Deployed fdf1f9ce to main with MkDocs 1.2.3 and mike 1.1.2

main/provider-ibm-secrets-manager/index.html

@@ -871,6 +871,13 @@
     API key secret
   </a>
   
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#trusted-profile-container-auth" class="md-nav__link">
+    Trusted Profile Container Auth
+  </a>
+  
 </li>
         
       </ul>
@@ -1688,6 +1695,13 @@
     API key secret
   </a>
   
+</li>
+        
+          <li class="md-nav__item">
+  <a href="#trusted-profile-container-auth" class="md-nav__link">
+    Trusted Profile Container Auth
+  </a>
+  
 </li>
         
       </ul>
@@ -1791,7 +1805,9 @@
 <h2 id="ibm-cloud-secret-manager">IBM Cloud Secret Manager</h2>
 <p>External Secrets Operator integrates with <a href="https://www.ibm.com/cloud/secrets-manager">IBM Secret Manager</a> for secret management.</p>
 <h3 id="authentication">Authentication</h3>
-<p>At the moment, we only support API key authentication for this provider. To generate your key (for test purposes we are going to generate from your user), first got to your (Access IAM) page:</p>
+<p>We support API key and trusted profile container authentication for this provider.</p>
+<h4 id="api-key-secret">API key secret</h4>
+<p>To generate your key (for test purposes we are going to generate from your user), first got to your (Access IAM) page:</p>
 <p><img alt="iam" src="../pictures/screenshot_api_keys_iam.png" /></p>
 <p>On the left, click "IBM Cloud API Keys":</p>
 <p><img alt="iam-left" src="../pictures/screenshot_api_keys_iam_left.png" /></p>
@@ -1801,10 +1817,58 @@
 <p><img alt="iam-create-key" src="../pictures/screenshot_api_keys_create.png" /></p>
 <p>You have created a key. Press the eyeball to show the key. Copy or save it because keys can't be displayed or downloaded twice.</p>
 <p><img alt="iam-create-success" src="../pictures/screenshot_api_keys_create_successful.png" /></p>
-<h4 id="api-key-secret">API key secret</h4>
 <p>Create a secret containing your apiKey:</p>
 <div class="highlight"><pre><span></span><code>kubectl create secret generic ibm-secret --from-literal<span class="o">=</span><span class="nv">apiKey</span><span class="o">=</span><span class="s1">&#39;API_KEY_VALUE&#39;</span>
 </code></pre></div>
+<h4 id="trusted-profile-container-auth">Trusted Profile Container Auth</h4>
+<p>To create the trusted profile, first got to your (Access IAM) page:</p>
+<p><img alt="iam" src="../pictures/screenshot_api_keys_iam.png" /></p>
+<p>On the left, click "Access groups":</p>
+<p><img alt="iam-left" src="../pictures/screenshot_container_auth_create_group.png" /></p>
+<p>Pick a name and description for your group:</p>
+<p><img alt="iam-left" src="../pictures/screenshot_container_auth_create_group_1.png" /></p>
+<p>Click on "Access Policies":</p>
+<p><img alt="iam-left" src="../pictures/screenshot_container_auth_create_group_2.png" /></p>
+<p>Click on "Assign Access", select "IAM services", and pick "Secrets Manager" from the pick-list:</p>
+<p><img alt="iam-left" src="../pictures/screenshot_container_auth_create_group_3.png" /></p>
+<p>Scope to "All resources" or "Resources based on selected attributes", select "SecretsReader":</p>
+<p><img alt="iam-left" src="../pictures/screenshot_container_auth_create_group_4.png" /></p>
+<p>Click "Add" and "Assign" to save the access group.</p>
+<p>Next, on the left, click "Trusted profiles":</p>
+<p><img alt="iam-left" src="../pictures/screenshot_container_auth_iam_left.png" /></p>
+<p>Press "Create":</p>
+<p><img alt="iam-create-button" src="../pictures/screenshot_container_auth_create_button.png" /></p>
+<p>Pick a name and description for your profile:</p>
+<p><img alt="iam-create-key" src="../pictures/screenshot_container_auth_create_1.png" /></p>
+<p>Scope the profile's access.</p>
+<p>The compute service type will be "Red Hat OpenShift on IBM Cloud".  Additional restriction can be configured based on cloud or cluster metadata, or if "Specific resources" is selected, restriction to a specific cluster.</p>
+<p><img alt="iam-create-key" src="../pictures/screenshot_container_auth_create_2.png" /></p>
+<p>Click "Add" next to the previously created access group and then "Create", to associate the necessary service permissions.</p>
+<p><img alt="iam-create-key" src="../pictures/screenshot_container_auth_create_3.png" /></p>
+<p>To use the container-based authentication, it is necessary to map the API server <code>serviceAccountToken</code> auth token to the "external-secrets" and "external-secrets-webhook" deployment descriptors. Example below:</p>
+<div class="highlight"><pre><span></span><code><span class="nn">...</span><span class="w"></span>
+<span class="nt">spec</span><span class="p">:</span><span class="w"></span>
+<span class="w">  </span><span class="l l-Scalar l-Scalar-Plain">...</span><span class="w"></span>
+<span class="w">  </span><span class="l l-Scalar l-Scalar-Plain">template</span><span class="p p-Indicator">:</span><span class="w"></span>
+<span class="w">    </span><span class="l l-Scalar l-Scalar-Plain">...</span><span class="w"></span>
+<span class="w">    </span><span class="l l-Scalar l-Scalar-Plain">spec</span><span class="p p-Indicator">:</span><span class="w"></span>
+<span class="w">      </span><span class="nt">containers</span><span class="p">:</span><span class="w"></span>
+<span class="w">        </span><span class="l l-Scalar l-Scalar-Plain">...</span><span class="w"></span>
+<span class="w">        </span><span class="l l-Scalar l-Scalar-Plain">volumeMounts</span><span class="p p-Indicator">:</span><span class="w"></span>
+<span class="w">        </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">mountPath</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">/var/run/secrets/tokens</span><span class="w"></span>
+<span class="w">           </span><span class="l l-Scalar l-Scalar-Plain">name</span><span class="p p-Indicator">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">sa-token</span><span class="w"></span>
+<span class="w">      </span><span class="l l-Scalar l-Scalar-Plain">...</span><span class="w"></span>
+<span class="w">      </span><span class="nt">volumes</span><span class="p">:</span><span class="w"></span>
+<span class="w">      </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">sa-token</span><span class="w"></span>
+<span class="w">        </span><span class="nt">projected</span><span class="p">:</span><span class="w"></span>
+<span class="w">          </span><span class="nt">defaultMode</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">420</span><span class="w"></span>
+<span class="w">          </span><span class="nt">sources</span><span class="p">:</span><span class="w"></span>
+<span class="w">          </span><span class="p p-Indicator">-</span><span class="w"> </span><span class="nt">serviceAccountToken</span><span class="p">:</span><span class="w"></span>
+<span class="w">              </span><span class="nt">audience</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">iam</span><span class="w"></span>
+<span class="w">              </span><span class="nt">expirationSeconds</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">3600</span><span class="w"></span>
+<span class="w">              </span><span class="nt">path</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">sa-token</span><span class="w"></span>
+<span class="nn">...</span><span class="w"></span>
+</code></pre></div>
 <h3 id="update-secret-store">Update secret store</h3>
 <p>Be sure the <code>ibm</code> provider is listed in the <code>Kind=SecretStore</code></p>
 <p><div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1beta1</span><span class="w"></span>
@@ -1816,12 +1880,18 @@
 <span class="w">    </span><span class="nt">ibm</span><span class="p">:</span><span class="w"></span>
 <span class="w">      </span><span class="nt">serviceUrl</span><span class="p">:</span><span class="w"> </span><span class="s">&quot;https://SECRETS_MANAGER_ID.REGION.secrets-manager.appdomain.cloud&quot;</span><span class="w"></span>
 <span class="w">      </span><span class="nt">auth</span><span class="p">:</span><span class="w"></span>
+<span class="w">        </span><span class="nt">containerAuth</span><span class="p">:</span><span class="w"></span>
+<span class="w">          </span><span class="nt">profile</span><span class="p">:</span><span class="w"> </span><span class="s">&quot;test</span><span class="nv"> </span><span class="s">container</span><span class="nv"> </span><span class="s">auth</span><span class="nv"> </span><span class="s">profile&quot;</span><span class="w"></span>
+<span class="w">          </span><span class="nt">tokenLocation</span><span class="p">:</span><span class="w"> </span><span class="s">&quot;/var/run/secrets/tokens/sa-token&quot;</span><span class="w"></span>
+<span class="w">          </span><span class="nt">iamEndpoint</span><span class="p">:</span><span class="w"> </span><span class="s">&quot;https://iam.cloud.ibm.com&quot;</span><span class="w"></span>
 <span class="w">        </span><span class="nt">secretRef</span><span class="p">:</span><span class="w"></span>
 <span class="w">          </span><span class="nt">secretApiKeySecretRef</span><span class="p">:</span><span class="w"></span>
 <span class="w">            </span><span class="nt">name</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">ibm-secret</span><span class="w"></span>
 <span class="w">            </span><span class="nt">key</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">apiKey</span><span class="w"></span>
 </code></pre></div>
 <strong>NOTE:</strong> In case of a <code>ClusterSecretStore</code>, Be sure to provide <code>namespace</code> in <code>secretApiKeySecretRef</code> with the namespace where the secret resides.</p>
+<p><strong>NOTE:</strong> Only <code>secretApiKeySecretRef</code> or <code>containerAuth</code> should be specified, depending on authentication me
+thod being used.</p>
 <p>To find your serviceURL, under your Secrets Manager resource, go to "Endpoints" on the left.
 Note: Use the url without the <code>/api</code> suffix that is presented in the UI.
 See here for a list of <a href="https://cloud.ibm.com/apidocs/secrets-manager#getting-started-endpoints">publicly available endpoints</a>.</p>
@@ -1829,13 +1899,13 @@ See here for a list of <a href="https://cloud.ibm.com/apidocs/secrets-manager#ge
 <h3 id="secret-types">Secret Types</h3>
 <p>We support the following secret types of <a href="https://cloud.ibm.com/apidocs/secrets-manager">IBM Secrets Manager</a>:</p>
 <ul>
-<li><code>arbitrary</code></li>
+<li><code>arbitrary</code> </li>
 <li><code>username_password</code></li>
 <li><code>iam_credentials</code></li>
 <li><code>imported_cert</code></li>
 <li><code>public_cert</code></li>
 <li><code>private_cert</code></li>
-<li><code>kv</code></li>
+<li><code>kv</code> </li>
 </ul>
 <p>To define the type of secret you would like to sync you need to prefix the secret id with the desired type. If the secret type is not specified it is defaulted to <code>arbitrary</code>:</p>
 <div class="highlight"><pre><span></span><code><span class="nt">apiVersion</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">external-secrets.io/v1beta1</span><span class="w"></span>

main/snippets/ibm-container-auth-volume.yaml

@@ -0,0 +1,22 @@
+...
+spec:
+  ...
+  template:
+    ...
+    spec:
+      containers:
+        ...
+        volumeMounts:
+        - mountPath: /var/run/secrets/tokens
+           name: sa-token
+      ...
+      volumes:
+      - name: sa-token
+        projected:
+          defaultMode: 420
+          sources:
+          - serviceAccountToken:
+              audience: iam
+              expirationSeconds: 3600
+              path: sa-token
+...

main/snippets/ibm-secret-store.yaml

@@ -7,6 +7,10 @@ spec:
     ibm:
       serviceUrl: "https://SECRETS_MANAGER_ID.REGION.secrets-manager.appdomain.cloud"
       auth:
+        containerAuth:
+          profile: "test container auth profile"
+          tokenLocation: "/var/run/secrets/tokens/sa-token"
+          iamEndpoint: "https://iam.cloud.ibm.com"
         secretRef:
           secretApiKeySecretRef:
             name: ibm-secret

main/spec/index.html

@@ -4202,6 +4202,69 @@ IBMAuthSecretRef
 <td>
 </td>
 </tr>
+<tr>
+<td>
+<code>containerAuth</code></br>
+<em>
+<a href="#external-secrets.io/v1beta1.IBMAuthContainerAuth">
+IBMAuthContainerAuth
+</a>
+</em>
+</td>
+<td>
+</td>
+</tr>
+</tbody>
+</table>
+<h3 id="external-secrets.io/v1beta1.IBMAuthContainerAuth">IBMAuthContainerAuth
+</h3>
+<p>
+(<em>Appears on:</em>
+<a href="#external-secrets.io/v1beta1.IBMAuth">IBMAuth</a>)
+</p>
+<p>
+<p>IBM Container-based auth with IAM Trusted Profile.</p>
+</p>
+<table>
+<thead>
+<tr>
+<th>Field</th>
+<th>Description</th>
+</tr>
+</thead>
+<tbody>
+<tr>
+<td>
+<code>profile</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<p>the IBM Trusted Profile</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>tokenLocation</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+<p>Location the token is mounted on the pod</p>
+</td>
+</tr>
+<tr>
+<td>
+<code>iamEndpoint</code></br>
+<em>
+string
+</em>
+</td>
+<td>
+</td>
+</tr>
 </tbody>
 </table>
 <h3 id="external-secrets.io/v1beta1.IBMAuthSecretRef">IBMAuthSecretRef
@@ -4228,7 +4291,6 @@ github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
 </em>
 </td>
 <td>
-<em>(Optional)</em>
 <p>The SecretAccessKey is used for authentication</p>
 </td>
 </tr>