update crds

crdSchemas/apiauth_v1alpha1.json

@@ -17,8 +17,36 @@
       "properties": {
         "apiKey": {
           "description": "APIKey configures API key authentication.",
+          "properties": {
+            "keySource": {
+              "description": "KeySource defines where to extract the API key from requests.\nWhen not specified, defaults to \"Authorization\" header with \"Bearer\" scheme and \"api_key\" query parameter.\nWhen specified, it completely overrides defaults - fields left empty will disable that extraction method.",
+              "minProperties": 1,
+              "properties": {
+                "header": {
+                  "description": "Header is the name of the header containing the API key.",
+                  "type": "string"
+                },
+                "headerAuthScheme": {
+                  "description": "HeaderAuthScheme is the authentication scheme prefix in the header value.\nThe scheme is used to parse headers in the format \"<scheme> <token>\".\nOnly applies when header is \"Authorization\".",
+                  "type": "string"
+                },
+                "query": {
+                  "description": "Query is the name of the query parameter containing the API key.",
+                  "type": "string"
+                }
+              },
+              "type": "object",
+              "x-kubernetes-validations": [
+                {
+                  "message": "headerAuthScheme can only be used when header is 'Authorization'",
+                  "rule": "!has(self.headerAuthScheme) || self.header == 'Authorization'"
+                }
+              ],
+              "additionalProperties": false
+            }
+          },
           "type": "object",
-          "x-kubernetes-preserve-unknown-fields": true
+          "additionalProperties": false
         },
         "isDefault": {
           "description": "IsDefault specifies if this APIAuth should be used as the default API authentication method for the namespace.\nOnly one APIAuth per namespace should have isDefault set to true.",
@@ -43,7 +71,7 @@
               "type": "string"
             },
             "jwksUrl": {
-              "description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.",
+              "description": "JWKSURL is the URL to fetch the JWKS for JWT verification.\nMutually exclusive with SigningSecretName, PublicKey, JWKSFile, and TrustedIssuers.\n\nDeprecated: Use TrustedIssuers instead for more flexible JWKS configuration with issuer validation.",
               "type": "string",
               "x-kubernetes-validations": [
                 {