{
  "description": "AccessControlPolicy defines an access control policy.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "AccessControlPolicySpec configures an access control policy.",
      "properties": {
        "apiKey": {
          "description": "AccessControlPolicyAPIKey configure an APIKey control policy.",
          "properties": {
            "forwardHeaders": {
              "additionalProperties": {
                "type": "string"
              },
              "description": "ForwardHeaders instructs the middleware to forward key metadata as header values upon successful authentication.",
              "type": "object"
            },
            "keySource": {
              "description": "KeySource defines how to extract API keys from requests.",
              "properties": {
                "cookie": {
                  "description": "Cookie is the name of a cookie.",
                  "type": "string"
                },
                "header": {
                  "description": "Header is the name of a header.",
                  "type": "string"
                },
                "headerAuthScheme": {
                  "description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
                  "type": "string"
                },
                "query": {
                  "description": "Query is the name of a query parameter.",
                  "type": "string"
                }
              },
              "type": "object",
              "additionalProperties": false
            },
            "keys": {
              "description": "Keys define the set of authorized keys to access a protected resource.",
              "items": {
                "description": "AccessControlPolicyAPIKeyKey defines an API key.",
                "properties": {
                  "id": {
                    "description": "ID is the unique identifier of the key.",
                    "type": "string"
                  },
                  "metadata": {
                    "additionalProperties": {
                      "type": "string"
                    },
                    "description": "Metadata holds arbitrary metadata for this key, can be used by ForwardHeaders.",
                    "type": "object"
                  },
                  "value": {
                    "description": "Value is the SHAKE-256 hash (using 64 bytes) of the API key.",
                    "type": "string"
                  }
                },
                "required": [
                  "id",
                  "value"
                ],
                "type": "object",
                "additionalProperties": false
              },
              "type": "array"
            }
          },
          "required": [
            "keySource"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "basicAuth": {
          "description": "AccessControlPolicyBasicAuth holds the HTTP basic authentication configuration.",
          "properties": {
            "forwardUsernameHeader": {
              "type": "string"
            },
            "realm": {
              "type": "string"
            },
            "stripAuthorizationHeader": {
              "type": "boolean"
            },
            "users": {
              "items": {
                "type": "string"
              },
              "type": "array"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "jwt": {
          "description": "AccessControlPolicyJWT configures a JWT access control policy.",
          "properties": {
            "claims": {
              "type": "string"
            },
            "forwardHeaders": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "jwksFile": {
              "type": "string"
            },
            "jwksUrl": {
              "type": "string"
            },
            "publicKey": {
              "type": "string"
            },
            "signingSecret": {
              "type": "string"
            },
            "signingSecretBase64Encoded": {
              "type": "boolean"
            },
            "stripAuthorizationHeader": {
              "type": "boolean"
            },
            "tokenQueryKey": {
              "type": "string"
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "oAuthIntro": {
          "description": "AccessControlOAuthIntro configures an OAuth 2.0 Token Introspection access control policy.",
          "properties": {
            "claims": {
              "type": "string"
            },
            "clientConfig": {
              "description": "AccessControlOAuthIntroClientConfig configures the OAuth 2.0 client for issuing token introspection requests.",
              "properties": {
                "headers": {
                  "additionalProperties": {
                    "type": "string"
                  },
                  "description": "Headers to set when sending requests to the Authorization Server.",
                  "type": "object"
                },
                "maxRetries": {
                  "default": 3,
                  "description": "MaxRetries defines the number of retries for introspection requests.",
                  "type": "integer"
                },
                "timeoutSeconds": {
                  "default": 5,
                  "description": "TimeoutSeconds configures the maximum amount of seconds to wait before giving up on requests.",
                  "type": "integer"
                },
                "tls": {
                  "description": "TLS configures TLS communication with the Authorization Server.",
                  "properties": {
                    "ca": {
                      "description": "CA sets the CA bundle used to sign the Authorization Server certificate.",
                      "type": "string"
                    },
                    "insecureSkipVerify": {
                      "description": "InsecureSkipVerify skips the Authorization Server certificate validation.\nFor testing purposes only, do not use in production.",
                      "type": "boolean"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                },
                "tokenTypeHint": {
                  "description": "TokenTypeHint is a hint to pass to the Authorization Server.\nSee https://tools.ietf.org/html/rfc7662#section-2.1 for more information.",
                  "type": "string"
                },
                "url": {
                  "description": "URL of the Authorization Server.",
                  "type": "string"
                }
              },
              "required": [
                "url"
              ],
              "type": "object",
              "additionalProperties": false
            },
            "forwardHeaders": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "tokenSource": {
              "description": "TokenSource describes how to extract tokens from HTTP requests.\nIf multiple sources are set, the order is the following: header > query > cookie.",
              "properties": {
                "cookie": {
