{
  "properties": {
    "spec": {
      "additionalProperties": false,
      "properties": {
        "trustStores": {
          "description": "Configuration for trusting identities from a given SPIFFE trust domain.\n\nIf there are multiple entries for a given SPIFFE trust domain, the certificate\nissuance machinery in the cluster will reject the overall config as invalid.\n",
          "items": {
            "additionalProperties": false,
            "properties": {
              "trustAnchors": {
                "items": {
                  "additionalProperties": false,
                  "properties": {
                    "certificateAuthorityServiceURI": {
                      "description": "Retrieve and trust the root certificates of this GCP Certificate Authority\nService CA Pool.  A resource URI of the form\n//privateca.googleapis.com/projects/{project}/locations/{location}/caPools/{pool_name}\n",
                      "type": [
                        "string",
                        "null"
                      ]
                    },
                    "pemCertificate": {
                      "description": "Additional CA certificates to trust.\n\nEach entry is a PEM-encoded certificate to use as a trust anchor.  Each\nentry should contain only one certificate; configurations with multiple\ncertificates per entry will be rejected as invalid.\n",
                      "type": [
                        "string",
                        "null"
                      ]
                    },
                    "spiffeTrustBundleEndpoint": {
                      "description": "An HTTPS endpoint that returns a list of trusted CA certificates in SPIFFE\ntrust bundle format [1].\n\n[1] https://github.com/spiffe/spiffe/blob/master/standards/SPIFFE_Trust_Domain_and_Bundle.md#4-spiffe-bundle-format\n",
                      "type": [
                        "string",
                        "null"
                      ]
                    }
                  },
                  "type": "object"
                },
                "type": [
                  "array",
                  "null"
                ]
              },
              "trustDomain": {
                "description": "The SPIFFE trust domain to which this trust anchor applies.\n",
                "type": "string"
              }
            },
            "required": [
              "trustDomain"
            ],
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        }
      },
      "type": "object"
    },
    "status": {
      "additionalProperties": false,
      "properties": {
        "conditions": {
          "items": {
            "additionalProperties": false,
            "properties": {
              "lastTransitionTime": {
                "description": "The time at which this condition last changed status, in the format \"2021-01-29T01:13:35Z\".\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "message": {
                "description": "Human-readable description of the condition's last transition.\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "observedGeneration": {
                "description": "If set, this represents the .metadata.generation that the condition was set\nbased upon.\n\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.\n",
                "type": [
                  "integer",
                  "null"
                ]
              },
              "reason": {
                "description": "Machine-readable description of the condition's last transition.\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "status": {
                "description": "Is the condition true or false?\n\nOne of \"True\", \"False\", or \"Unknown\".\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "type": {
                "description": "Known values:\n\n* \"Ready\": The certificate issuance machinery has validated and rendered\n  this TrustConfig; if the Ready condition is set to status=True with an\n  observedGeneration equal to the current .metadata.generation of the\n  TrustConfig, the rendered trust anchors will be published to pods.\n\n  If the Ready condition is set to status=False, check the reason and\n  message fields for an explanation of why the controller rejected your\n  configuration.\n",
                "type": [
                  "string",
                  "null"
                ]
              }
            },
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        },
        "renderedTrustStores": {
          "description": "Holds the actual set of trust anchor certificates for each trust domain.\n\nUpdated by the controller based on .spec.trustStores --- the node agent does not\nnecessarily have the connectivity or access necessary to retrieve certificates\nfrom external systems.\n",
          "items": {
            "additionalProperties": false,
            "properties": {
              "trustAnchors": {
                "items": {
                  "additionalProperties": false,
                  "properties": {
                    "pemCertificates": {
                      "items": {
                        "type": "string"
                      },
                      "type": [
                        "array",
                        "null"
                      ]
                    }
                  },
                  "type": "object"
                },
                "type": [
                  "array",
                  "null"
                ]
              },
              "trustDomain": {
                "type": "string"
              }
            },
            "required": [
              "trustDomain"
            ],
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ]
    }
  },
  "required": [
    "spec"
  ],
  "type": "object"
}