---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
  creationTimestamp: "2022-03-08T10:13:28Z"
  generation: 1
  managedFields:
  - apiVersion: apiextensions.k8s.io/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:include.release.openshift.io/self-managed-high-availability: {}
      f:spec:
        f:conversion:
          .: {}
          f:strategy: {}
        f:group: {}
        f:names:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:preserveUnknownFields: {}
        f:scope: {}
        f:subresources:
          .: {}
          f:status: {}
        f:validation:
          .: {}
          f:openAPIV3Schema:
            .: {}
            f:description: {}
            f:properties:
              .: {}
              f:apiVersion:
                .: {}
                f:description: {}
                f:type: {}
              f:kind:
                .: {}
                f:description: {}
                f:type: {}
              f:metadata:
                .: {}
                f:type: {}
              f:spec:
                .: {}
                f:description: {}
                f:properties:
                  .: {}
                  f:oauthMetadata:
                    .: {}
                    f:description: {}
                    f:properties:
                      .: {}
                      f:name:
                        .: {}
                        f:description: {}
                        f:type: {}
                    f:required: {}
                    f:type: {}
                  f:serviceAccountIssuer:
                    .: {}
                    f:description: {}
                    f:type: {}
                  f:type:
                    .: {}
                    f:description: {}
                    f:type: {}
                  f:webhookTokenAuthenticator:
                    .: {}
                    f:description: {}
                    f:properties:
                      .: {}
                      f:kubeConfig:
                        .: {}
                        f:description: {}
                        f:properties:
                          .: {}
                          f:name:
                            .: {}
                            f:description: {}
                            f:type: {}
                        f:required: {}
                        f:type: {}
                    f:required: {}
                    f:type: {}
                  f:webhookTokenAuthenticators:
                    .: {}
                    f:description: {}
                    f:items: {}
                    f:type: {}
                f:type: {}
              f:status:
                .: {}
                f:description: {}
                f:properties:
                  .: {}
                  f:integratedOAuthMetadata:
                    .: {}
                    f:description: {}
                    f:properties:
                      .: {}
                      f:name:
                        .: {}
                        f:description: {}
                        f:type: {}
                    f:required: {}
                    f:type: {}
                f:type: {}
            f:required: {}
            f:type: {}
        f:version: {}
        f:versions: {}
      f:status:
        f:storedVersions: {}
    manager: cluster-bootstrap
    operation: Update
    time: "2022-03-08T10:13:28Z"
  - apiVersion: apiextensions.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:acceptedNames:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:conditions: {}
    manager: kube-apiserver
    operation: Update
    time: "2022-03-08T10:13:28Z"
  name: authentications.config.openshift.io
  resourceVersion: "342"
  selfLink: /apis/apiextensions.k8s.io/v1/customresourcedefinitions/authentications.config.openshift.io
  uid: 003c1791-bf69-41bd-ba0c-7abedd5ac8dc
spec:
  conversion:
    strategy: None
  group: config.openshift.io
  names:
    kind: Authentication
    listKind: AuthenticationList
    plural: authentications
    singular: authentication
  scope: Cluster
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: Authentication specifies cluster-wide settings for authentication (like OAuth and webhook token authenticators). The canonical name of an instance is `cluster`.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: spec holds user settable values for configuration
            properties:
              oauthMetadata:
                description: 'oauthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for an external OAuth server. This discovery document can be viewed from its served location: oc get --raw ''/.well-known/oauth-authorization-server'' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 If oauthMetadata.name is non-empty, this value has precedence over any metadata reference stored in status. The key "oauthMetadata" is used to locate the data. If specified and the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config.'
                properties:
                  name:
                    description: name is the metadata.name of the referenced config map
                    type: string
                required:
                - name
                type: object
              serviceAccountIssuer:
                description: 'serviceAccountIssuer is the identifier of the bound service account token issuer. The default is https://kubernetes.default.svc WARNING: Updating this field will result in the invalidation of all bound tokens with the previous issuer value. Unless the holder of a bound token has explicit support for a change in issuer, they will not request a new bound token until pod restart or until their existing token exceeds 80% of its duration.'
                type: string
              type:
                description: type identifies the cluster managed, user facing authentication mode in use. Specifically, it manages the component that responds to login attempts. The default is IntegratedOAuth.
                type: string
              webhookTokenAuthenticator:
                description: webhookTokenAuthenticator configures a remote token reviewer. These remote authentication webhooks can be used to verify bearer tokens via the tokenreviews.authentication.k8s.io REST API. This is required to honor bearer tokens that are provisioned by an external authentication service.
                properties:
                  kubeConfig:
                    description: "kubeConfig references a secret that contains kube config file data which describes how to access the remote webhook service. The namespace for the referenced secret is openshift-config. \n For further details, see: \n https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication \n The key \"kubeConfig\" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored."
                    properties:
                      name:
                        description: name is the metadata.name of the referenced secret
                        type: string
                    required:
                    - name
                    type: object
                required:
                - kubeConfig
                type: object
              webhookTokenAuthenticators:
                description: webhookTokenAuthenticators is DEPRECATED, setting it has no effect.
                items:
                  description: deprecatedWebhookTokenAuthenticator holds the necessary configuration options for a remote token authenticator. It's the same as WebhookTokenAuthenticator but it's missing the 'required' validation on KubeConfig field.
                  properties:
                    kubeConfig:
                      description: 'kubeConfig contains kube config file data which describes how to access the remote webhook service. For further details, see: https://kubernetes.io/docs/reference/access-authn-authz/authentication/#webhook-token-authentication The key "kubeConfig" is used to locate the data. If the secret or expected key is not found, the webhook is not honored. If the specified kube config data is not valid, the webhook is not honored. The namespace for this secret is determined by the point of use.'
                      properties:
                        name:
                          description: name is the metadata.name of the referenced secret
                          type: string
                      required:
                      - name
                      type: object
                  type: object
                type: array
            type: object
          status:
            description: status holds observed values from the cluster. They may not be overridden.
            properties:
              integratedOAuthMetadata:
                description: 'integratedOAuthMetadata contains the discovery endpoint data for OAuth 2.0 Authorization Server Metadata for the in-cluster integrated OAuth server. This discovery document can be viewed from its served location: oc get --raw ''/.well-known/oauth-authorization-server'' For further details, see the IETF Draft: https://tools.ietf.org/html/draft-ietf-oauth-discovery-04#section-2 This contains the observed value based on cluster state. An explicitly set value in spec.oauthMetadata has precedence over this field. This field has no meaning if authentication spec.type is not set to IntegratedOAuth. The key "oauthMetadata" is used to locate the data. If the config map or expected key is not found, no metadata is served. If the specified metadata is not valid, no metadata is served. The namespace for this config map is openshift-config-managed.'
                properties:
                  name:
                    description: name is the metadata.name of the referenced config map
                    type: string
                required:
                - name
                type: object
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: Authentication
    listKind: AuthenticationList
    plural: authentications
    singular: authentication
  conditions:
  - lastTransitionTime: "2022-03-08T10:13:28Z"
    message: no conflicts found
    reason: NoConflicts
    status: "True"
    type: NamesAccepted
  - lastTransitionTime: "2022-03-08T10:13:28Z"
    message: the initial names have been accepted
    reason: InitialNamesAccepted
    status: "True"
    type: Established
  storedVersions:
  - v1