                  "description": "Cookie is the name of a cookie.",
                  "type": "string"
                },
                "header": {
                  "description": "Header is the name of a header.",
                  "type": "string"
                },
                "headerAuthScheme": {
                  "description": "HeaderAuthScheme sets an optional auth scheme when Header is set to \"Authorization\".\nIf set, this scheme is removed from the token, and all requests not including it are dropped.",
                  "type": "string"
                },
                "query": {
                  "description": "Query is the name of a query parameter.",
                  "type": "string"
                }
              },
              "type": "object",
              "additionalProperties": false
            }
          },
          "required": [
            "clientConfig",
            "tokenSource"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "oidc": {
          "description": "AccessControlPolicyOIDC holds the OIDC authentication configuration.",
          "properties": {
            "authParams": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "claims": {
              "type": "string"
            },
            "clientId": {
              "type": "string"
            },
            "disableAuthRedirectionPaths": {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "forwardHeaders": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "issuer": {
              "type": "string"
            },
            "logoutUrl": {
              "type": "string"
            },
            "redirectUrl": {
              "type": "string"
            },
            "scopes": {
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "secret": {
              "description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
              "properties": {
                "name": {
                  "description": "name is unique within a namespace to reference a secret resource.",
                  "type": "string"
                },
                "namespace": {
                  "description": "namespace defines the space within which the secret name must be unique.",
                  "type": "string"
                }
              },
              "type": "object",
              "x-kubernetes-map-type": "atomic",
              "additionalProperties": false
            },
            "session": {
              "description": "Session holds session configuration.",
              "properties": {
                "domain": {
                  "type": "string"
                },
                "path": {
                  "type": "string"
                },
                "refresh": {
                  "type": "boolean"
                },
                "sameSite": {
                  "type": "string"
                },
                "secure": {
                  "type": "boolean"
                }
              },
              "type": "object",
              "additionalProperties": false
            },
            "stateCookie": {
              "description": "StateCookie holds state cookie configuration.",
              "properties": {
                "domain": {
                  "type": "string"
                },
                "path": {
                  "type": "string"
                },
                "sameSite": {
                  "type": "string"
                },
                "secure": {
                  "type": "boolean"
                }
              },
              "type": "object",
              "additionalProperties": false
            }
          },
          "type": "object",
          "additionalProperties": false
        },
        "oidcGoogle": {
          "description": "AccessControlPolicyOIDCGoogle holds the Google OIDC authentication configuration.",
          "properties": {
            "authParams": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "clientId": {
              "type": "string"
            },
            "emails": {
              "description": "Emails are the allowed emails to connect.",
              "items": {
                "type": "string"
              },
              "minItems": 1,
              "type": "array"
            },
            "forwardHeaders": {
              "additionalProperties": {
                "type": "string"
              },
              "type": "object"
            },
            "logoutUrl": {
              "type": "string"
            },
            "redirectUrl": {
              "type": "string"
            },
            "secret": {
              "description": "SecretReference represents a Secret Reference. It has enough information to retrieve secret\nin any namespace",
              "properties": {
                "name": {
                  "description": "name is unique within a namespace to reference a secret resource.",
                  "type": "string"
                },
                "namespace": {
                  "description": "namespace defines the space within which the secret name must be unique.",
                  "type": "string"
                }
              },
              "type": "object",
              "x-kubernetes-map-type": "atomic",
              "additionalProperties": false
            },
            "session": {
              "description": "Session holds session configuration.",
              "properties": {
                "domain": {
                  "type": "string"
                },
                "path": {
                  "type": "string"
                },
                "refresh": {
                  "type": "boolean"
                },
                "sameSite": {
                  "type": "string"
                },
                "secure": {
                  "type": "boolean"
                }
              },
              "type": "object",
              "additionalProperties": false
            },
            "stateCookie": {
              "description": "StateCookie holds state cookie configuration.",
              "properties": {
                "domain": {
                  "type": "string"
                },
                "path": {
                  "type": "string"
                },
                "sameSite": {
                  "type": "string"
                },
                "secure": {
                  "type": "boolean"
                }
              },
              "type": "object",
              "additionalProperties": false
            }
          },
          "type": "object",
          "additionalProperties": false
        }
      },
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "The current status of this access control policy.",
      "properties": {
        "specHash": {
          "type": "string"
        },
        "syncedAt": {
          "format": "date-time",
          "type": "string"
        },
        "version": {
          "type": "string"
        }
      },
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}