---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: meshidentities.kuma.io
spec:
  group: kuma.io
  names:
    categories:
    - kuma
    kind: MeshIdentity
    listKind: MeshIdentityList
    plural: meshidentities
    shortNames:
    - mid
    singular: meshidentity
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: MeshIdentity manages service identity and certificate provisioning
          for workloads in the mesh. It configures how services obtain their identity
          certificates, supporting multiple providers including bundled certificates
          (self-signed or user-provided CA), SPIRE integration, and custom SPIFFE
          ID configuration for secure service-to-service authentication.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: Spec is the specification of the Kuma MeshIdentity resource.
            properties:
              provider:
                properties:
                  bundled:
                    description: |-
                      Bundled provides information about certificates that are generated by the control plane,
                      either autogenerated or provided by the user.
                    properties:
                      autogenerate:
                        description: Autogenerate configures the control plane to
                          use self-signed certificates.
                        properties:
                          enabled:
                            type: boolean
                        type: object
                      ca:
                        description: CA has configuration related to the CA
                        properties:
                          certificate:
                            description: Certificate allows the user to specify a
                              custom certificate.
                            properties:
                              envVar:
                                properties:
                                  name:
                                    type: string
                                required:
                                - name
                                type: object
                              file:
                                properties:
                                  path:
                                    type: string
                                required:
                                - path
                                type: object
                              insecureInline:
                                properties:
                                  value:
                                    type: string
                                required:
                                - value
                                type: object
                              secretRef:
                                properties:
                                  kind:
                                    enum:
                                    - Secret
                                    type: string
                                  name:
                                    type: string
                                required:
                                - kind
                                - name
                                type: object
                              type:
                                enum:
                                - File
                                - Secret
                                - EnvVar
                                - InsecureInline
                                type: string
                            required:
                            - type
                            type: object
                          privateKey:
                            description: PrivateKey allows the user to specify a custom
                              private key.
                            properties:
                              envVar:
                                properties:
                                  name:
                                    type: string
                                required:
                                - name
                                type: object
                              file:
                                properties:
                                  path:
                                    type: string
                                required:
                                - path
                                type: object
                              insecureInline:
                                properties:
                                  value:
                                    type: string
                                required:
                                - value
                                type: object
                              secretRef:
                                properties:
                                  kind:
                                    enum:
                                    - Secret
                                    type: string
                                  name:
                                    type: string
                                required:
                                - kind
                                - name
                                type: object
                              type:
                                enum:
                                - File
                                - Secret
                                - EnvVar
                                - InsecureInline
                                type: string
                            required:
                            - type
                            type: object
                        type: object
                      certificateParameters:
                        description: CertificateParameters allows users to define
                          certificate generation parameters.
                        properties:
                          expiry:
                            type: string
                        type: object
                      insecureAllowSelfSigned:
                        description: InsecureAllowSelfSigned allows users to enable
                          the use of self-signed certificates.
                        type: boolean
                      meshTrustCreation:
                        description: |-
                          MeshTrustCreation defines whether a MeshTrust resource should be automatically created
                          from an existing MeshIdentity. If not defined, the control plane automatically generates a MeshTrust.
                        enum:
                        - Enabled
                        - Disabled
                        type: string
                    type: object
                  spire:
                    description: Spire indicates that SPIRE is used for certificate
                      delivery.
                    properties:
                      agent:
                        description: Spire agent configuration
                        properties:
                          timeout:
                            description: |-
                              Connection timeout to the socket exposed by Spire agent
                              Default 1 second.
                            type: string
                        type: object
                    type: object
                  type:
                    description: Type specifies the type of certificate provider.
                    enum:
                    - Bundled
                    - Spire
                    type: string
                required:
                - type
                type: object
              selector:
                properties:
                  dataplane:
                    properties:
                      matchLabels:
                        additionalProperties:
                          type: string
                        type: object
                    type: object
                type: object
              spiffeID:
                properties:
                  path:
                    type: string
                  trustDomain:
                    type: string
                type: object
            type: object
          status:
            description: Status is the current status of the Kuma MeshIdentity resource.
            properties:
              conditions:
                description: Conditions is an array of hostname generator conditions.
                items:
                  properties:
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
                x-kubernetes-list-map-keys:
                - type
                x-kubernetes-list-type: map
            type: object
        type: object
    served: true
    storage: true
