mz_cloud_resources/crd/generated/cert_manager/
certificates.rs

1// Copyright Materialize, Inc. and contributors. All rights reserved.
2//
3// Use of this software is governed by the Business Source License
4// included in the LICENSE file.
5//
6// As of the Change Date specified in that file, in accordance with
7// the Business Source License, use of this software will be governed
8// by the Apache License, Version 2.0.
9
10#![allow(rustdoc::all)]
11
12// WARNING: generated by kopium - manual changes will be overwritten
13// kopium command: kopium certificates.cert-manager.io --docs --smart-derive-elision --derive Default --derive PartialEq --derive JsonSchema
14// kopium version: 0.21.1
15
16#[allow(unused_imports)]
17mod prelude {
18    pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
19    pub use kube::CustomResource;
20    pub use schemars::JsonSchema;
21    pub use serde::{Deserialize, Serialize};
22    pub use std::collections::BTreeMap;
23}
24use self::prelude::*;
25
26/// Specification of the desired state of the Certificate resource.
27/// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
28#[derive(
29    CustomResource,
30    Serialize,
31    Deserialize,
32    Clone,
33    Debug,
34    Default,
35    PartialEq,
36    JsonSchema
37)]
38#[kube(
39    group = "cert-manager.io",
40    version = "v1",
41    kind = "Certificate",
42    plural = "certificates"
43)]
44#[kube(namespaced)]
45#[kube(status = "CertificateStatus")]
46#[kube(schema = "disabled")]
47#[kube(derive = "Default")]
48#[kube(derive = "PartialEq")]
49pub struct CertificateSpec {
50    /// Defines extra output formats of the private key and signed certificate chain
51    /// to be written to this Certificate's target Secret.
52    ///
53    /// This is a Beta Feature enabled by default. It can be disabled with the
54    /// `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
55    /// the controller and webhook components.
56    #[serde(
57        default,
58        skip_serializing_if = "Option::is_none",
59        rename = "additionalOutputFormats"
60    )]
61    pub additional_output_formats: Option<Vec<CertificateAdditionalOutputFormats>>,
62    /// Requested common name X509 certificate subject attribute.
63    /// More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
64    /// NOTE: TLS clients will ignore this value when any subject alternative name is
65    /// set (see https://tools.ietf.org/html/rfc6125#section-6.4.4).
66    ///
67    /// Should have a length of 64 characters or fewer to avoid generating invalid CSRs.
68    /// Cannot be set if the `literalSubject` field is set.
69    #[serde(
70        default,
71        skip_serializing_if = "Option::is_none",
72        rename = "commonName"
73    )]
74    pub common_name: Option<String>,
75    /// Requested DNS subject alternative names.
76    #[serde(default, skip_serializing_if = "Option::is_none", rename = "dnsNames")]
77    pub dns_names: Option<Vec<String>>,
78    /// Requested 'duration' (i.e. lifetime) of the Certificate. Note that the
79    /// issuer may choose to ignore the requested duration, just like any other
80    /// requested attribute.
81    ///
82    /// If unset, this defaults to 90 days.
83    /// Minimum accepted duration is 1 hour.
84    /// Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
85    #[serde(default, skip_serializing_if = "Option::is_none")]
86    pub duration: Option<String>,
87    /// Requested email subject alternative names.
88    #[serde(
89        default,
90        skip_serializing_if = "Option::is_none",
91        rename = "emailAddresses"
92    )]
93    pub email_addresses: Option<Vec<String>>,
94    /// Whether the KeyUsage and ExtKeyUsage extensions should be set in the encoded CSR.
95    ///
96    /// This option defaults to true, and should only be disabled if the target
97    /// issuer does not support CSRs with these X509 KeyUsage/ ExtKeyUsage extensions.
98    #[serde(
99        default,
100        skip_serializing_if = "Option::is_none",
101        rename = "encodeUsagesInRequest"
102    )]
103    pub encode_usages_in_request: Option<bool>,
104    /// Requested IP address subject alternative names.
