ForgejoUser
A Forgejo user, in one of three modes.
- API version:
forgejo.weebo.io/v1alpha1 - Scope: Namespaced
- Short names:
fjuser - Guide: Users, OIDC and teams
A Forgejo user, in one of three modes:
- external —
loginSourceIdset: the account is pre-provisioned against an authentication source (e.g. Authentik over OIDC) and linked on the person's first login. No password. - local — no
loginSourceId: a random password is generated and written tosecretTargets. Withbot: truethe password is generated and never stored anywhere: nobody can use it, and the account works only through its tokens and SSH keys. - observed —
managementPolicy: Observe: the user is never created, modified or deleted, only resolved byusernameso other CRs can reference an account Forgejo auto-created at OIDC login.
Example
apiVersion: forgejo.weebo.io/v1alpha1
kind: ForgejoUser
metadata:
name: my-user
namespace: team-a
spec:
username: alice
email: alice@example.comSpec fields
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
active | boolean | no | true | |
admin | boolean | no | false | Site administrator. |
allowCreateOrganization | boolean | no | ||
bot | boolean | no | false | Service account: its password is random and never emitted, so it is only usable through ForgejoAccessTokens and ForgejoUserKeys. (Not prohibitLogin: Forgejo refuses a prohibited account's API tokens too.) |
deletionPolicy | string | no | "Orphan" | Defaults to Orphan: deleting the CR keeps the account and the attribution of everything it authored. Users are never purged. |
email | string | no | Required unless managementPolicy: Observe. | |
fullName | string | no | ||
instanceRef | object | no | The ForgejoInstance or ForgejoLocalInstance this object lives on. Unset: the cluster's only ForgejoInstance, else the only ForgejoLocalInstance of this namespace. | |
loginName | string | no | Identity of the account at the authentication source (for OIDC, the sub claim or the configured username claim). Defaults to username. Only used with loginSourceId. | |
loginSourceId | integer | no | ID of the Forgejo authentication source (Site administration → Authentication sources) the account logs in through. Forgejo has no API to list sources, so this is the numeric id, not its name. | |
managementPolicy | string | no | "Manage" | Whether the operator owns the Forgejo object or only looks it up. |
maxRepoCreation | integer | no | -1 uses the instance default. | |
mustChangePassword | boolean | no | Force a password change at first login. Local, non-bot users only; defaults to true. Until it's changed, Forgejo also refuses the account's API tokens. | |
prohibitLogin | boolean | no | false | Disable the account entirely — web, git and API tokens alike. |
restricted | boolean | no | false | Restricted users only see what they are explicitly granted. |
secretTargets | object[] | no | Where the generated password of a local, non-bot user is written (FORGEJO_USERNAME, FORGEJO_PASSWORD, FORGEJO_URL). Required for those users; ignored otherwise. A target deleted later triggers a password reset, since the old value can't be read back. | |
sharedWith | object | no | Other namespaces allowed to reference this object (when the operator enables cross-namespace references). Unset: this namespace only. | |
username | string | yes | Forgejo login. Changing it renames the account in place. | |
visibility | string | no | "public" | Visibility of a Forgejo user or organization. |
Build a manifest
Answer the questions and fill in the fields: the YAML preview updates as you type, ready to copy or download and kubectl apply.
Loading form...