apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  labels:
    external-secrets.io/component: controller
  name: pushsecrets.external-secrets.io
spec:
  group: external-secrets.io
  names:
    categories:
      - external-secrets
    kind: PushSecret
    listKind: PushSecretList
    plural: pushsecrets
    shortNames:
      - ps
    singular: pushsecret
  scope: Namespaced
  versions:
    - additionalPrinterColumns:
        - jsonPath: .metadata.creationTimestamp
          name: AGE
          type: date
        - jsonPath: .status.conditions[?(@.type=="Ready")].reason
          name: Status
          type: string
        - jsonPath: .status.refreshTime
          name: Last Sync
          type: date
      name: v1alpha1
      schema:
        openAPIV3Schema:
          description: PushSecret is the Schema for the PushSecrets API that enables pushing Kubernetes secrets to external secret providers.
          properties:
            apiVersion:
              description: |-
                APIVersion defines the versioned schema of this representation of an object.
                Servers should convert recognized schemas to the latest internal value, and
                may reject unrecognized values.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
              type: string
            kind:
              description: |-
                Kind is a string value representing the REST resource this object represents.
                Servers may infer this from the endpoint the client submits requests to.
                Cannot be updated.
                In CamelCase.
                More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
              type: string
            metadata:
              type: object
            spec:
              description: PushSecretSpec configures the behavior of the PushSecret.
              properties:
                data:
                  description: Secret Data that should be pushed to providers
                  items:
                    description: PushSecretData defines data to be pushed to the provider and associated metadata.
                    properties:
                      conversionStrategy:
                        default: None
                        description: Used to define a conversion Strategy for the secret keys
                        enum:
                          - None
                          - ReverseUnicode
                        type: string
                      match:
                        description: Match a given Secret Key to be pushed to the provider.
                        properties:
                          remoteRef:
                            description: Remote Refs to push to providers.
                            properties:
                              property:
                                description: Name of the property in the resulting secret
                                type: string
                              remoteKey:
                                description: Name of the resulting provider secret.
                                type: string
                            required:
                              - remoteKey
                            type: object
                          secretKey:
                            description: Secret Key to be pushed
                            type: string
                        required:
                          - remoteRef
                        type: object
                      metadata:
                        description: |-
                          Metadata is metadata attached to the secret.
                          The structure of metadata is provider specific, please look it up in the provider documentation.
                        x-kubernetes-preserve-unknown-fields: true
                    required:
                      - match
                    type: object
                  type: array
                dataTo:
                  description: DataTo defines bulk push rules that expand source Secret keys into provider entries.
                  items:
                    description: PushSecretDataTo defines how to bulk-push secrets to providers without explicit per-key mappings.
                    properties:
                      conversionStrategy:
                        default: None
                        description: Used to define a conversion Strategy for the secret keys
                        enum:
                          - None
                          - ReverseUnicode
                        type: string
                      match:
                        description: |-
                          Match pattern for selecting keys from the source Secret.
                          If not specified, all keys are selected.
                        properties:
                          regexp:
                            description: |-
                              Regexp matches keys by regular expression.
                              If not specified, all keys are matched.
                            type: string
                        type: object
                      metadata:
                        description: |-
                          Metadata is metadata attached to the secret.
                          The structure of metadata is provider specific, please look it up in the provider documentation.
                        x-kubernetes-preserve-unknown-fields: true
                      remoteKey:
                        description: |-
                          RemoteKey is the name of the single provider secret that will receive ALL
                          matched keys bundled as a JSON object (e.g. {"DB_HOST":"...","DB_USER":"..."}).
                          When set, per-key expansion is skipped and a single push is performed.
                          The provider's store prefix (if any) is still prepended to this value.
                          When not set, each matched key is pushed as its own individual provider secret.
                        type: string
                      rewrite:
                        description: |-
                          Rewrite operations to transform keys before pushing to the provider.
                          Operations are applied sequentially.
                        items:
                          description: PushSecretRewrite defines how to transform secret keys before pushing.
                          properties:
                            regexp:
                              description: Used to rewrite with regular expressions.
                              properties:
                                source:
                                  description: Used to define the regular expression of a re.Compiler.
                                  type: string
                                target:
                                  description: Used to define the target pattern of a ReplaceAll operation.
                                  type: string
                              required:
                                - source
                                - target
                              type: object
                            transform:
                              description: Used to apply string transformation on the secrets.
                              properties:
                                template:
                                  description: |-
                                    Used to define the template to apply on the secret name.
                                    `.value ` will specify the secret name in the template.
                                  type: string
                              required:
                                - template
                              type: object
                          type: object
                          x-kubernetes-validations:
                            - message: exactly one of regexp or transform must be set
                              rule: (has(self.regexp) && !has(self.transform)) || (!has(self.regexp) && has(self.transform))
                        type: array
                      storeRef:
                        description: StoreRef specifies which SecretStore to push to. Required.
