API Reference for ArangoPermissionRoleGroupBinding V1Alpha1
Spec
.spec.deployment.name
Type: string [ref]
This field is required
Name of the object
.spec.groupName
Type: string [ref]
This field is required
GroupName is the name of the group to bind the role to. The group is matched against the groups claim of the identity token, so the binding applies to every user whose token lists this group.
.spec.role.direct
Type: string [ref]
Direct references an existing authorization object (role or policy) by its exact name, without a backing ArangoPermission CRD - e.g. an operator-managed predefined role “managed:predefined:coredb-reader”. The value is used as-is. Exactly one of Name or Direct must be set.
.spec.role.name
Type: string [ref]
Name references an ArangoPermission CRD by name. The operator resolves it to the sidecar name.
.spec.scope.description
Type: string [ref]
Description is an optional human-readable description of this policy
.spec.scope.statements[int].actions
Type: array [ref]
This field is required
Actions defines the list of actions. Action needs to be defined in format <namespace>:<name>
.spec.scope.statements[int].description
Type: string [ref]
Description is an optional human-readable description of what this statement does
.spec.scope.statements[int].effect
Type: string [ref]
This field is required
Effect defines the statement effect.
Possible Values:
"Allow"(default) - Action is Allowed"Deny"- Action is Denied
.spec.scope.statements[int].resources
Type: array [ref]
This field is required
Resources defines the list of resources