{
  "description": "AIStoreAuthProfile defines trusted authentication provider endpoint configuration.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "AIStoreAuthProfileSpec defines trusted authentication provider endpoint configuration.\nExactly one of UsernamePassword or TokenExchange must be specified.",
      "properties": {
        "serviceURL": {
          "description": "ServiceURL is the trusted authentication provider base URL (scheme + host + optional port, no path).",
          "minLength": 1,
          "type": "string"
        },
        "tls": {
          "description": "TLS configuration for connections to the authentication provider.",
          "properties": {
            "caConfigMapRef": {
              "description": "CAConfigMapRef references a ConfigMap containing a PEM CA certificate.",
              "properties": {
                "key": {
                  "description": "Key within the ConfigMap data containing the PEM certificate.",
                  "minLength": 1,
                  "type": "string"
                },
                "name": {
                  "description": "Name of the ConfigMap.",
                  "minLength": 1,
                  "type": "string"
                },
                "namespace": {
                  "description": "Namespace of the ConfigMap.",
                  "minLength": 1,
                  "type": "string"
                }
              },
              "required": [
                "key",
                "name",
                "namespace"
              ],
              "type": "object",
              "additionalProperties": false
            },
            "insecureSkipVerify": {
              "description": "InsecureSkipVerify disables TLS certificate verification (not recommended for production).",
              "type": "boolean"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "tokenExchange": {
          "description": "TokenExchange configures RFC 8693 token exchange.",
          "properties": {
            "endpoint": {
              "default": "/token",
              "description": "Endpoint is the authentication provider token exchange path.\nIf not specified, defaults to \"/token\".",
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "usernamePassword": {
          "description": "UsernamePassword configures static credential login against the authentication provider.",
          "properties": {
            "loginConf": {
              "description": "LoginConf contains OAuth 2.0 password-grant login details for the authentication provider.",
              "properties": {
                "clientID": {
                  "description": "ClientID serves as a public identifier for the client to pass to the auth provider",
                  "minLength": 1,
                  "type": "string"
                },
                "scope": {
                  "description": "Scope passed to the auth provider contains a space-delimited string listing permissions requested",
                  "type": "string"
                }
              },
              "required": [
                "clientID"
              ],
              "type": "object",
              "additionalProperties": false
            },
            "secret": {
              "description": "Secret references the K8s Secret containing auth provider admin credentials.",
              "properties": {
                "name": {
                  "description": "Name is the name of the Secret.",
                  "minLength": 1,
                  "type": "string"
                },
                "namespace": {
                  "description": "Namespace is the namespace of the Secret.",
                  "minLength": 1,
                  "type": "string"
                },
                "passKey": {
                  "description": "PassKey defines the Secret key for the password the client will use for login.\nDefaults to SU-PASS to match AuthN default admin secret format.",
                  "type": "string"
                },
                "userKey": {
                  "description": "UserKey defines the Secret key for the username the client will use for login.\nDefaults to SU-NAME to match AuthN default admin secret format.",
                  "type": "string"
                }
              },
              "required": [
                "name",
                "namespace"
              ],
              "type": "object",
              "additionalProperties": false
            }
          },
          "required": [
            "secret"
          ],
          "type": "object",
          "additionalProperties": false
        }
      },
      "required": [
        "serviceURL"
      ],
      "type": "object",
      "x-kubernetes-validations": [
        {
          "message": "exactly one of usernamePassword or tokenExchange must be specified",
          "rule": "has(self.usernamePassword) != has(self.tokenExchange)"
        }
      ],
      "additionalProperties": false
    }
  },
  "type": "object"
}