105    #[serde(
106        default,
107        skip_serializing_if = "Option::is_none",
108        rename = "ipAddresses"
109    )]
110    pub ip_addresses: Option<Vec<String>>,
111    /// Requested basic constraints isCA value.
112    /// The isCA value is used to set the `isCA` field on the created CertificateRequest
113    /// resources. Note that the issuer may choose to ignore the requested isCA value, just
114    /// like any other requested attribute.
115    ///
116    /// If true, this will automatically add the `cert sign` usage to the list
117    /// of requested `usages`.
118    #[serde(default, skip_serializing_if = "Option::is_none", rename = "isCA")]
119    pub is_ca: Option<bool>,
120    /// Reference to the issuer responsible for issuing the certificate.
121    /// If the issuer is namespace-scoped, it must be in the same namespace
122    /// as the Certificate. If the issuer is cluster-scoped, it can be used
123    /// from any namespace.
124    ///
125    /// The `name` field of the reference must always be specified.
126    #[serde(rename = "issuerRef")]
127    pub issuer_ref: CertificateIssuerRef,
128    /// Additional keystore output formats to be stored in the Certificate's Secret.
129    #[serde(default, skip_serializing_if = "Option::is_none")]
130    pub keystores: Option<CertificateKeystores>,
131    /// Requested X.509 certificate subject, represented using the LDAP "String
132    /// Representation of a Distinguished Name" [1].
133    /// Important: the LDAP string format also specifies the order of the attributes
134    /// in the subject, this is important when issuing certs for LDAP authentication.
135    /// Example: `CN=foo,DC=corp,DC=example,DC=com`
136    /// More info [1]: https://datatracker.ietf.org/doc/html/rfc4514
137    /// More info: https://github.com/cert-manager/cert-manager/issues/3203
138    /// More info: https://github.com/cert-manager/cert-manager/issues/4424
139    ///
140    /// Cannot be set if the `subject` or `commonName` field is set.
141    #[serde(
142        default,
143        skip_serializing_if = "Option::is_none",
144        rename = "literalSubject"
145    )]
146    pub literal_subject: Option<String>,
147    /// x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
148    /// More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
149    ///
150    /// This is an Alpha Feature and is only enabled with the
151    /// `--feature-gates=NameConstraints=true` option set on both
152    /// the controller and webhook components.
153    #[serde(
154        default,
155        skip_serializing_if = "Option::is_none",
156        rename = "nameConstraints"
157    )]
158    pub name_constraints: Option<CertificateNameConstraints>,
159    /// `otherNames` is an escape hatch for SAN that allows any type. We currently restrict the support to string like otherNames, cf RFC 5280 p 37
160    /// Any UTF8 String valued otherName can be passed with by setting the keys oid: x.x.x.x and UTF8Value: somevalue for `otherName`.
161    /// Most commonly this would be UPN set with oid: 1.3.6.1.4.1.311.20.2.3
162    /// You should ensure that any OID passed is valid for the UTF8String type as we do not explicitly validate this.
163    #[serde(
164        default,
165        skip_serializing_if = "Option::is_none",
166        rename = "otherNames"
167    )]
168    pub other_names: Option<Vec<CertificateOtherNames>>,
169    /// Private key options. These include the key algorithm and size, the used
170    /// encoding and the rotation policy.
171    #[serde(
172        default,
173        skip_serializing_if = "Option::is_none",
174        rename = "privateKey"
175    )]
176    pub private_key: Option<CertificatePrivateKey>,
177    /// How long before the currently issued certificate's expiry cert-manager should
178    /// renew the certificate. For example, if a certificate is valid for 60 minutes,
179    /// and `renewBefore=10m`, cert-manager will begin to attempt to renew the certificate
180    /// 50 minutes after it was issued (i.e. when there are 10 minutes remaining until
181    /// the certificate is no longer valid).
182    ///
183    /// NOTE: The actual lifetime of the issued certificate is used to determine the
184    /// renewal time. If an issuer returns a certificate with a different lifetime than
185    /// the one requested, cert-manager will use the lifetime of the issued certificate.
