---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    operatorframework.io/installed-alongside-ea6b3d74f5d6fd0c: keycloak-system/keycloak-operator.v26.7.0
  creationTimestamp: "2026-07-12T19:30:30Z"
  generation: 1
  labels:
    olm.managed: "true"
    operators.coreos.com/keycloak-operator.keycloak-system: ""
  managedFields:
  - apiVersion: apiextensions.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:annotations:
          .: {}
          f:operatorframework.io/installed-alongside-ea6b3d74f5d6fd0c: {}
        f:labels:
          .: {}
          f:olm.managed: {}
      f:spec:
        f:conversion:
          .: {}
          f:strategy: {}
        f:group: {}
        f:names:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:scope: {}
        f:versions: {}
    manager: catalog
    operation: Update
    time: "2026-07-12T19:30:30Z"
  - apiVersion: apiextensions.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:status:
        f:acceptedNames:
          f:kind: {}
          f:listKind: {}
          f:plural: {}
          f:singular: {}
        f:conditions:
          k:{"type":"Established"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
          k:{"type":"NamesAccepted"}:
            .: {}
            f:lastTransitionTime: {}
            f:message: {}
            f:reason: {}
            f:status: {}
            f:type: {}
    manager: kube-apiserver
    operation: Update
    subresource: status
    time: "2026-07-12T19:30:30Z"
  - apiVersion: apiextensions.k8s.io/v1
    fieldsType: FieldsV1
    fieldsV1:
      f:metadata:
        f:labels:
          f:operators.coreos.com/keycloak-operator.keycloak-system: {}
    manager: olm
    operation: Update
    time: "2026-07-12T19:30:36Z"
  name: keycloaksamlclients.k8s.keycloak.org
  resourceVersion: "21325"
  uid: b63047f9-d9e9-4f6c-be62-7d8d8e489cc8
spec:
  conversion:
    strategy: None
  group: k8s.keycloak.org
  names:
    kind: KeycloakSAMLClient
    listKind: KeycloakSAMLClientList
    plural: keycloaksamlclients
    singular: keycloaksamlclient
  scope: Namespaced
  versions:
  - name: v2alpha1
    schema:
      openAPIV3Schema:
        properties:
          spec:
            properties:
              client:
                properties:
                  allowEcpFlow:
                    description: Allow ECP (Enhanced Client or Proxy) flow
                    type: boolean
                  appUrl:
                    description: URL to the application's homepage that is represented
                      by this client
                    type: string
                  clientSignatureRequired:
                    description: Require client to sign SAML requests
                    type: boolean
                  createdTimestamp:
                    description: Timestamp when the client was created
                    type: integer
                  description:
                    description: Human readable description of the client
                    type: string
                  displayName:
                    description: Human readable name of the client
                    type: string
                  enabled:
                    description: Whether this client is enabled
                    type: boolean
                  forceNameIdFormat:
                    description: Force the specified Name ID format even if the client
                      requests a different one
                    type: boolean
                  forcePostBinding:
                    description: Force POST binding for SAML responses
                    type: boolean
                  frontChannelLogout:
                    description: Use front-channel logout (browser redirect)
                    type: boolean
                  includeAuthnStatement:
                    description: Include AuthnStatement in the SAML response
                    type: boolean
                  nameIdFormat:
                    description: Name ID format to use for the subject
                    enum:
                    - email
                    - persistent
                    - transient
                    - username
                    type: string
                  redirectUris:
                    description: URIs that the browser can redirect to after login
                    items:
                      type: string
                    type: array
                  roles:
                    description: Roles associated with this client
                    items:
                      type: string
                    type: array
                  signAssertions:
                    description: Sign SAML assertions
                    type: boolean
                  signDocuments:
                    description: Sign SAML documents on the server side
                    type: boolean
                  signatureAlgorithm:
                    description: Signature algorithm for signing SAML documents
                    enum:
                    - DSA_SHA1
                    - RSA_SHA1
                    - RSA_SHA256
                    - RSA_SHA256_MGF1
                    - RSA_SHA512
                    - RSA_SHA512_MGF1
                    type: string
                  signatureCanonicalizationMethod:
                    description: Canonicalization method for XML signatures
                    type: string
                  signingCertificate:
                    description: X.509 certificate for signing (PEM format, without
                      headers)
                    type: string
                  updatedTimestamp:
                    description: Timestamp when the client was last updated
                    type: integer
                type: object
              keycloakCRName:
                description: The name of the Keycloak CR to reference, in the same
                  namespace.
                type: string
                x-kubernetes-validations:
                - message: keycloakCrName is immutable
                  rule: self == oldSelf
              realm:
                description: The realm of the Client
                type: string
                x-kubernetes-validations:
                - message: realm is immutable
                  rule: self == oldSelf
            required:
            - client
            - keycloakCRName
            - realm
            type: object
          status:
            properties:
              conditions:
                items:
                  properties:
                    lastTransitionTime:
                      type: string
                    message:
                      type: string
                    observedGeneration:
                      type: integer
                    status:
                      type: string
                    type:
                      type: string
                  type: object
                type: array
              hash:
                type: string
              observedGeneration:
                type: integer
              uuid:
                type: string
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: KeycloakSAMLClient
    listKind: KeycloakSAMLClientList
    plural: keycloaksamlclients
    singular: keycloaksamlclient
  conditions:
  - lastTransitionTime: "2026-07-12T19:30:30Z"
    message: no conflicts found
    reason: NoConflicts
    status: "True"
    type: NamesAccepted
  - lastTransitionTime: "2026-07-12T19:30:30Z"
    message: the initial names have been accepted
    reason: InitialNamesAccepted
    status: "True"
    type: Established
  storedVersions:
  - v2alpha1