{{- if .Values.installCRDs }}
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    {{- with .Values.crds.annotations }}
    {{- toYaml . | nindent 4}}
    {{- end }}
    {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
    cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
    {{- end }}
    controller-gen.kubebuilder.io/version: v0.13.0
  name: externalsecrets.external-secrets.io
spec:
  group: external-secrets.io
  names:
    categories:
      - externalsecrets
    kind: ExternalSecret
    listKind: ExternalSecretList
    plural: externalsecrets
    shortNames:
      - es
    singular: externalsecret
  scope: Namespaced
  versions:
    - additionalPrinterColumns:
        - jsonPath: .spec.secretStoreRef.name
          name: Store
          type: string
        - jsonPath: .spec.refreshInterval
          name: Refresh Interval
          type: string
        - jsonPath: .status.conditions[?(@.type=="Ready")].reason
          name: Status
          type: string
      deprecated: true
      name: v1alpha1
      schema:
        openAPIV3Schema:
          description: ExternalSecret is the Schema for the external-secrets API.
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
              type: string
            kind:
              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
              type: string
            metadata:
              type: object
            spec:
              description: ExternalSecretSpec defines the desired state of ExternalSecret.
              properties:
                data:
                  description: Data defines the connection between the Kubernetes Secret keys and the Provider data
                  items:
                    description: ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.<key>) and the Provider data.
                    properties:
                      remoteRef:
                        description: ExternalSecretDataRemoteRef defines Provider data location.
                        properties:
                          conversionStrategy:
                            default: Default
                            description: Used to define a conversion Strategy
                            enum:
                              - Default
                              - Unicode
                            type: string
                          key:
                            description: Key is the key used in the Provider, mandatory
                            type: string
                          property:
                            description: Used to select a specific property of the Provider value (if a map), if supported
                            type: string
                          version:
                            description: Used to select a specific version of the Provider value, if supported
                            type: string
                        required:
                          - key
                        type: object
                      secretKey:
                        type: string
                    required:
                      - remoteRef
                      - secretKey
                    type: object
                  type: array
                dataFrom:
                  description: DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order
                  items:
                    description: ExternalSecretDataRemoteRef defines Provider data location.
                    properties:
                      conversionStrategy:
                        default: Default
                        description: Used to define a conversion Strategy
                        enum:
                          - Default
                          - Unicode
                        type: string
                      key:
                        description: Key is the key used in the Provider, mandatory
                        type: string
                      property:
                        description: Used to select a specific property of the Provider value (if a map), if supported
                        type: string
                      version:
                        description: Used to select a specific version of the Provider value, if supported
                        type: string
                    required:
                      - key
                    type: object
                  type: array
                refreshInterval:
                  default: 1h
                  description: RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h" May be set to zero to fetch and create it once. Defaults to 1h.
                  type: string
                secretStoreRef:
                  description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
                  properties:
                    kind:
                      description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to `SecretStore`
                      type: string
                    name:
                      description: Name of the SecretStore resource
                      type: string
                  required:
                    - name
                  type: object
                target:
                  description: ExternalSecretTarget defines the Kubernetes Secret to be created There can be only one target per ExternalSecret.
                  properties:
                    creationPolicy:
                      default: Owner
                      description: CreationPolicy defines rules on how to create the resulting Secret Defaults to 'Owner'
                      enum:
                        - Owner
                        - Merge
                        - None
                      type: string
                    immutable:
                      description: Immutable defines if the final secret will be immutable
                      type: boolean
                    name:
                      description: Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource
                      type: string
                    template:
                      description: Template defines a blueprint for the created Secret resource.
                      properties:
                        data:
                          additionalProperties:
                            type: string
                          type: object
                        engineVersion:
                          default: v1
                          description: EngineVersion specifies the template engine version that should be used to compile/execute the template specified in .data and .templateFrom[].