                        properties:
                          kind:
                            default: SecretStore
                            description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
                            enum:
                              - SecretStore
                              - ClusterSecretStore
                            type: string
                          labelSelector:
                            description: Optionally, sync to secret stores with label selector
                            properties:
                              matchExpressions:
                                description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
                                items:
                                  description: |-
                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                    relates the key and values.
                                  properties:
                                    key:
                                      description: key is the label key that the selector applies to.
                                      type: string
                                    operator:
                                      description: |-
                                        operator represents a key's relationship to a set of values.
                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                      type: string
                                    values:
                                      description: |-
                                        values is an array of string values. If the operator is In or NotIn,
                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty. This array is replaced during a strategic
                                        merge patch.
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                  required:
                                    - key
                                    - operator
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              matchLabels:
                                additionalProperties:
                                  type: string
                                description: |-
                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                type: object
                            type: object
                            x-kubernetes-map-type: atomic
                          name:
                            description: Optionally, sync to the SecretStore of the given name
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                        type: object
                    type: object
                    x-kubernetes-validations:
                      - message: storeRef must specify either name or labelSelector
                        rule: has(self.storeRef) && (has(self.storeRef.name) || has(self.storeRef.labelSelector))
                      - message: 'remoteKey and rewrite are mutually exclusive: rewrite is only supported in per-key mode (without remoteKey)'
                        rule: '!has(self.remoteKey) || !has(self.rewrite) || size(self.rewrite) == 0'
                  type: array
                deletionPolicy:
                  default: None
                  description: Deletion Policy to handle Secrets in the provider.
                  enum:
                    - Delete
                    - None
                  type: string
                refreshInterval:
                  default: 1h0m0s
                  description: The Interval to which External Secrets will try to push a secret definition
                  type: string
                secretStoreRefs:
                  items:
                    description: PushSecretStoreRef contains a reference on how to sync to a SecretStore.
                    properties:
                      kind:
                        default: SecretStore
                        description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
                        enum:
                          - SecretStore
                          - ClusterSecretStore
                        type: string
                      labelSelector:
                        description: Optionally, sync to secret stores with label selector
                        properties:
                          matchExpressions:
                            description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
                            items:
                              description: |-
                                A label selector requirement is a selector that contains values, a key, and an operator that
                                relates the key and values.
                              properties:
                                key:
                                  description: key is the label key that the selector applies to.
                                  type: string
                                operator:
                                  description: |-
                                    operator represents a key's relationship to a set of values.
                                    Valid operators are In, NotIn, Exists and DoesNotExist.
                                  type: string
                                values:
                                  description: |-
                                    values is an array of string values. If the operator is In or NotIn,
                                    the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                    the values array must be empty. This array is replaced during a strategic
                                    merge patch.
                                  items:
                                    type: string
                                  type: array
                                  x-kubernetes-list-type: atomic
                              required:
                                - key
                                - operator
                              type: object
                            type: array
                            x-kubernetes-list-type: atomic
                          matchLabels:
                            additionalProperties:
                              type: string
                            description: |-
                              matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                              map is equivalent to an element of matchExpressions, whose key field is "key", the
                              operator is "In", and the values array contains only "value". The requirements are ANDed.
                            type: object
                        type: object
                        x-kubernetes-map-type: atomic
                      name:
                        description: Optionally, sync to the SecretStore of the given name
                        maxLength: 253
                        minLength: 1
                        pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                        type: string
                    type: object
                  type: array
                selector:
                  description: The Secret Selector (k8s source) for the Push Secret
                  maxProperties: 1
                  minProperties: 1
                  properties:
                    generatorRef:
                      description: Point to a generator to create a Secret.
                      properties:
                        apiVersion:
                          default: generators.external-secrets.io/v1alpha1
                          description: Specify the apiVersion of the generator resource
                          type: string
                        kind:
                          description: Specify the Kind of the generator resource
                          enum:
                            - ACRAccessToken
                            - ClusterGenerator
                            - CloudsmithAccessToken
                            - ECRAuthorizationToken
                            - Fake
                            - GCRAccessToken
                            - GithubAccessToken
                            - QuayAccessToken
                            - Password
                            - SSHKey
                            - STSSessionToken
                            - UUID
                            - VaultDynamicSecret
                            - Webhook
                            - Grafana
                            - MFA
                          type: string
                        name:
                          description: Specify the name of the generator resource
                          maxLength: 253
                          minLength: 1
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          type: string
                      required:
                        - kind
                        - name
                      type: object
                    secret:
                      description: Select a Secret to Push.
                      properties:
                        name:
                          description: |-
                            Name of the Secret.
                            The Secret must exist in the same namespace as the PushSecret manifest.
                          maxLength: 253
                          minLength: 1
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          type: string
                        selector:
                          description: Selector chooses secrets using a labelSelector.