186    ///
187    /// If unset, this defaults to 1/3 of the issued certificate's lifetime.
188    /// Minimum accepted value is 5 minutes.
189    /// Value must be in units accepted by Go time.ParseDuration https://golang.org/pkg/time/#ParseDuration.
190    /// Cannot be set if the `renewBeforePercentage` field is set.
191    #[serde(
192        default,
193        skip_serializing_if = "Option::is_none",
194        rename = "renewBefore"
195    )]
196    pub renew_before: Option<String>,
197    /// `renewBeforePercentage` is like `renewBefore`, except it is a relative percentage
198    /// rather than an absolute duration. For example, if a certificate is valid for 60
199    /// minutes, and  `renewBeforePercentage=25`, cert-manager will begin to attempt to
200    /// renew the certificate 45 minutes after it was issued (i.e. when there are 15
201    /// minutes (25%) remaining until the certificate is no longer valid).
202    ///
203    /// NOTE: The actual lifetime of the issued certificate is used to determine the
204    /// renewal time. If an issuer returns a certificate with a different lifetime than
205    /// the one requested, cert-manager will use the lifetime of the issued certificate.
206    ///
207    /// Value must be an integer in the range (0,100). The minimum effective
208    /// `renewBefore` derived from the `renewBeforePercentage` and `duration` fields is 5
209    /// minutes.
210    /// Cannot be set if the `renewBefore` field is set.
211    #[serde(
212        default,
213        skip_serializing_if = "Option::is_none",
214        rename = "renewBeforePercentage"
215    )]
216    pub renew_before_percentage: Option<i32>,
217    /// The maximum number of CertificateRequest revisions that are maintained in
218    /// the Certificate's history. Each revision represents a single `CertificateRequest`
219    /// created by this Certificate, either when it was created, renewed, or Spec
220    /// was changed. Revisions will be removed by oldest first if the number of
221    /// revisions exceeds this number.
222    ///
223    /// If set, revisionHistoryLimit must be a value of `1` or greater.
224    /// If unset (`nil`), revisions will not be garbage collected.
225    /// Default value is `nil`.
226    #[serde(
227        default,
228        skip_serializing_if = "Option::is_none",
229        rename = "revisionHistoryLimit"
230    )]
231    pub revision_history_limit: Option<i32>,
232    /// Name of the Secret resource that will be automatically created and
233    /// managed by this Certificate resource. It will be populated with a
234    /// private key and certificate, signed by the denoted issuer. The Secret
235    /// resource lives in the same namespace as the Certificate resource.
236    #[serde(rename = "secretName")]
237    pub secret_name: String,
238    /// Defines annotations and labels to be copied to the Certificate's Secret.
239    /// Labels and annotations on the Secret will be changed as they appear on the
240    /// SecretTemplate when added or removed. SecretTemplate annotations are added
241    /// in conjunction with, and cannot overwrite, the base set of annotations
242    /// cert-manager sets on the Certificate's Secret.
243    #[serde(
244        default,
245        skip_serializing_if = "Option::is_none",
246        rename = "secretTemplate"
247    )]
248    pub secret_template: Option<CertificateSecretTemplate>,
249    /// Requested set of X509 certificate subject attributes.
250    /// More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
251    ///
252    /// The common name attribute is specified separately in the `commonName` field.
253    /// Cannot be set if the `literalSubject` field is set.
254    #[serde(default, skip_serializing_if = "Option::is_none")]
255    pub subject: Option<CertificateSubject>,
256    /// Requested URI subject alternative names.
257    #[serde(default, skip_serializing_if = "Option::is_none")]
258    pub uris: Option<Vec<String>>,
259    /// Requested key usages and extended key usages.
260    /// These usages are used to set the `usages` field on the created CertificateRequest
261    /// resources. If `encodeUsagesInRequest` is unset or set to `true`, the usages
262    /// will additionally be encoded in the `request` field which contains the CSR blob.
263    ///
264    /// If unset, defaults to `digital signature` and `key encipherment`.