                          enum:
                            - v1
                            - v2
                          type: string
                        metadata:
                          description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
                          properties:
                            annotations:
                              additionalProperties:
                                type: string
                              type: object
                            labels:
                              additionalProperties:
                                type: string
                              type: object
                          type: object
                        templateFrom:
                          items:
                            maxProperties: 1
                            minProperties: 1
                            properties:
                              configMap:
                                properties:
                                  items:
                                    items:
                                      properties:
                                        key:
                                          type: string
                                      required:
                                        - key
                                      type: object
                                    type: array
                                  name:
                                    type: string
                                required:
                                  - items
                                  - name
                                type: object
                              secret:
                                properties:
                                  items:
                                    items:
                                      properties:
                                        key:
                                          type: string
                                      required:
                                        - key
                                      type: object
                                    type: array
                                  name:
                                    type: string
                                required:
                                  - items
                                  - name
                                type: object
                            type: object
                          type: array
                        type:
                          type: string
                      type: object
                  type: object
              required:
                - secretStoreRef
                - target
              type: object
            status:
              properties:
                binding:
                  description: Binding represents a servicebinding.io Provisioned Service reference to the secret
                  properties:
                    name:
                      description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
                      type: string
                  type: object
                  x-kubernetes-map-type: atomic
                conditions:
                  items:
                    properties:
                      lastTransitionTime:
                        format: date-time
                        type: string
                      message:
                        type: string
                      reason:
                        type: string
                      status:
                        type: string
                      type:
                        type: string
                    required:
                      - status
                      - type
                    type: object
                  type: array
                refreshTime:
                  description: refreshTime is the time and date the external secret was fetched and the target secret updated
                  format: date-time
                  nullable: true
                  type: string
                syncedResourceVersion:
                  description: SyncedResourceVersion keeps track of the last synced version
                  type: string
              type: object
          type: object
      served: true
      storage: false
      subresources:
        status: {}
    - additionalPrinterColumns:
        - jsonPath: .spec.secretStoreRef.name
          name: Store
          type: string
        - jsonPath: .spec.refreshInterval
          name: Refresh Interval
          type: string
        - jsonPath: .status.conditions[?(@.type=="Ready")].reason
          name: Status
          type: string
        - jsonPath: .status.conditions[?(@.type=="Ready")].status
          name: Ready
          type: string
      name: v1beta1
      schema:
        openAPIV3Schema:
          description: ExternalSecret is the Schema for the external-secrets API.
          properties:
            apiVersion:
              description: 'APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
              type: string
            kind:
              description: 'Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
              type: string
            metadata:
              type: object
            spec:
              description: ExternalSecretSpec defines the desired state of ExternalSecret.
              properties:
                data:
                  description: Data defines the connection between the Kubernetes Secret keys and the Provider data
                  items:
                    description: ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.<key>) and the Provider data.
                    properties:
                      remoteRef:
                        description: RemoteRef points to the remote secret and defines which secret (version/property/..) to fetch.
                        properties:
                          conversionStrategy:
                            default: Default
                            description: Used to define a conversion Strategy
                            enum:
                              - Default
                              - Unicode
                            type: string
                          decodingStrategy:
                            default: None
                            description: Used to define a decoding Strategy
                            enum:
                              - Auto
                              - Base64
                              - Base64URL
                              - None
                            type: string
                          key:
                            description: Key is the key used in the Provider, mandatory
                            type: string
                          metadataPolicy:
                            default: None
                            description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
                            enum:
                              - None
                              - Fetch
                            type: string
                          property:
                            description: Used to select a specific property of the Provider value (if a map), if supported
                            type: string
                          version:
                            description: Used to select a specific version of the Provider value, if supported
                            type: string
                        required:
                          - key
                        type: object
                      secretKey:
                        description: SecretKey defines the key in which the controller stores the value. This is the key in the Kind=Secret
                        type: string
                      sourceRef:
                        description: SourceRef allows you to override the source from which the value will pulled from.
                        maxProperties: 1
                        properties:
                          generatorRef:
                            description: "GeneratorRef points to a generator custom resource. \n Deprecated: The generatorRef is not implemented in .data[]. this will be removed with v1."
                            properties:
                              apiVersion:
                                default: generators.external-secrets.io/v1alpha1
                                description: Specify the apiVersion of the generator resource
                                type: string
                              kind:
                                description: Specify the Kind of the resource, e.g. Password, ACRAccessToken etc.
