{ "description": "AtlasDatabaseUser is the Schema for the Atlas Database User API", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "AtlasDatabaseUserSpec defines the target state of Database User in Atlas", "properties": { "awsIamType": { "default": "NONE", "description": "Human-readable label that indicates whether the new database user authenticates with Amazon Web Services (AWS).\nIdentity and Access Management (IAM) credentials associated with the user or the user's role", "enum": [ "NONE", "USER", "ROLE" ], "type": "string" }, "connectionSecret": { "description": "Name of the secret containing Atlas API private and public keys.", "properties": { "name": { "description": "Name of the resource being referred to\nMore info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "databaseName": { "default": "admin", "description": "DatabaseName is a Database against which Atlas authenticates the user.\nIf the user authenticates with AWS IAM, x.509, LDAP, or OIDC Workload this value should be '$external'.\nIf the user authenticates with SCRAM-SHA or OIDC Workforce, this value should be 'admin'.\nDefault value is 'admin'.", "type": "string" }, "deleteAfterDate": { "description": "DeleteAfterDate is a timestamp in ISO 8601 date and time format in UTC after which Atlas deletes the user.\nThe specified date must be in the future and within one week.", "type": "string" }, "description": { "description": "Description of this database user. Maximum 100 characters.", "maxLength": 100, "type": "string" }, "externalProjectRef": { "description": "externalProjectRef holds the parent Atlas project ID.\nMutually exclusive with the \"projectRef\" field.", "properties": { "id": { "description": "ID is the Atlas project ID.", "type": "string" } }, "required": [ "id" ], "type": "object", "additionalProperties": false }, "labels": { "description": "Labels is an array containing key-value pairs that tag and categorize the database user.\nEach key and value has a maximum length of 255 characters.", "items": { "description": "LabelSpec contains key-value pairs that tag and categorize the Cluster/DBUser", "properties": { "key": { "description": "Key applied to tag and categorize this component.", "maxLength": 255, "type": "string" }, "value": { "description": "Value set to the Key applied to tag and categorize this component.", "type": "string" } }, "required": [ "key", "value" ], "type": "object", "additionalProperties": false }, "type": "array" }, "oidcAuthType": { "default": "NONE", "description": "Human-readable label that indicates whether the new database Username with OIDC federated authentication.\nTo create a federated authentication group (Workforce), specify the value of IDP_GROUP in this field.\nTo create a federated authentication user (Workload), specify the value of USER in this field.", "enum": [ "NONE", "IDP_GROUP", "USER" ], "type": "string" }, "passwordSecretRef": { "description": "PasswordSecret is a reference to the Secret keeping the user password.", "properties": { "name": { "description": "Name is the name of the Kubernetes Resource", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "projectRef": { "description": "projectRef is a reference to the parent AtlasProject resource.\nMutually exclusive with the \"externalProjectRef\" field.", "properties": { "name": { "description": "Name of the Kubernetes Resource", "type": "string" }, "namespace": { "description": "Namespace of the Kubernetes Resource", "type": "string" } }, "required": [ "name" ], "type": "object", "additionalProperties": false }, "roles": { "description": "Roles is an array of this user's roles and the databases / collections on which the roles apply. A role allows\nthe user to perform particular actions on the specified database.", "items": { "description": "RoleSpec allows the user to perform particular actions on the specified database.\nA role on the admin database can include privileges that apply to the other databases as well.", "properties": { "collectionName": { "description": "CollectionName is a collection for which the role applies.", "type": "string" }, "databaseName": { "description": "DatabaseName is a database on which the user has the specified role. A role on the admin database can include\nprivileges that apply to the other databases.", "type": "string" }, "roleName": { "description": "RoleName is a name of the role. This value can either be a built-in role or a custom role.", "type": "string" } }, "required": [ "databaseName", "roleName" ], "type": "object", "additionalProperties": false }, "minItems": 1, "type": "array" }, "scopes": { "description": "Scopes is an array of clusters and Atlas Data Lakes that this user has access to.", "items": { "description": "ScopeSpec if present a database user only have access to the indicated resource (Cluster or Atlas Data Lake)\nif none is given then it has access to all.\nIt's highly recommended to restrict the access of the database users only to a limited set of resources.", "properties": { "name": { "description": "Name is a name of the cluster or Atlas Data Lake that the user has access to.", "type": "string" }, "type": { "description": "Type is a type of resource that the user has access to.", "enum": [ "CLUSTER", "DATA_LAKE" ], "type": "string" } }, "required": [ "name", "type" ], "type": "object", "additionalProperties": false }, "type": "array" }, "username": { "description": "Username is a username for authenticating to MongoDB\nHuman-readable label that represents the user that authenticates to MongoDB. The format of this label depends on the method of authentication:\nIn case of AWS IAM: the value should be AWS ARN for the IAM User/Role;\nIn case of OIDC Workload or Workforce: the value should be the Atlas OIDC IdP ID, followed by a '/', followed by the IdP group name;\nIn case of Plain text auth: the value can be anything.", "maxLength": 1024, "type": "string" }, "x509Type": { "default": "NONE", "description": "X509Type is X.509 method by which the database authenticates the provided username.", "enum": [ "NONE", "MANAGED", "CUSTOMER" ], "type": "string" } }, "required": [ "roles", "username" ], "type": "object", "x-kubernetes-validations": [ { "message": "must define only one project reference through externalProjectRef or projectRef", "rule": "(has(self.externalProjectRef) && !has(self.projectRef)) || (!has(self.externalProjectRef) && has(self.projectRef))" }, { "message": "must define a local connection secret when referencing an external project", "rule": "(has(self.externalProjectRef) && has(self.connectionSecret)) || !has(self.externalProjectRef)" } ], "additionalProperties": false }, "status": { "description": "AtlasDatabaseUserStatus defines the observed state of AtlasProject", "properties": { "conditions": { "description": "Conditions is the list of statuses showing the current state of the Atlas Custom Resource", "items": { "description": "Condition describes the state of an Atlas Custom Resource at a certain point.", "properties": { "lastTransitionTime": { "description": "Last time the condition transitioned from one status to another.\nRepresented in ISO 8601 format.", "format": "date-time", "type": "string" }, "message": { "description": "A message providing details about the transition.", "type": "string" }, "reason": { "description": "The reason for the condition's last transition.", "type": "string" }, "status": { "description": "Status of the condition; one of True, False, Unknown.", "type": "string" }, "type": { "description": "Type of Atlas Custom Resource condition.", "type": "string" } }, "required": [ "status", "type" ], "type": "object", "additionalProperties": false }, "type": "array" }, "name": { "description": "UserName is the current name of database user.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration indicates the generation of the resource specification of which the Atlas Operator is aware.\nThe Atlas Operator updates this field to the value of 'metadata.generation' as soon as it starts reconciliation of the resource.", "format": "int64", "type": "integer" }, "passwordVersion": { "description": "PasswordVersion is the 'ResourceVersion' of the password Secret that the Atlas Operator is aware of", "type": "string" } }, "required": [ "conditions" ], "type": "object", "additionalProperties": false } }, "type": "object" }