                          properties:
                            matchExpressions:
                              description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description: key is the label key that the selector applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                  - key
                                  - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                      type: object
                  type: object
                template:
                  description: Template defines a blueprint for the created Secret resource.
                  properties:
                    data:
                      additionalProperties:
                        type: string
                      type: object
                    engineVersion:
                      default: v2
                      description: |-
                        EngineVersion specifies the template engine version
                        that should be used to compile/execute the
                        template specified in .data and .templateFrom[].
                      enum:
                        - v2
                      type: string
                    mergePolicy:
                      default: Replace
                      description: TemplateMergePolicy defines how the rendered template should be merged with the existing Secret data.
                      enum:
                        - Replace
                        - Merge
                      type: string
                    metadata:
                      description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
                      properties:
                        annotations:
                          additionalProperties:
                            type: string
                          type: object
                        finalizers:
                          items:
                            type: string
                          type: array
                        labels:
                          additionalProperties:
                            type: string
                          type: object
                      type: object
                    templateFrom:
                      items:
                        description: |-
                          TemplateFrom specifies a source for templates.
                          Each item in the list can either reference a ConfigMap or a Secret resource.
                        properties:
                          configMap:
                            description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
                            properties:
                              items:
                                description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
                                items:
                                  description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
                                  properties:
                                    key:
                                      description: A key in the ConfigMap/Secret
                                      maxLength: 253
                                      minLength: 1
                                      pattern: ^[-._a-zA-Z0-9]+$
                                      type: string
                                    templateAs:
                                      default: Values
                                      description: TemplateScope specifies how the template keys should be interpreted.
                                      enum:
                                        - Values
                                        - KeysAndValues
                                      type: string
                                  required:
                                    - key
                                  type: object
                                type: array
                              name:
                                description: The name of the ConfigMap/Secret resource
                                maxLength: 253
                                minLength: 1
                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                type: string
                            required:
                              - items
                              - name
                            type: object
                          literal:
                            type: string
                          secret:
                            description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
                            properties:
                              items:
                                description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
                                items:
                                  description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
                                  properties:
                                    key:
                                      description: A key in the ConfigMap/Secret
                                      maxLength: 253
                                      minLength: 1
                                      pattern: ^[-._a-zA-Z0-9]+$
                                      type: string
                                    templateAs:
                                      default: Values
                                      description: TemplateScope specifies how the template keys should be interpreted.
                                      enum:
                                        - Values
                                        - KeysAndValues
                                      type: string
                                  required:
                                    - key
                                  type: object
                                type: array
                              name:
                                description: The name of the ConfigMap/Secret resource
                                maxLength: 253
                                minLength: 1
                                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                type: string
                            required:
                              - items
                              - name
                            type: object
                          target:
                            default: Data
                            description: |-
                              Target specifies where to place the template result.
                              For Secret resources, common values are: "Data", "Annotations", "Labels".
                              For custom resources (when spec.target.manifest is set), this supports
                              nested paths like "spec.database.config" or "data".
                            type: string
                        type: object
                      type: array
                    type:
                      type: string
                  type: object
                updatePolicy:
                  default: Replace
                  description: UpdatePolicy to handle Secrets in the provider.
                  enum:
                    - Replace
                    - IfNotExists
                  type: string
              required:
                - secretStoreRefs
                - selector
              type: object
            status:
              description: PushSecretStatus indicates the history of the status of PushSecret.
              properties:
                conditions:
                  items:
                    description: PushSecretStatusCondition indicates the status of the PushSecret.
                    properties:
                      lastTransitionTime:
                        format: date-time
                        type: string
                      message:
                        type: string
                      reason:
                        type: string
                      status:
                        type: string
                      type:
                        description: PushSecretConditionType indicates the condition of the PushSecret.
                        type: string
                    required:
                      - status
                      - type
                    type: object
                  type: array
                refreshTime:
                  description: |-
                    refreshTime is the time and date the external secret was fetched and
                    the target secret updated
                  format: date-time
                  nullable: true
                  type: string
                syncedPushSecrets:
                  additionalProperties:
                    additionalProperties:
                      description: PushSecretData defines data to be pushed to the provider and associated metadata.
                      properties:
                        conversionStrategy:
                          default: None
                          description: Used to define a conversion Strategy for the secret keys
                          enum:
                            - None
                            - ReverseUnicode
                          type: string
                        match:
                          description: Match a given Secret Key to be pushed to the provider.
                          properties:
                            remoteRef:
                              description: Remote Refs to push to providers.
                              properties:
                                property:
                                  description: Name of the property in the resulting secret
                                  type: string
                                remoteKey:
                                  description: Name of the resulting provider secret.
                                  type: string
                              required:
                                - remoteKey
                              type: object
                            secretKey:
                              description: Secret Key to be pushed
                              type: string
                          required:
                            - remoteRef
                          type: object
                        metadata:
                          description: |-
                            Metadata is metadata attached to the secret.
                            The structure of metadata is provider specific, please look it up in the provider documentation.
                          x-kubernetes-preserve-unknown-fields: true
                      required:
                        - match
                      type: object
                    type: object
                  description: |-
                    Synced PushSecrets, including secrets that already exist in provider.
                    Matches secret stores to PushSecretData that was stored to that secret store.
                  type: object
                syncedResourceVersion:
                  description: SyncedResourceVersion keeps track of the last synced version.
                  type: string
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}