                                type: string
                              name:
                                description: Specify the name of the generator resource
                                type: string
                            required:
                              - kind
                              - name
                            type: object
                          storeRef:
                            description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
                            properties:
                              kind:
                                description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to `SecretStore`
                                type: string
                              name:
                                description: Name of the SecretStore resource
                                type: string
                            required:
                              - name
                            type: object
                        type: object
                    required:
                      - remoteRef
                      - secretKey
                    type: object
                  type: array
                dataFrom:
                  description: DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order
                  items:
                    properties:
                      extract:
                        description: 'Used to extract multiple key/value pairs from one secret Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.'
                        properties:
                          conversionStrategy:
                            default: Default
                            description: Used to define a conversion Strategy
                            enum:
                              - Default
                              - Unicode
                            type: string
                          decodingStrategy:
                            default: None
                            description: Used to define a decoding Strategy
                            enum:
                              - Auto
                              - Base64
                              - Base64URL
                              - None
                            type: string
                          key:
                            description: Key is the key used in the Provider, mandatory
                            type: string
                          metadataPolicy:
                            default: None
                            description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
                            enum:
                              - None
                              - Fetch
                            type: string
                          property:
                            description: Used to select a specific property of the Provider value (if a map), if supported
                            type: string
                          version:
                            description: Used to select a specific version of the Provider value, if supported
                            type: string
                        required:
                          - key
                        type: object
                      find:
                        description: 'Used to find secrets based on tags or regular expressions Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.'
                        properties:
                          conversionStrategy:
                            default: Default
                            description: Used to define a conversion Strategy
                            enum:
                              - Default
                              - Unicode
                            type: string
                          decodingStrategy:
                            default: None
                            description: Used to define a decoding Strategy
                            enum:
                              - Auto
                              - Base64
                              - Base64URL
                              - None
                            type: string
                          name:
                            description: Finds secrets based on the name.
                            properties:
                              regexp:
                                description: Finds secrets base
                                type: string
                            type: object
                          path:
                            description: A root path to start the find operations.
                            type: string
                          tags:
                            additionalProperties:
                              type: string
                            description: Find secrets based on tags.
                            type: object
                        type: object
                      rewrite:
                        description: Used to rewrite secret Keys after getting them from the secret Provider Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)
                        items:
                          properties:
                            regexp:
                              description: Used to rewrite with regular expressions. The resulting key will be the output of a regexp.ReplaceAll operation.
                              properties:
                                source:
                                  description: Used to define the regular expression of a re.Compiler.
                                  type: string
                                target:
                                  description: Used to define the target pattern of a ReplaceAll operation.
                                  type: string
                              required:
                                - source
                                - target
                              type: object
                            transform:
                              description: Used to apply string transformation on the secrets. The resulting key will be the output of the template applied by the operation.
                              properties:
                                template:
                                  description: Used to define the template to apply on the secret name. `.value ` will specify the secret name in the template.
                                  type: string
                              required:
                                - template
                              type: object
                          type: object
                        type: array
                      sourceRef:
                        description: SourceRef points to a store or generator which contains secret values ready to use. Use this in combination with Extract or Find pull values out of a specific SecretStore. When sourceRef points to a generator Extract or Find is not supported. The generator returns a static map of values
                        maxProperties: 1
                        properties:
                          generatorRef:
                            description: GeneratorRef points to a generator custom resource.
                            properties:
                              apiVersion:
                                default: generators.external-secrets.io/v1alpha1
                                description: Specify the apiVersion of the generator resource
                                type: string
                              kind:
                                description: Specify the Kind of the resource, e.g. Password, ACRAccessToken etc.