265    #[serde(default, skip_serializing_if = "Option::is_none")]
266    pub usages: Option<Vec<String>>,
267}
268
269/// CertificateAdditionalOutputFormat defines an additional output format of a
270/// Certificate resource. These contain supplementary data formats of the signed
271/// certificate chain and paired private key.
272#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
273pub struct CertificateAdditionalOutputFormats {
274    /// Type is the name of the format type that should be written to the
275    /// Certificate's target Secret.
276    #[serde(rename = "type")]
277    pub r#type: CertificateAdditionalOutputFormatsType,
278}
279
280/// CertificateAdditionalOutputFormat defines an additional output format of a
281/// Certificate resource. These contain supplementary data formats of the signed
282/// certificate chain and paired private key.
283#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
284pub enum CertificateAdditionalOutputFormatsType {
285    #[serde(rename = "DER")]
286    Der,
287    #[serde(rename = "CombinedPEM")]
288    CombinedPem,
289}
290
291/// Reference to the issuer responsible for issuing the certificate.
292/// If the issuer is namespace-scoped, it must be in the same namespace
293/// as the Certificate. If the issuer is cluster-scoped, it can be used
294/// from any namespace.
295///
296/// The `name` field of the reference must always be specified.
297#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
298pub struct CertificateIssuerRef {
299    /// Group of the resource being referred to.
300    #[serde(default, skip_serializing_if = "Option::is_none")]
301    pub group: Option<String>,
302    /// Kind of the resource being referred to.
303    #[serde(default, skip_serializing_if = "Option::is_none")]
304    pub kind: Option<String>,
305    /// Name of the resource being referred to.
306    pub name: String,
307}
308
309/// Additional keystore output formats to be stored in the Certificate's Secret.
310#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
311pub struct CertificateKeystores {
312    /// JKS configures options for storing a JKS keystore in the
313    /// `spec.secretName` Secret resource.
314    #[serde(default, skip_serializing_if = "Option::is_none")]
315    pub jks: Option<CertificateKeystoresJks>,
316    /// PKCS12 configures options for storing a PKCS12 keystore in the
317    /// `spec.secretName` Secret resource.
318    #[serde(default, skip_serializing_if = "Option::is_none")]
319    pub pkcs12: Option<CertificateKeystoresPkcs12>,
320}
321
322/// JKS configures options for storing a JKS keystore in the
323/// `spec.secretName` Secret resource.
324#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
325pub struct CertificateKeystoresJks {
326    /// Alias specifies the alias of the key in the keystore, required by the JKS format.
327    /// If not provided, the default alias `certificate` will be used.
328    #[serde(default, skip_serializing_if = "Option::is_none")]
329    pub alias: Option<String>,
330    /// Create enables JKS keystore creation for the Certificate.
331    /// If true, a file named `keystore.jks` will be created in the target
332    /// Secret resource, encrypted using the password stored in
333    /// `passwordSecretRef`.
334    /// The keystore file will be updated immediately.
335    /// If the issuer provided a CA certificate, a file named `truststore.jks`
336    /// will also be created in the target Secret resource, encrypted using the
337    /// password stored in `passwordSecretRef`
338    /// containing the issuing Certificate Authority
339    pub create: bool,
340    /// PasswordSecretRef is a reference to a key in a Secret resource
341    /// containing the password used to encrypt the JKS keystore.
342    #[serde(rename = "passwordSecretRef")]
343    pub password_secret_ref: CertificateKeystoresJksPasswordSecretRef,
344}
345
346/// PasswordSecretRef is a reference to a key in a Secret resource
347/// containing the password used to encrypt the JKS keystore.
348#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
349pub struct CertificateKeystoresJksPasswordSecretRef {
350    /// The key of the entry in the Secret resource's `data` field to be used.
351    /// Some instances of this field may be defaulted, in others it may be
352    /// required.
353    #[serde(default, skip_serializing_if = "Option::is_none")]
354    pub key: Option<String>,
355    /// Name of the resource being referred to.
356    /// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
357    pub name: String,
358}
359
360/// PKCS12 configures options for storing a PKCS12 keystore in the
361/// `spec.secretName` Secret resource.
