crds/iam_v1beta1_iampolicymember.yaml

# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cnrm.cloud.google.com/version: 1.128.0
  creationTimestamp: null
  labels:
    cnrm.cloud.google.com/managed-by-kcc: "true"
    cnrm.cloud.google.com/system: "true"
  name: iampolicymembers.iam.cnrm.cloud.google.com
spec:
  group: iam.cnrm.cloud.google.com
  names:
    categories:
    - gcp
    kind: IAMPolicyMember
    plural: iampolicymembers
    shortNames:
    - gcpiampolicymember
    - gcpiampolicymembers
    singular: iampolicymember
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - description: When 'True' the most recent reconcile of the resource succeeded
      jsonPath: .status.conditions[?(@.type=='Ready')].status
      name: Ready
      type: string
    - description: The reason for the value in 'Ready'
      jsonPath: .status.conditions[?(@.type=='Ready')].reason
      name: Status
      type: string
    - jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
      name: Status Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        description: IAMPolicyMember is the Schema for the iampolicies API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: IAMPolicyMemberSpec defines the desired state of IAMPolicyMember
            oneOf:
            - required:
              - member
            - required:
              - memberFrom
            properties:
              condition:
                description: Immutable. Optional. The condition under which the binding
                  applies.
                properties:
                  description:
                    type: string
                  expression:
                    type: string
                  title:
                    type: string
                required:
                - expression
                - title
                type: object
              member:
                description: Immutable. The IAM identity to be bound to the role.
                  Exactly one of 'member' or 'memberFrom' must be used.
                type: string
              memberFrom:
                description: Immutable. The IAM identity to be bound to the role.
                  Exactly one of 'member' or 'memberFrom' must be used, and only one
                  subfield within 'memberFrom' can be used.
                oneOf:
                - required:
                  - bigQueryConnectionConnectionRef
                - required:
                  - logSinkRef
                - required:
                  - serviceAccountRef
                - required:
                  - serviceIdentityRef
                - required:
                  - sqlInstanceRef
                properties:
                  bigQueryConnectionConnectionRef:
                    description: BigQueryConnectionConnection whose service account
                      is to be bound to the role. Use the Type field to specifie the
                      connection type. For "spark" connetion, the service account
                      is in `status.observedState.spark.serviceAccountID`. For "cloudSQL"
                      connection, the service account is in `status.observedState.cloudSQL.serviceAccountID`.
                      For "cloudResource" connection, the service account is in `status.observedState.cloudResource.serviceAccountID`.
                    properties:
                      name:
                        type: string
                      namespace:
                        type: string
                      type:
                        description: Type field specifies the connection type of the
                          BigQueryConnectionConnection resource, whose service account
                          is to be bound to the role.
                        enum:
                        - spark
                        - cloudSQL
                        - cloudResource
                        type: string
                    required:
                    - name
                    - type
                    type: object
                  logSinkRef:
                    description: The LoggingLogSink whose writer identity (i.e. its
                      'status.writerIdentity') is to be bound to the role.
                    properties:
                      name:
                        type: string
                      namespace:
                        type: string
                    required:
                    - name
                    type: object
                  serviceAccountRef:
                    description: The IAMServiceAccount to be bound to the role.
                    properties:
                      name:
                        type: string
                      namespace:
                        type: string
                    required:
                    - name
                    type: object
                  serviceIdentityRef:
                    description: The ServiceIdentity whose service account (i.e.,
                      its 'status.email') is to be bound to the role.
                    properties:
                      name:
                        type: string
                      namespace:
                        type: string
                    required:
                    - name
                    type: object
                  sqlInstanceRef:
                    description: The SQLInstance whose service account (i.e. its 'status.serviceAccountEmailAddress')
                      is to be bound to the role.
                    properties:
                      name:
                        type: string
                      namespace:
                        type: string
                    required:
                    - name
                    type: object
                type: object
              resourceRef:
                description: Immutable. Required. The GCP resource to set the IAM
                  policy on.
                oneOf:
                - not:
                    required:
                    - external
                  required:
                  - name
                - not:
                    anyOf:
                    - required:
                      - name
                    - required:
                      - namespace
                  required:
                  - external
                - not:
                    anyOf:
                    - required:
                      - name
                    - required:
                      - namespace
                    - required:
                      - apiVersion
                    - required:
                      - external
                properties:
                  apiVersion:
                    type: string
                  external:
                    type: string
                  kind:
                    type: string
                  name:
                    type: string
                  namespace:
                    type: string
                required:
                - kind
                type: object
              role:
                description: Immutable. Required. The role for which the Member will
                  be bound.
                pattern: ^((projects|organizations)/[^/]+/)?roles/[\w_\.]+$
                type: string
            required:
            - resourceRef
            - role
            type: object
          status:
            description: IAMPolicyMemberStatus defines the observed state of IAMPolicyMember
            properties:
              conditions:
                description: Conditions represent the latest available observations
                  of the IAM policy's current state.
                items:
                  properties:
                    lastTransitionTime:
                      description: Last time the condition transitioned from one status
                        to another.
                      type: string
                    message:
                      description: Human-readable message indicating details about
                        last transition.
                      type: string
                    reason:
                      description: Unique, one-word, CamelCase reason for the condition's
                        last transition.
                      type: string
                    status:
                      description: Status is the status of the condition. Can be True,
                        False, Unknown.
                      type: string
                    type:
                      description: Type is the type of the condition.
                      type: string
                  type: object
                type: array
              observedGeneration:
                description: ObservedGeneration is the generation of the resource
                  that was most recently observed by the Config Connector controller.
                  If this is equal to metadata.generation, then that means that the
                  current reported status reflects the most recent desired state of
                  the resource.
                format: int64
                type: integer
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []