diff --git a/kube/kube.libsonnet b/kube/kube.libsonnet
index c12e3db..202b41b 100644
--- a/kube/kube.libsonnet
+++ b/kube/kube.libsonnet
@@ -12,4 +12,16 @@
     Certificate(name): kube._Object("certmanager.k8s.io/v1alpha1", "Certificate", name) {
         spec: error "spec must be defined",
     },
+
+    CephObjectStoreUser(name): kube._Object("ceph.rook.io/v1", "CephObjectStoreUser", name) {
+        local user = self,
+        spec: error "spec must be defined",
+
+        // Name of the secret that contains the login data for this user.
+        // This secret is created in the same namespace as the ceph cluster, so
+        // unfortunately you can't really refer to it directly.
+        // We should write some automation to copy these secrets over in a
+        // secure way.
+        secret_name:: "rook-ceph-object-user-%s-%s" % [user.spec.store, user.spec.displayName],
+    },
 }