362#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
363pub struct CertificateKeystoresPkcs12 {
364    /// Create enables PKCS12 keystore creation for the Certificate.
365    /// If true, a file named `keystore.p12` will be created in the target
366    /// Secret resource, encrypted using the password stored in
367    /// `passwordSecretRef`.
368    /// The keystore file will be updated immediately.
369    /// If the issuer provided a CA certificate, a file named `truststore.p12` will
370    /// also be created in the target Secret resource, encrypted using the
371    /// password stored in `passwordSecretRef` containing the issuing Certificate
372    /// Authority
373    pub create: bool,
374    /// PasswordSecretRef is a reference to a key in a Secret resource
375    /// containing the password used to encrypt the PKCS12 keystore.
376    #[serde(rename = "passwordSecretRef")]
377    pub password_secret_ref: CertificateKeystoresPkcs12PasswordSecretRef,
378    /// Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
379    /// used to create the PKCS12 keystore. Default value is `LegacyRC2` for backward compatibility.
380    ///
381    /// If provided, allowed values are:
382    /// `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
383    /// `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
384    /// `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
385    /// (eg. because of company policy). Please note that the security of the algorithm is not that important
386    /// in reality, because the unencrypted certificate and private key are also stored in the Secret.
387    #[serde(default, skip_serializing_if = "Option::is_none")]
388    pub profile: Option<CertificateKeystoresPkcs12Profile>,
389}
390
391/// PasswordSecretRef is a reference to a key in a Secret resource
392/// containing the password used to encrypt the PKCS12 keystore.
393#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
394pub struct CertificateKeystoresPkcs12PasswordSecretRef {
395    /// The key of the entry in the Secret resource's `data` field to be used.
396    /// Some instances of this field may be defaulted, in others it may be
397    /// required.
398    #[serde(default, skip_serializing_if = "Option::is_none")]
399    pub key: Option<String>,
400    /// Name of the resource being referred to.
401    /// More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
402    pub name: String,
403}
404
405/// PKCS12 configures options for storing a PKCS12 keystore in the
406/// `spec.secretName` Secret resource.
407#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
408pub enum CertificateKeystoresPkcs12Profile {
409    #[serde(rename = "LegacyRC2")]
410    LegacyRc2,
411    #[serde(rename = "LegacyDES")]
412    LegacyDes,
413    Modern2023,
414}
415
416/// x.509 certificate NameConstraint extension which MUST NOT be used in a non-CA certificate.
417/// More Info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.10
418///
419/// This is an Alpha Feature and is only enabled with the
420/// `--feature-gates=NameConstraints=true` option set on both
421/// the controller and webhook components.
422#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
423pub struct CertificateNameConstraints {
424    /// if true then the name constraints are marked critical.
425    #[serde(default, skip_serializing_if = "Option::is_none")]
426    pub critical: Option<bool>,
427    /// Excluded contains the constraints which must be disallowed. Any name matching a
428    /// restriction in the excluded field is invalid regardless
429    /// of information appearing in the permitted
430    #[serde(default, skip_serializing_if = "Option::is_none")]
431    pub excluded: Option<CertificateNameConstraintsExcluded>,
432    /// Permitted contains the constraints in which the names must be located.
433    #[serde(default, skip_serializing_if = "Option::is_none")]
434    pub permitted: Option<CertificateNameConstraintsPermitted>,
435}
436
437/// Excluded contains the constraints which must be disallowed. Any name matching a
438/// restriction in the excluded field is invalid regardless
439/// of information appearing in the permitted
440#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
441pub struct CertificateNameConstraintsExcluded {
442    /// DNSDomains is a list of DNS domains that are permitted or excluded.
443    #[serde(
444        default,
445        skip_serializing_if = "Option::is_none",
446        rename = "dnsDomains"
447    )]
448    pub dns_domains: Option<Vec<String>>,
449    /// EmailAddresses is a list of Email Addresses that are permitted or excluded.
