crds.yaml

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: buckets.rustfs.com
spec:
  group: rustfs.com
  names:
    categories: []
    kind: Bucket
    plural: buckets
    shortNames:
    - rfb
    singular: bucket
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.ready
      name: Ready
      type: boolean
    - jsonPath: .status.message
      name: Message
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: Auto-generated derived type for BucketSpec via `CustomResource`
        properties:
          spec:
            description: An S3 bucket in RustFS.
            properties:
              bucketName:
                description: Bucket name in RustFS; defaults to the CR name.
                nullable: true
                type: string
              connection:
                description: |-
                  Reference to a RustFS server. Exactly one of `secretRef` / `clusterRef`
                  must be set (validated at reconcile time).
                properties:
                  clusterRef:
                    description: Name of a cluster-scoped ClusterConnection.
                    nullable: true
                    type: string
                  secretRef:
                    description: |-
                      Name of a Secret in the resource's namespace holding `endpoint`,
                      `accessKey` and `secretKey` (optional: `region`, `insecure`).
                    nullable: true
                    type: string
                type: object
              deletionPolicy:
                default: Delete
                description: What happens to the remote resource when the CR is deleted.
                enum:
                - Delete
                - Retain
                type: string
              lifecycle:
                description: |-
                  Lifecycle rules; unset means unmanaged (the operator never reads or writes
                  the bucket's lifecycle configuration). An explicitly EMPTY list is not the
                  same thing: it means "no rules", and removes any configuration present on
                  the bucket.
                items:
                  description: |-
                    A single S3 lifecycle rule.

                    Deliberately a *subset* of the S3 lifecycle spec: expiration by age and
                    aborting stale multipart uploads. Transitions and non-current-version rules
                    are omitted — they only make sense with storage tiers / versioning, which
                    RustFS does not offer, and a CRD field that silently does nothing is worse
                    than no field.
                  properties:
                    abortIncompleteMultipartUploadDays:
                      description: |-
                        Abort multipart uploads left incomplete for this many days. Worth setting
                        on any bucket that takes large writes: aborted parts are invisible to a
                        normal LIST and still consume the disk.
                      format: int32
                      nullable: true
                      type: integer
                    expirationDays:
                      description: Expire objects this many days after creation.
                      format: int32
                      nullable: true
                      type: integer
                    id:
                      description: Rule ID, unique within the bucket.
                      type: string
                    prefix:
                      description: Object-key prefix the rule applies to. Unset = the whole bucket.
                      nullable: true
                      type: string
                    status:
                      default: Enabled
                      description: Enabled (default) or Disabled.
                      enum:
                      - Enabled
                      - Disabled
                      type: string
                  required:
                  - id
                  type: object
                nullable: true
                type: array
              quotaBytes:
                description: Hard quota in bytes; unset means unmanaged.
                format: uint64
                minimum: 0.0
                nullable: true
                type: integer
              versioning:
                description: Desired versioning state; unset means unmanaged.
                nullable: true
                type: boolean
            required:
            - connection
            type: object
          status:
            description: Shared status for all RustFS resources.
            nullable: true
            properties:
              message:
                description: Human-readable state or last error.
                nullable: true
                type: string
              observedGeneration:
                description: Generation last acted upon.
                format: int64
                nullable: true
                type: integer
              ready:
                default: false
                description: True once the remote resource matches the spec.
                type: boolean
            type: object
        required:
        - spec
        title: Bucket
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: users.rustfs.com
spec:
  group: rustfs.com
  names:
    categories: []
    kind: User
    plural: users
    shortNames:
    - rfu
    singular: user
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.ready
      name: Ready
      type: boolean
    - jsonPath: .status.message
      name: Message
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: Auto-generated derived type for UserSpec via `CustomResource`
        properties:
          spec:
            description: |-
              An IAM user (identity) in RustFS: a username with a password. Policies
              attach to the user; applications should authenticate with [`AccessKey`]s
              issued for the user rather than the password itself.