                                type: string
                              name:
                                description: Specify the name of the generator resource
                                type: string
                            required:
                              - kind
                              - name
                            type: object
                          storeRef:
                            description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
                            properties:
                              kind:
                                description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to `SecretStore`
                                type: string
                              name:
                                description: Name of the SecretStore resource
                                type: string
                            required:
                              - name
                            type: object
                        type: object
                    type: object
                  type: array
                refreshInterval:
                  default: 1h
                  description: RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h" May be set to zero to fetch and create it once. Defaults to 1h.
                  type: string
                secretStoreRef:
                  description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
                  properties:
                    kind:
                      description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to `SecretStore`
                      type: string
                    name:
                      description: Name of the SecretStore resource
                      type: string
                  required:
                    - name
                  type: object
                target:
                  default:
                    creationPolicy: Owner
                    deletionPolicy: Retain
                  description: ExternalSecretTarget defines the Kubernetes Secret to be created There can be only one target per ExternalSecret.
                  properties:
                    creationPolicy:
                      default: Owner
                      description: CreationPolicy defines rules on how to create the resulting Secret Defaults to 'Owner'
                      enum:
                        - Owner
                        - Orphan
                        - Merge
                        - None
                      type: string
                    deletionPolicy:
                      default: Retain
                      description: DeletionPolicy defines rules on how to delete the resulting Secret Defaults to 'Retain'
                      enum:
                        - Delete
                        - Merge
                        - Retain
                      type: string
                    immutable:
                      description: Immutable defines if the final secret will be immutable
                      type: boolean
                    name:
                      description: Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource
                      type: string
                    template:
                      description: Template defines a blueprint for the created Secret resource.
                      properties:
                        data:
                          additionalProperties:
                            type: string
                          type: object
                        engineVersion:
                          default: v2
                          description: EngineVersion specifies the template engine version that should be used to compile/execute the template specified in .data and .templateFrom[].
                          enum:
                            - v1
                            - v2
                          type: string
                        mergePolicy:
                          default: Replace
                          enum:
                            - Replace
                            - Merge
                          type: string
                        metadata:
                          description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
                          properties:
                            annotations:
                              additionalProperties:
                                type: string
                              type: object
                            labels:
                              additionalProperties:
                                type: string
                              type: object
                          type: object
                        templateFrom:
                          items:
                            properties:
                              configMap:
                                properties:
                                  items:
                                    items:
                                      properties:
                                        key:
                                          type: string
                                        templateAs:
                                          default: Values
                                          enum:
                                            - Values
                                            - KeysAndValues
                                          type: string
                                      required:
                                        - key
                                      type: object
                                    type: array
                                  name:
                                    type: string
                                required:
                                  - items
                                  - name
                                type: object
                              literal:
                                type: string
                              secret:
                                properties:
                                  items:
                                    items:
                                      properties:
                                        key:
                                          type: string
                                        templateAs:
                                          default: Values
                                          enum:
                                            - Values
                                            - KeysAndValues
                                          type: string
                                      required:
                                        - key
                                      type: object
                                    type: array
                                  name:
                                    type: string
                                required:
                                  - items
                                  - name
                                type: object
                              target:
                                default: Data
                                enum:
                                  - Data
                                  - Annotations
                                  - Labels
                                type: string
                            type: object
                          type: array
                        type:
                          type: string
                      type: object
                  type: object
              type: object
            status:
              properties:
                binding:
                  description: Binding represents a servicebinding.io Provisioned Service reference to the secret
                  properties:
                    name:
                      description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names TODO: Add other useful fields. apiVersion, kind, uid?'
                      type: string
                  type: object
                  x-kubernetes-map-type: atomic
                conditions:
                  items:
                    properties:
                      lastTransitionTime:
                        format: date-time
                        type: string
                      message:
                        type: string
                      reason:
                        type: string
                      status:
                        type: string
                      type:
                        type: string
                    required:
                      - status
                      - type
                    type: object
                  type: array
                refreshTime:
                  description: refreshTime is the time and date the external secret was fetched and the target secret updated
                  format: date-time
                  nullable: true
                  type: string
                syncedResourceVersion:
                  description: SyncedResourceVersion keeps track of the last synced version
                  type: string
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}
{{- if .Values.crds.conversion.enabled }}
  conversion:
    strategy: Webhook
    webhook:
      conversionReviewVersions:
        - v1
      clientConfig:
        service:
          name: {{ include "external-secrets.fullname" . }}-webhook
          namespace: {{ .Release.Namespace | quote }}
          path: /convert
{{- end }}
{{- end }}