450    #[serde(
451        default,
452        skip_serializing_if = "Option::is_none",
453        rename = "emailAddresses"
454    )]
455    pub email_addresses: Option<Vec<String>>,
456    /// IPRanges is a list of IP Ranges that are permitted or excluded.
457    /// This should be a valid CIDR notation.
458    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ipRanges")]
459    pub ip_ranges: Option<Vec<String>>,
460    /// URIDomains is a list of URI domains that are permitted or excluded.
461    #[serde(
462        default,
463        skip_serializing_if = "Option::is_none",
464        rename = "uriDomains"
465    )]
466    pub uri_domains: Option<Vec<String>>,
467}
468
469/// Permitted contains the constraints in which the names must be located.
470#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
471pub struct CertificateNameConstraintsPermitted {
472    /// DNSDomains is a list of DNS domains that are permitted or excluded.
473    #[serde(
474        default,
475        skip_serializing_if = "Option::is_none",
476        rename = "dnsDomains"
477    )]
478    pub dns_domains: Option<Vec<String>>,
479    /// EmailAddresses is a list of Email Addresses that are permitted or excluded.
480    #[serde(
481        default,
482        skip_serializing_if = "Option::is_none",
483        rename = "emailAddresses"
484    )]
485    pub email_addresses: Option<Vec<String>>,
486    /// IPRanges is a list of IP Ranges that are permitted or excluded.
487    /// This should be a valid CIDR notation.
488    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ipRanges")]
489    pub ip_ranges: Option<Vec<String>>,
490    /// URIDomains is a list of URI domains that are permitted or excluded.
491    #[serde(
492        default,
493        skip_serializing_if = "Option::is_none",
494        rename = "uriDomains"
495    )]
496    pub uri_domains: Option<Vec<String>>,
497}
498
499#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
500pub struct CertificateOtherNames {
501    /// OID is the object identifier for the otherName SAN.
502    /// The object identifier must be expressed as a dotted string, for
503    /// example, "1.2.840.113556.1.4.221".
504    #[serde(default, skip_serializing_if = "Option::is_none")]
505    pub oid: Option<String>,
506    /// utf8Value is the string value of the otherName SAN.
507    /// The utf8Value accepts any valid UTF8 string to set as value for the otherName SAN.
508    #[serde(default, skip_serializing_if = "Option::is_none", rename = "utf8Value")]
509    pub utf8_value: Option<String>,
510}
511
512/// Private key options. These include the key algorithm and size, the used
513/// encoding and the rotation policy.
514#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
515pub struct CertificatePrivateKey {
516    /// Algorithm is the private key algorithm of the corresponding private key
517    /// for this certificate.
518    ///
519    /// If provided, allowed values are either `RSA`, `ECDSA` or `Ed25519`.
520    /// If `algorithm` is specified and `size` is not provided,
521    /// key size of 2048 will be used for `RSA` key algorithm and
522    /// key size of 256 will be used for `ECDSA` key algorithm.
523    /// key size is ignored when using the `Ed25519` key algorithm.
524    #[serde(default, skip_serializing_if = "Option::is_none")]
525    pub algorithm: Option<CertificatePrivateKeyAlgorithm>,
526    /// The private key cryptography standards (PKCS) encoding for this
527    /// certificate's private key to be encoded in.
528    ///
529    /// If provided, allowed values are `PKCS1` and `PKCS8` standing for PKCS#1
530    /// and PKCS#8, respectively.
531    /// Defaults to `PKCS1` if not specified.
532    #[serde(default, skip_serializing_if = "Option::is_none")]
533    pub encoding: Option<CertificatePrivateKeyEncoding>,
534    /// RotationPolicy controls how private keys should be regenerated when a
535    /// re-issuance is being processed.
536    ///
537    /// If set to `Never`, a private key will only be generated if one does not
538    /// already exist in the target `spec.secretName`. If one does exist but it
539    /// does not have the correct algorithm or size, a warning will be raised
540    /// to await user intervention.
541    /// If set to `Always`, a private key matching the specified requirements
542    /// will be generated whenever a re-issuance occurs.
