PocketIDUser Examples¶

Common PocketIDUser configurations. For how each feature behaves see the PocketIDUser guide, and for every field see the API reference.

Full Profile¶

apiVersion: pocketid.internal/v1alpha1
kind: PocketIDUser
metadata:
  name: jsmith
  namespace: pocket-id
spec:
  username:
    value: jsmith
  firstName:
    value: John
  lastName:
    value: Smith
  displayName:
    value: John Smith
  email:
    value: "jsmith@example.com"
  admin: true
  locale: en

Profile From a Secret¶

Single Secret¶

apiVersion: v1
kind: Secret
metadata:
  name: jsmith-user-info
  namespace: pocket-id
stringData:
  username: "jsmith"
  firstName: "John"
  lastName: "Smith"
  email: "jsmith@example.com"
  displayName: "John Smith"
---
apiVersion: pocketid.internal/v1alpha1
kind: PocketIDUser
metadata:
  name: jsmith
  namespace: pocket-id
spec:
  userInfoSecretRef:
    name: jsmith-user-info

Individual Fields¶

spec:
  email:
    valueFrom:
      secretKeyRef:
        name: jsmith-private
        key: email

Declarative User ID¶

apiVersion: pocketid.internal/v1alpha1
kind: PocketIDUser
metadata:
  name: jsmith
  namespace: pocket-id
spec:
  userID: 3f8a1c72-9b4d-4e61-8a0f-2c5d7e9b1a34
  email:
    value: "jsmith@example.com"

Custom Claims¶

spec:
  customClaims:
    - key: department
      value: engineering
    - key: employee_id
      value: "E-1042"

API Keys¶

Operator-Created Keys¶

Each key's token is written to the Secret <user>-<key>-key under token, here ci-bot-deploy-key and ci-bot-ops-key.

apiVersion: pocketid.internal/v1alpha1
kind: PocketIDUser
metadata:
  name: ci-bot
  namespace: pocket-id
spec:
  email:
    value: "ci-bot@example.com"
  admin: true
  apiKeys:
    - name: deploy
      description: "CI deploy key"
    - name: ops
      expiresAt: "2030-01-01T00:00:00Z"

Pre-Existing Key Secret¶

apiVersion: v1
kind: Secret
metadata:
  name: existing-api-key
  namespace: pocket-id
stringData:
  token: "pocket-id-api-key-token"
---
apiVersion: pocketid.internal/v1alpha1
kind: PocketIDUser
metadata:
  name: legacy-user
  namespace: pocket-id
spec:
  email:
    value: "legacy@example.com"
  apiKeys:
    - name: legacy
      secretRef:
        name: existing-api-key
        key: token

Delete From Pocket-ID With the Resource¶

metadata:
  annotations:
    pocketid.internal/delete-from-pocket-id: "true"