{
  "properties": {
    "spec": {
      "additionalProperties": false,
      "properties": {
        "certificateAuthorityConfig": {
          "additionalProperties": false,
          "description": "Controls which CA workload certificates are issued against.\n\nOne and only one sub-object should be specified.\n",
          "oneOf": [
            {
              "required": [
                "meshCAConfig"
              ]
            },
            {
              "required": [
                "certificateAuthorityServiceConfig"
              ]
            }
          ],
          "properties": {
            "certificateAuthorityServiceConfig": {
              "additionalProperties": false,
              "description": "Issue certificates from a GCP Certificate Authority Service CA Pool.\n",
              "properties": {
                "endpointURI": {
                  "description": "GCP Certificate Authority Service CA Pool URI of the form\n//privateca.googleapis.com/projects/{project}/locations/{location}/caPools/{pool_name}\n",
                  "type": [
                    "string",
                    "null"
                  ]
                },
                "fallbackURIs": {
                  "description": "List of fallback Certificate Authority Service CA Pool URIs, each URI of the form\n//privateca.googleapis.com/projects/{project}/locations/{location}/caPools/{pool_name}\n",
                  "items": {
                    "type": "string"
                  },
                  "type": [
                    "array",
                    "null"
                  ]
                }
              },
              "type": [
                "object",
                "null"
              ]
            },
            "meshCAConfig": {
              "type": [
                "object",
                "null"
              ]
            }
          },
          "type": "object"
        },
        "keyAlgorithm": {
          "additionalProperties": false,
          "description": "The key algorithm to use when generating key-pairs for workload certificates.\n",
          "oneOf": [
            {
              "required": [
                "rsa"
              ]
            },
            {
              "required": [
                "ecdsa"
              ]
            }
          ],
          "properties": {
            "ecdsa": {
              "additionalProperties": false,
              "properties": {
                "curve": {
                  "description": "The name of the ECDSA curve to use.\n\nThe certificate issuance machinery in the cluster is only guaranteed to\naccept the values \"P256\" and \"P384\".\n",
                  "type": "string"
                }
              },
              "required": [
                "curve"
              ],
              "type": [
                "object",
                "null"
              ]
            },
            "rsa": {
              "additionalProperties": false,
              "properties": {
                "modulusSize": {
                  "description": "The number of bits to use in the workload's RSA key modulus.\n\nThe certificate issuance machinery in the cluster may enforce a range of\nallowed values.\n",
                  "type": "integer"
                }
              },
              "required": [
                "modulusSize"
              ],
              "type": [
                "object",
                "null"
              ]
            }
          },
          "type": "object"
        },
        "rotationWindowPercentage": {
          "description": "Start trying to renew certificates when this much percentage of certificate validity duration\nis remaining.\n\nCertificate issuers default to 50 percent (12 hours) if this value is not specified.\n\nMust be between 0 and 100. Certificate issuance implementations may enforce a narrower range.\n",
          "type": [
            "integer",
            "null"
          ]
        },
        "validityDurationSeconds": {
          "description": "Length of time (in seconds) that issued certificates should be valid for.\n\nCertificate issuers default to 86400 (24 hours) if this value is not specified.\nCertificate issuance implementations may enforce minimum and maximum bounds on\nthis value.\n",
          "type": [
            "integer",
            "null"
          ]
        }
      },
      "required": [
        "certificateAuthorityConfig"
      ],
      "type": "object"
    },
    "status": {
      "additionalProperties": false,
      "properties": {
        "conditions": {
          "items": {
            "additionalProperties": false,
            "properties": {
              "lastTransitionTime": {
                "description": "The time at which this condition last changed status, in the format \"2021-01-29T01:13:35Z\".\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "message": {
                "description": "Human-readable description of the condition's last transition.\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "observedGeneration": {
                "description": "If set, this represents the .metadata.generation that the condition was set\nbased upon.\n\nFor instance, if .metadata.generation is currently 12, but the\n.status.condition[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.\n",
                "type": [
                  "integer",
                  "null"
                ]
              },
              "reason": {
                "description": "Machine-readable description of the condition's last transition.\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "status": {
                "description": "Is the condition true or false?\n\nOne of \"True\", \"False\", or \"Unknown\".\n",
                "type": [
                  "string",
                  "null"
                ]
              },
              "type": {
                "description": "Known values:\n\n* \"Ready\": The certificate issuance machinery has validated and rendered\n  this WorkloadCertificateConfig; if the Ready condition is set to\n  status=True with an observedGeneration equal to the current\n  .metadata.generation of the WorkloadCertificateConfig, it can be used for\n  issuing certificates.\n\n  If the Ready condition is set to status=False, check the reason and\n  message fields for an explanation of why the controller rejected your\n  configuration.\n",
                "type": [
                  "string",
                  "null"
                ]
              }
            },
            "type": "object"
          },
          "type": [
            "array",
            "null"
          ]
        }
      },
      "type": [
        "object",
        "null"
      ]
    }
  },
  "required": [
    "spec"
  ],
  "type": "object"
}