            properties:
              connection:
                description: |-
                  Reference to a RustFS server. Exactly one of `secretRef` / `clusterRef`
                  must be set (validated at reconcile time).
                properties:
                  clusterRef:
                    description: Name of a cluster-scoped ClusterConnection.
                    nullable: true
                    type: string
                  secretRef:
                    description: |-
                      Name of a Secret in the resource's namespace holding `endpoint`,
                      `accessKey` and `secretKey` (optional: `region`, `insecure`).
                    nullable: true
                    type: string
                type: object
              deletionPolicy:
                default: Delete
                description: What happens to the remote resource when the CR is deleted.
                enum:
                - Delete
                - Retain
                type: string
              enabled:
                default: true
                description: Whether the user is enabled.
                type: boolean
              passwordRef:
                description: |-
                  Secret holding the user's password (key defaults to `password`).
                  Only applied when the user is first created; RustFS cannot update it.
                properties:
                  key:
                    description: Key within the Secret; each consumer documents its default.
                    nullable: true
                    type: string
                  name:
                    description: Secret name.
                    type: string
                required:
                - name
                type: object
              policies:
                default: []
                description: |-
                  Policies attached to the user; managed declaratively (extra
                  attachments are detached).
                items:
                  type: string
                type: array
              username:
                description: Username in RustFS; defaults to the CR name.
                nullable: true
                type: string
            required:
            - connection
            - passwordRef
            type: object
          status:
            description: Shared status for all RustFS resources.
            nullable: true
            properties:
              message:
                description: Human-readable state or last error.
                nullable: true
                type: string
              observedGeneration:
                description: Generation last acted upon.
                format: int64
                nullable: true
                type: integer
              ready:
                default: false
                description: True once the remote resource matches the spec.
                type: boolean
            type: object
        required:
        - spec
        title: User
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: policies.rustfs.com
spec:
  group: rustfs.com
  names:
    categories: []
    kind: Policy
    plural: policies
    shortNames:
    - rfp
    singular: policy
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.ready
      name: Ready
      type: boolean
    - jsonPath: .status.message
      name: Message
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: Auto-generated derived type for PolicySpec via `CustomResource`
        properties:
          spec:
            description: An IAM policy in RustFS.
            properties:
              connection:
                description: |-
                  Reference to a RustFS server. Exactly one of `secretRef` / `clusterRef`
                  must be set (validated at reconcile time).
                properties:
                  clusterRef:
                    description: Name of a cluster-scoped ClusterConnection.
                    nullable: true
                    type: string
                  secretRef:
                    description: |-
                      Name of a Secret in the resource's namespace holding `endpoint`,
                      `accessKey` and `secretKey` (optional: `region`, `insecure`).
                    nullable: true
                    type: string
                type: object
              deletionPolicy:
                default: Delete
                description: What happens to the remote resource when the CR is deleted.
                enum:
                - Delete
                - Retain
                type: string
              document:
                description: IAM policy document, written inline as YAML/JSON.
                type: object
                x-kubernetes-preserve-unknown-fields: true
              policyName:
                description: Policy name in RustFS; defaults to the CR name.
                nullable: true
                type: string
            required:
            - connection
            - document
            type: object
          status:
            description: Shared status for all RustFS resources.
            nullable: true
            properties:
              message:
                description: Human-readable state or last error.
                nullable: true
                type: string
              observedGeneration:
                description: Generation last acted upon.
                format: int64
                nullable: true
                type: integer
              ready:
                default: false
                description: True once the remote resource matches the spec.
