{
  "description": "GitlabDeployToken generates a GitLab deploy token.",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "GitlabDeployTokenSpec defines the desired state to generate a GitLab deploy token.",
      "properties": {
        "auth": {
          "description": "Auth configures how ESO authenticates with the GitLab API.",
          "properties": {
            "token": {
              "description": "Token references a secret containing a GitLab access token (personal, group, or\nproject) with the api scope and at least the Maintainer role on the target.",
              "properties": {
                "secretRef": {
                  "description": "SecretKeySelector is a reference to a specific 'key' within a Secret resource.\nIn some instances, `key` is a required field.",
                  "properties": {
                    "key": {
                      "description": "A key in the referenced Secret.\nSome instances of this field may be defaulted, in others it may be required.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[-._a-zA-Z0-9]+$",
                      "type": "string"
                    },
                    "name": {
                      "description": "The name of the Secret resource being referred to.",
                      "maxLength": 253,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
                      "type": "string"
                    },
                    "namespace": {
                      "description": "The namespace of the Secret resource being referred to.\nIgnored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.",
                      "maxLength": 63,
                      "minLength": 1,
                      "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?$",
                      "type": "string"
                    }
                  },
                  "type": "object",
                  "additionalProperties": false
                }
              },
              "required": [
                "secretRef"
              ],
              "type": "object",
              "additionalProperties": false
            }
          },
          "required": [
            "token"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "expiresAt": {
          "description": "ExpiresAt is an optional expiry for the deploy token. If omitted the token does\nnot expire on the GitLab side and is revoked only when the generator state is\ncleaned up (on regeneration or when the consuming ExternalSecret is deleted).",
          "format": "date-time",
          "type": "string"
        },
        "groupID": {
          "description": "GroupID is the numeric ID or unescaped path (e.g. parent/group) of the group to\ncreate the deploy token in. The generator URL-escapes paths before calling the\nGitLab API, so do not pre-encode. Mutually exclusive with projectID.",
          "minLength": 1,
          "type": "string"
        },
        "name": {
          "description": "Name of the deploy token.",
          "minLength": 1,
          "type": "string"
        },
        "projectID": {
          "description": "ProjectID is the numeric ID or unescaped path (e.g. group/project) of the\nproject to create the deploy token in. The generator URL-escapes paths before\ncalling the GitLab API, so do not pre-encode. Mutually exclusive with groupID.",
          "minLength": 1,
          "type": "string"
        },
        "scopes": {
          "description": "Scopes granted to the deploy token. At least one scope is required.",
          "items": {
            "description": "GitlabDeployTokenScope is a scope that can be granted to a GitLab deploy token.",
            "enum": [
              "read_repository",
              "read_registry",
              "write_registry",
              "read_package_registry",
              "write_package_registry",
              "read_virtual_registry",
              "write_virtual_registry"
            ],
            "type": "string"
          },
          "minItems": 1,
          "type": "array"
        },
        "url": {
          "description": "URL configures the GitLab instance URL. Defaults to https://gitlab.com.",
          "type": "string"
        },
        "username": {
          "description": "Username is an optional username for the deploy token. GitLab defaults it to\ngitlab+deploy-token-{n} when omitted.",
          "type": "string"
        }
      },
      "required": [
        "auth",
        "name",
        "scopes"
      ],
      "type": "object",
      "x-kubernetes-validations": [
        {
          "message": "exactly one of projectID or groupID must be set",
          "rule": "has(self.projectID) != has(self.groupID)"
        }
      ],
      "additionalProperties": false
    }
  },
  "type": "object"
}