543    /// Default is `Never` for backward compatibility.
544    #[serde(
545        default,
546        skip_serializing_if = "Option::is_none",
547        rename = "rotationPolicy"
548    )]
549    pub rotation_policy: Option<CertificatePrivateKeyRotationPolicy>,
550    /// Size is the key bit size of the corresponding private key for this certificate.
551    ///
552    /// If `algorithm` is set to `RSA`, valid values are `2048`, `4096` or `8192`,
553    /// and will default to `2048` if not specified.
554    /// If `algorithm` is set to `ECDSA`, valid values are `256`, `384` or `521`,
555    /// and will default to `256` if not specified.
556    /// If `algorithm` is set to `Ed25519`, Size is ignored.
557    /// No other values are allowed.
558    #[serde(default, skip_serializing_if = "Option::is_none")]
559    pub size: Option<i64>,
560}
561
562/// Private key options. These include the key algorithm and size, the used
563/// encoding and the rotation policy.
564#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
565pub enum CertificatePrivateKeyAlgorithm {
566    #[serde(rename = "RSA")]
567    Rsa,
568    #[serde(rename = "ECDSA")]
569    Ecdsa,
570    Ed25519,
571}
572
573/// Private key options. These include the key algorithm and size, the used
574/// encoding and the rotation policy.
575#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
576pub enum CertificatePrivateKeyEncoding {
577    #[serde(rename = "PKCS1")]
578    Pkcs1,
579    #[serde(rename = "PKCS8")]
580    Pkcs8,
581}
582
583/// Private key options. These include the key algorithm and size, the used
584/// encoding and the rotation policy.
585#[derive(Serialize, Deserialize, Clone, Debug, PartialEq, JsonSchema)]
586pub enum CertificatePrivateKeyRotationPolicy {
587    Never,
588    Always,
589}
590
591/// Defines annotations and labels to be copied to the Certificate's Secret.
592/// Labels and annotations on the Secret will be changed as they appear on the
593/// SecretTemplate when added or removed. SecretTemplate annotations are added
594/// in conjunction with, and cannot overwrite, the base set of annotations
595/// cert-manager sets on the Certificate's Secret.
596#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
597pub struct CertificateSecretTemplate {
598    /// Annotations is a key value map to be copied to the target Kubernetes Secret.
599    #[serde(default, skip_serializing_if = "Option::is_none")]
600    pub annotations: Option<BTreeMap<String, String>>,
601    /// Labels is a key value map to be copied to the target Kubernetes Secret.
602    #[serde(default, skip_serializing_if = "Option::is_none")]
603    pub labels: Option<BTreeMap<String, String>>,
604}
605
606/// Requested set of X509 certificate subject attributes.
607/// More info: https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.6
608///
609/// The common name attribute is specified separately in the `commonName` field.
610/// Cannot be set if the `literalSubject` field is set.
611#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
612pub struct CertificateSubject {
613    /// Countries to be used on the Certificate.
614    #[serde(default, skip_serializing_if = "Option::is_none")]
615    pub countries: Option<Vec<String>>,
616    /// Cities to be used on the Certificate.
617    #[serde(default, skip_serializing_if = "Option::is_none")]
618    pub localities: Option<Vec<String>>,
619    /// Organizational Units to be used on the Certificate.
620    #[serde(
621        default,
622        skip_serializing_if = "Option::is_none",
623        rename = "organizationalUnits"
624    )]
625    pub organizational_units: Option<Vec<String>>,
626    /// Organizations to be used on the Certificate.
627    #[serde(default, skip_serializing_if = "Option::is_none")]
628    pub organizations: Option<Vec<String>>,
629    /// Postal codes to be used on the Certificate.
630    #[serde(
631        default,
632        skip_serializing_if = "Option::is_none",
633        rename = "postalCodes"
634    )]
635    pub postal_codes: Option<Vec<String>>,
636    /// State/Provinces to be used on the Certificate.
637    #[serde(default, skip_serializing_if = "Option::is_none")]
638    pub provinces: Option<Vec<String>>,
639    /// Serial number to be used on the Certificate.
