": {
"description": "Status of the condition, one of True, False, Unknown.",
"type": "string"
},
"type": {
"description": "Type of condition.",
"type": "string"
}
},
"required": [
"type",
"status"
],
"type": "object",
"additionalProperties": false
},
"type": "array",
"x-kubernetes-list-map-keys": [
"type"
],
"x-kubernetes-list-type": "map"
},
"v20250312": {
"description": "The last observed Atlas state of the databaseuser resource for version v20250312.",
"properties": {
"databaseName": {
"description": "The database against which the database user authenticates. Database users must provide both a username and authentication database to log into MongoDB. If the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be `$external`. If the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be `admin`.",
"type": "string"
},
"groupId": {
"description": "Unique 24-hexadecimal digit string that identifies the project.",
"type": "string"
},
"username": {
"description": "Human-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:\n\n| Authentication Method | Parameter Needed | Parameter Value | username Format |\n|---|---|---|---|\n| AWS IAM | `awsIAMType` | `ROLE` | ARN |\n| AWS IAM | `awsIAMType` | `USER` | ARN |\n| x.509 | `x509Type` | `CUSTOMER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| x.509 | `x509Type` | `MANAGED` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| LDAP | `ldapAuthType` | `USER` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| LDAP | `ldapAuthType` | `GROUP` | [RFC 2253](https://tools.ietf.org/html/2253) Distinguished Name |\n| OIDC Workforce | `oidcAuthType` | `IDP_GROUP` | Atlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP group name |\n| OIDC Workload | `oidcAuthType` | `USER` | Atlas OIDC IdP ID (found in federation settings), followed by a '/', followed by the IdP user name |\n| SCRAM-SHA | `awsIAMType`, `x509Type`, `ldapAuthType`, `oidcAuthType` | `NONE` | Alphanumeric string |\n",
"type": "string"
}
},
"required": [
"databaseName",
"groupId",
"username"
],
"type": "object",
"additionalProperties": false
}
},
"type": "object",
"additionalProperties": false
}
},
"type": "object"
}