{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://paulkov.github.io/dpone/schemas/gitops/credential-runtime.schema.json",
  "title": "dpone GitOps credential runtime",
  "type": "object",
  "required": [
    "schema",
    "environment"
  ],
  "additionalProperties": true,
  "properties": {
    "schema": {
      "const": "dpone.credential-runtime.v1"
    },
    "environment": {
      "type": "string",
      "minLength": 1
    },
    "vault": {
      "type": "object",
      "required": [
        "address",
        "auth"
      ],
      "additionalProperties": true,
      "properties": {
        "address": {
          "type": "string",
          "format": "uri"
        },
        "namespace": {
          "type": "string"
        },
        "auth": {
          "type": "object",
          "required": [
            "method",
            "role"
          ],
          "additionalProperties": true,
          "properties": {
            "method": {
              "enum": [
                "kubernetes",
                "jwt",
                "approle"
              ]
            },
            "role": {
              "type": "string",
              "minLength": 1
            }
          },
          "not": {
            "anyOf": [
              {
                "required": [
                  "access_key"
                ]
              },
              {
                "required": [
                  "access_key_id"
                ]
              },
              {
                "required": [
                  "client_secret"
                ]
              },
              {
                "required": [
                  "jwt"
                ]
              },
              {
                "required": [
                  "password"
                ]
              },
              {
                "required": [
                  "private_key"
                ]
              },
              {
                "required": [
                  "secret"
                ]
              },
              {
                "required": [
                  "secret_id"
                ]
              },
              {
                "required": [
                  "secret_key"
                ]
              },
              {
                "required": [
                  "session_token"
                ]
              },
              {
                "required": [
                  "token"
                ]
              },
              {
                "required": [
                  "vault_path"
                ]
              },
              {
                "required": [
                  "vault_token"
                ]
              }
            ]
          }
        }
      }
    },
    "fingerprint": {
      "$ref": "#/$defs/sha256"
    }
  },
  "$defs": {
    "sha256": {
      "type": "string",
      "pattern": "^sha256:[A-Fa-f0-9]{64}$"
    }
  }
}