640    #[serde(
641        default,
642        skip_serializing_if = "Option::is_none",
643        rename = "serialNumber"
644    )]
645    pub serial_number: Option<String>,
646    /// Street addresses to be used on the Certificate.
647    #[serde(
648        default,
649        skip_serializing_if = "Option::is_none",
650        rename = "streetAddresses"
651    )]
652    pub street_addresses: Option<Vec<String>>,
653}
654
655/// Status of the Certificate.
656/// This is set and managed automatically.
657/// Read-only.
658/// More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#spec-and-status
659#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq, JsonSchema)]
660pub struct CertificateStatus {
661    /// List of status conditions to indicate the status of certificates.
662    /// Known condition types are `Ready` and `Issuing`.
663    #[serde(default, skip_serializing_if = "Option::is_none")]
664    pub conditions: Option<Vec<Condition>>,
665    /// The number of continuous failed issuance attempts up till now. This
666    /// field gets removed (if set) on a successful issuance and gets set to
667    /// 1 if unset and an issuance has failed. If an issuance has failed, the
668    /// delay till the next issuance will be calculated using formula
669    /// time.Hour * 2 ^ (failedIssuanceAttempts - 1).
670    #[serde(
671        default,
672        skip_serializing_if = "Option::is_none",
673        rename = "failedIssuanceAttempts"
674    )]
675    pub failed_issuance_attempts: Option<i64>,
676    /// LastFailureTime is set only if the latest issuance for this
677    /// Certificate failed and contains the time of the failure. If an
678    /// issuance has failed, the delay till the next issuance will be
679    /// calculated using formula time.Hour * 2 ^ (failedIssuanceAttempts -
680    /// 1). If the latest issuance has succeeded this field will be unset.
681    #[serde(
682        default,
683        skip_serializing_if = "Option::is_none",
684        rename = "lastFailureTime"
685    )]
686    pub last_failure_time: Option<String>,
687    /// The name of the Secret resource containing the private key to be used
688    /// for the next certificate iteration.
689    /// The keymanager controller will automatically set this field if the
690    /// `Issuing` condition is set to `True`.
691    /// It will automatically unset this field when the Issuing condition is
692    /// not set or False.
693    #[serde(
694        default,
695        skip_serializing_if = "Option::is_none",
696        rename = "nextPrivateKeySecretName"
697    )]
698    pub next_private_key_secret_name: Option<String>,
699    /// The expiration time of the certificate stored in the secret named
700    /// by this resource in `spec.secretName`.
701    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notAfter")]
702    pub not_after: Option<String>,
703    /// The time after which the certificate stored in the secret named
704    /// by this resource in `spec.secretName` is valid.
705    #[serde(default, skip_serializing_if = "Option::is_none", rename = "notBefore")]
706    pub not_before: Option<String>,
707    /// RenewalTime is the time at which the certificate will be next
708    /// renewed.
709    /// If not set, no upcoming renewal is scheduled.
710    #[serde(
711        default,
712        skip_serializing_if = "Option::is_none",
713        rename = "renewalTime"
714    )]
715    pub renewal_time: Option<String>,
716    /// The current 'revision' of the certificate as issued.
717    ///
718    /// When a CertificateRequest resource is created, it will have the
719    /// `cert-manager.io/certificate-revision` set to one greater than the
720    /// current value of this field.
721    ///
722    /// Upon issuance, this field will be set to the value of the annotation
723    /// on the CertificateRequest resource used to issue the certificate.
724    ///
725    /// Persisting the value on the CertificateRequest resource allows the
726    /// certificates controller to know whether a request is part of an old
727    /// issuance or if it is part of the ongoing revision's issuance by
728    /// checking if the revision value in the annotation is greater than this
729    /// field.
730    #[serde(default, skip_serializing_if = "Option::is_none")]
731    pub revision: Option<i64>,
732}
mz_cloud_resources/crd/generated/cert_manager/certificates.rs

mz_cloud_resources/crd/generated/cert_manager/
certificates.rs
