---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    include.release.openshift.io/self-managed-high-availability: "true"
  creationTimestamp: "2022-03-08T10:13:26Z"
  generation: 1
  managedFields:
  - apiVersion: apiextensions.k8s.io/v1beta1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:include.release.openshift.io/self-managed-high-availability: {}
      f:spec:
        f:conversion:
          .: {}
          f:strategy: {}
        f:group: {}
        f:names:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:preserveUnknownFields: {}
        f:scope: {}
        f:validation:
          .: {}
          f:openAPIV3Schema:
            .: {}
            f:description: {}
            f:properties:
              .: {}
              f:apiVersion:
                .: {}
                f:description: {}
                f:type: {}
              f:kind:
                .: {}
                f:description: {}
                f:type: {}
              f:metadata:
                .: {}
                f:type: {}
              f:spec:
                .: {}
                f:description: {}
                f:properties:
                  .: {}
                  f:grouprestriction:
                    .: {}
                    f:description: {}
                    f:nullable: {}
                    f:properties:
                      .: {}
                      f:groups:
                        .: {}
                        f:description: {}
                        f:items: {}
                        f:nullable: {}
                        f:type: {}
                      f:labels:
                        .: {}
                        f:description: {}
                        f:items: {}
                        f:nullable: {}
                        f:type: {}
                    f:type: {}
                  f:serviceaccountrestriction:
                    .: {}
                    f:description: {}
                    f:nullable: {}
                    f:properties:
                      .: {}
                      f:namespaces:
                        .: {}
                        f:description: {}
                        f:items: {}
                        f:type: {}
                      f:serviceaccounts:
                        .: {}
                        f:description: {}
                        f:items: {}
                        f:type: {}
                    f:type: {}
                  f:userrestriction:
                    .: {}
                    f:description: {}
                    f:nullable: {}
                    f:properties:
                      .: {}
                      f:groups:
                        .: {}
                        f:description: {}
                        f:items: {}
                        f:nullable: {}
                        f:type: {}
                      f:labels:
                        .: {}
                        f:description: {}
                        f:items: {}
                        f:nullable: {}
                        f:type: {}
                      f:users:
                        .: {}
                        f:description: {}
                        f:items: {}
                        f:type: {}
                    f:type: {}
                f:type: {}
            f:type: {}
        f:version: {}
        f:versions: {}
      f:status:
        f:storedVersions: {}
    manager: cluster-bootstrap
    operation: Update
    time: "2022-03-08T10:13:26Z"
  - apiVersion: apiextensions.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:acceptedNames:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:conditions: {}
    manager: kube-apiserver
    operation: Update
    time: "2022-03-08T10:13:26Z"
  name: rolebindingrestrictions.authorization.openshift.io
  resourceVersion: "243"
  selfLink: /apis/apiextensions.k8s.io/v1/customresourcedefinitions/rolebindingrestrictions.authorization.openshift.io
  uid: 375fa47f-1ad7-40fc-83ab-16ec33ddca4a
spec:
  conversion:
    strategy: None
  group: authorization.openshift.io
  names:
    kind: RoleBindingRestriction
    listKind: RoleBindingRestrictionList
    plural: rolebindingrestrictions
    singular: rolebindingrestriction
  scope: Namespaced
  versions:
  - name: v1
    schema:
      openAPIV3Schema:
        description: RoleBindingRestriction is an object that can be matched against a subject (user, group, or service account) to determine whether rolebindings on that subject are allowed in the namespace to which the RoleBindingRestriction belongs.  If any one of those RoleBindingRestriction objects matches a subject, rolebindings on that subject in the namespace are allowed.
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: Spec defines the matcher.
            properties:
              grouprestriction:
                description: GroupRestriction matches against group subjects.
                nullable: true
                properties:
                  groups:
                    description: Groups is a list of groups used to match against an individual user's groups. If the user is a member of one of the whitelisted groups, the user is allowed to be bound to a role.
                    items:
                      type: string
                    nullable: true
                    type: array
                  labels:
                    description: Selectors specifies a list of label selectors over group labels.
                    items:
                      description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
                      properties:
                        matchExpressions:
                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
                          items:
                            description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
                            properties:
                              key:
                                description: key is the label key that the selector applies to.
                                type: string
                              operator:
                                description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
                                type: string
                              values:
                                description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
                                items:
                                  type: string
                                type: array
                            required:
                            - key
                            - operator
                            type: object
                          type: array
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
                          type: object
                      type: object
                    nullable: true
                    type: array
                type: object
              serviceaccountrestriction:
                description: ServiceAccountRestriction matches against service-account subjects.
                nullable: true
                properties:
                  namespaces:
                    description: Namespaces specifies a list of literal namespace names.
                    items:
                      type: string
                    type: array
                  serviceaccounts:
                    description: ServiceAccounts specifies a list of literal service-account names.
                    items:
                      description: ServiceAccountReference specifies a service account and namespace by their names.
                      properties:
                        name:
                          description: Name is the name of the service account.
                          type: string
                        namespace:
                          description: Namespace is the namespace of the service account.  Service accounts from inside the whitelisted namespaces are allowed to be bound to roles.  If Namespace is empty, then the namespace of the RoleBindingRestriction in which the ServiceAccountReference is embedded is used.
                          type: string
                      type: object
                    type: array
                type: object
              userrestriction:
                description: UserRestriction matches against user subjects.
                nullable: true
                properties:
                  groups:
                    description: Groups specifies a list of literal group names.
                    items:
                      type: string
                    nullable: true
                    type: array
                  labels:
                    description: Selectors specifies a list of label selectors over user labels.
                    items:
                      description: A label selector is a label query over a set of resources. The result of matchLabels and matchExpressions are ANDed. An empty label selector matches all objects. A null label selector matches no objects.
                      properties:
                        matchExpressions:
                          description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
                          items:
                            description: A label selector requirement is a selector that contains values, a key, and an operator that relates the key and values.
                            properties:
                              key:
                                description: key is the label key that the selector applies to.
                                type: string
                              operator:
                                description: operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
                                type: string
                              values:
                                description: values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.
                                items:
                                  type: string
                                type: array
                            required:
                            - key
                            - operator
                            type: object
                          type: array
                        matchLabels:
                          additionalProperties:
                            type: string
                          description: matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.
                          type: object
                      type: object
                    nullable: true
                    type: array
                  users:
                    description: Users specifies a list of literal user names.
                    items:
                      type: string
                    type: array
                type: object
            type: object
        type: object
    served: true
    storage: true
status:
  acceptedNames:
    kind: RoleBindingRestriction
    listKind: RoleBindingRestrictionList
    plural: rolebindingrestrictions
    singular: rolebindingrestriction
  conditions:
  - lastTransitionTime: "2022-03-08T10:13:26Z"
    message: no conflicts found
    reason: NoConflicts
    status: "True"
    type: NamesAccepted
  - lastTransitionTime: "2022-03-08T10:13:26Z"
    message: the initial names have been accepted
    reason: InitialNamesAccepted
    status: "True"
    type: Established
  storedVersions:
  - v1