                type: boolean
            type: object
        required:
        - spec
        title: Policy
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: accesskeys.rustfs.com
spec:
  group: rustfs.com
  names:
    categories: []
    kind: AccessKey
    plural: accesskeys
    shortNames:
    - rfak
    singular: accesskey
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .status.ready
      name: Ready
      type: boolean
    - jsonPath: .status.accessKey
      name: AccessKey
      type: string
    - jsonPath: .status.message
      name: Message
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: Auto-generated derived type for AccessKeySpec via `CustomResource`
        properties:
          spec:
            description: |-
              An access key (AK/SK credential pair, a RustFS "service account") owned
              by a [`User`]. A user can have many. The operator authenticates to
              RustFS *as the user* to issue the key (the admin API only mints keys for
              the calling identity), generates the credentials, and writes them to a
              Secret in the CR's namespace, owner-referenced so it is garbage-collected
              with the CR.
            properties:
              accessKey:
                description: Explicit access key id; generated when omitted.
                nullable: true
                type: string
              connection:
                description: |-
                  Reference to a RustFS server. Exactly one of `secretRef` / `clusterRef`
                  must be set (validated at reconcile time).
                properties:
                  clusterRef:
                    description: Name of a cluster-scoped ClusterConnection.
                    nullable: true
                    type: string
                  secretRef:
                    description: |-
                      Name of a Secret in the resource's namespace holding `endpoint`,
                      `accessKey` and `secretKey` (optional: `region`, `insecure`).
                    nullable: true
                    type: string
                type: object
              deletionPolicy:
                default: Delete
                description: What happens to the remote resource when the CR is deleted.
                enum:
                - Delete
                - Retain
                type: string
              description:
                description: Optional description stored on the service account.
                nullable: true
                type: string
              passwordRef:
                description: Secret holding that user's password (key defaults to `password`).
                properties:
                  key:
                    description: Key within the Secret; each consumer documents its default.
                    nullable: true
                    type: string
                  name:
                    description: Secret name.
                    type: string
                required:
                - name
                type: object
              policy:
                description: |-
                  Optional inline policy restricting what this key may do (subset of
                  the user's permissions), written as YAML/JSON.
                type: object
                x-kubernetes-preserve-unknown-fields: true
              targetSecretName:
                description: |-
                  Name of the Secret the operator writes the credentials to
                  (keys `accessKey`, `secretKey`, `endpoint`); defaults to
                  `<cr-name>-credentials`.
                nullable: true
                type: string
              user:
                description: Username of the owning RustFS user.
                type: string
            required:
            - connection
            - passwordRef
            - user
            type: object
          status:
            description: Status for AccessKey resources.
            nullable: true
            properties:
              accessKey:
                description: The issued access key id.
                nullable: true
                type: string
              message:
                nullable: true
                type: string
              observedGeneration:
                format: int64
                nullable: true
                type: integer
              ready:
                default: false
                type: boolean
            type: object
        required:
        - spec
        title: AccessKey
        type: object
    served: true
    storage: true
    subresources:
      status: {}
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: clusterconnections.rustfs.com
spec:
  group: rustfs.com
  names:
    categories: []
    kind: ClusterConnection
    plural: clusterconnections
    shortNames:
    - rfcc
    singular: clusterconnection
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.endpoint
      name: Endpoint
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: Auto-generated derived type for ClusterConnectionSpec via `CustomResource`
        properties:
          spec:
            description: |-
              A centrally managed connection to a RustFS server. Cluster-scoped; the
              referenced credentials Secret lives in the operator's own namespace, so
              application namespaces never see admin credentials.
            properties:
              allowedNamespaces:
                description: |-
                  Namespaces whose resources may use this connection.
                  Absent means all namespaces are allowed.
                items:
                  type: string
                nullable: true
                type: array
              credentialsSecretRef:
                description: |-
                  Name of the Secret in the operator's namespace holding `accessKey`
                  and `secretKey`.
                type: string
              endpoint:
                description: RustFS endpoint URL, e.g. `http://rustfs.storage.svc:9000`.
                type: string
              insecure:
                default: false
                description: Skip TLS verification.
                type: boolean
              region:
                description: AWS region; defaults to `us-east-1`.
                nullable: true
                type: string
            required:
            - credentialsSecretRef
            - endpoint
            type: object
        required:
        - spec
        title: ClusterConnection
        type: object
    served: true
    storage: true
    subresources: {}