{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://runninglake.com/schema/v1alpha1/secretreference.json",
  "title": "SecretReference",
  "description": "A SecretReference as RunningLake's configuration repository declares it, at secretreferences/<name>.yaml. Generated from the Go types the control plane decodes this file into, so it checks the shape the gate reads — field names and types, and which fields may exist. The gate also applies rules no schema can express — required fields inside spec among them — so a file this schema accepts can still be refused by `rl diff`. Take #/properties/spec for the spec alone.",
  "type": "object",
  "additionalProperties": false,
  "required": [
    "apiVersion",
    "kind",
    "metadata"
  ],
  "properties": {
    "apiVersion": {
      "type": "string",
      "const": "runninglake.io/v1alpha1",
      "description": "The config schema's version, which is independent of the HTTP API's (rule unsupported-api-version)."
    },
    "kind": {
      "type": "string",
      "const": "SecretReference",
      "description": "The kind this file declares. A kind that disagrees with the file's path is refused (rule kind-mismatch)."
    },
    "metadata": {
      "required": [
        "name"
      ],
      "type": "object",
      "additionalProperties": false,
      "properties": {
        "name": {
          "type": "string",
          "pattern": "^[a-z0-9_-]{1,63}$",
          "description": "The resource's name, which is also its path segment. It must be the name this file's path gives it (rule name-mismatch)."
        },
        "labels": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        },
        "annotations": {
          "type": "object",
          "additionalProperties": {
            "type": "string"
          }
        }
      }
    },
    "spec": {
      "description": "SecretReferenceSpec is where a secret lives in your own store, AWS Secrets Manager or Vault, read inside your data plane. Nothing resolves a reference yet, so nothing reads the secret.",
      "type": [
        "object",
        "null"
      ],
      "additionalProperties": false,
      "properties": {
        "store": {
          "description": "Store is customer: your own store, read inside your data plane. runninglake is refused: secrets held by RunningLake are not offered.",
          "type": [
            "string",
            "null"
          ]
        },
        "provider": {
          "description": "Provider is aws-secrets-manager or vault. Leave it out when the plane has exactly one.",
          "type": [
            "string",
            "null"
          ]
        },
        "path": {
          "description": "Path is the secret's name in your store, such as payroll/warehouse-reader: segments of letters, digits and _+=.@- joined by /, at most 512 bytes. It may not begin RL_ or /, and a path that reads as a secret value is refused.",
          "type": [
            "string",
            "null"
          ]
        },
        "key": {
          "description": "Key is the JSON key inside the secret's value, such as password. Leave it out for a value that is a plain string.",
          "type": [
            "string",
            "null"
          ]
        },
        "version": {
          "description": "Version pins one version: an AWS version id, AWSCURRENT or AWSPREVIOUS, or a Vault KV version number. Leave it out for the current one.",
          "type": [
            "string",
            "null"
          ]
        }
      }
    }
  }
}