|
|
@@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
|
|
|
kind: CustomResourceDefinition
|
|
|
metadata:
|
|
|
annotations:
|
|
|
- controller-gen.kubebuilder.io/version: v0.13.0
|
|
|
+ controller-gen.kubebuilder.io/version: v0.14.0
|
|
|
name: vaultdynamicsecrets.generators.external-secrets.io
|
|
|
spec:
|
|
|
group: generators.external-secrets.io
|
|
|
@@ -22,23 +22,28 @@ spec:
|
|
|
openAPIV3Schema:
|
|
|
properties:
|
|
|
apiVersion:
|
|
|
- description: 'APIVersion defines the versioned schema of this representation
|
|
|
- of an object. Servers should convert recognized schemas to the latest
|
|
|
- internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
|
|
|
+ description: |-
|
|
|
+ APIVersion defines the versioned schema of this representation of an object.
|
|
|
+ Servers should convert recognized schemas to the latest internal value, and
|
|
|
+ may reject unrecognized values.
|
|
|
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
|
|
type: string
|
|
|
kind:
|
|
|
- description: 'Kind is a string value representing the REST resource this
|
|
|
- object represents. Servers may infer this from the endpoint the client
|
|
|
- submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
|
|
|
+ description: |-
|
|
|
+ Kind is a string value representing the REST resource this object represents.
|
|
|
+ Servers may infer this from the endpoint the client submits requests to.
|
|
|
+ Cannot be updated.
|
|
|
+ In CamelCase.
|
|
|
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
|
|
type: string
|
|
|
metadata:
|
|
|
type: object
|
|
|
spec:
|
|
|
properties:
|
|
|
controller:
|
|
|
- description: 'Used to select the correct ESO controller (think: ingress.ingressClassName)
|
|
|
- The ESO controller is instantiated with a specific controller name
|
|
|
- and filters VDS based on this property'
|
|
|
+ description: |-
|
|
|
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
|
|
|
+ The ESO controller is instantiated with a specific controller name and filters VDS based on this property
|
|
|
type: string
|
|
|
method:
|
|
|
description: Vault API method to use (GET/POST/other)
|
|
|
@@ -57,61 +62,63 @@ spec:
|
|
|
with the Vault server.
|
|
|
properties:
|
|
|
appRole:
|
|
|
- description: AppRole authenticates with Vault using the App
|
|
|
- Role auth mechanism, with the role and secret stored in
|
|
|
- a Kubernetes Secret resource.
|
|
|
+ description: |-
|
|
|
+ AppRole authenticates with Vault using the App Role auth mechanism,
|
|
|
+ with the role and secret stored in a Kubernetes Secret resource.
|
|
|
properties:
|
|
|
path:
|
|
|
default: approle
|
|
|
- description: 'Path where the App Role authentication backend
|
|
|
- is mounted in Vault, e.g: "approle"'
|
|
|
+ description: |-
|
|
|
+ Path where the App Role authentication backend is mounted
|
|
|
+ in Vault, e.g: "approle"
|
|
|
type: string
|
|
|
roleId:
|
|
|
- description: RoleID configured in the App Role authentication
|
|
|
- backend when setting up the authentication backend in
|
|
|
- Vault.
|
|
|
+ description: |-
|
|
|
+ RoleID configured in the App Role authentication backend when setting
|
|
|
+ up the authentication backend in Vault.
|
|
|
type: string
|
|
|
roleRef:
|
|
|
- description: Reference to a key in a Secret that contains
|
|
|
- the App Role ID used to authenticate with Vault. The
|
|
|
- `key` field must be specified and denotes which entry
|
|
|
- within the Secret resource is used as the app role id.
|
|
|
+ description: |-
|
|
|
+ Reference to a key in a Secret that contains the App Role ID used
|
|
|
+ to authenticate with Vault.
|
|
|
+ The `key` field must be specified and denotes which entry within the Secret
|
|
|
+ resource is used as the app role id.
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
secretRef:
|
|
|
- description: Reference to a key in a Secret that contains
|
|
|
- the App Role secret used to authenticate with Vault.
|
|
|
- The `key` field must be specified and denotes which
|
|
|
- entry within the Secret resource is used as the app
|
|
|
- role secret.
|
|
|
+ description: |-
|
|
|
+ Reference to a key in a Secret that contains the App Role secret used
|
|
|
+ to authenticate with Vault.
|
|
|
+ The `key` field must be specified and denotes which entry within the Secret
|
|
|
+ resource is used as the app role secret.
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
required:
|
|
|
@@ -119,54 +126,55 @@ spec:
|
|
|
- secretRef
|
|
|
type: object
|
|
|
cert:
|
|
|
- description: Cert authenticates with TLS Certificates by passing
|
|
|
- client certificate, private key and ca certificate Cert
|
|
|
- authentication method
|
|
|
+ description: |-
|
|
|
+ Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
|
|
|
+ Cert authentication method
|
|
|
properties:
|
|
|
clientCert:
|
|
|
- description: ClientCert is a certificate to authenticate
|
|
|
- using the Cert Vault authentication method
|
|
|
+ description: |-
|
|
|
+ ClientCert is a certificate to authenticate using the Cert Vault
|
|
|
+ authentication method
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
secretRef:
|
|
|
- description: SecretRef to a key in a Secret resource containing
|
|
|
- client private key to authenticate with Vault using
|
|
|
- the Cert authentication method
|
|
|
+ description: |-
|
|
|
+ SecretRef to a key in a Secret resource containing client private key to
|
|
|
+ authenticate with Vault using the Cert authentication method
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
type: object
|
|
|
iam:
|
|
|
- description: Iam authenticates with vault by passing a special
|
|
|
- AWS request signed with AWS IAM credentials AWS IAM authentication
|
|
|
- method
|
|
|
+ description: |-
|
|
|
+ Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
|
|
|
+ AWS IAM authentication method
|
|
|
properties:
|
|
|
externalID:
|
|
|
description: AWS External ID set on assumed IAM roles
|
|
|
@@ -178,11 +186,10 @@ spec:
|
|
|
description: A reference to a ServiceAccount resource.
|
|
|
properties:
|
|
|
audiences:
|
|
|
- description: Audience specifies the `aud` claim
|
|
|
- for the service account token If the service
|
|
|
- account uses a well-known annotation for e.g.
|
|
|
- IRSA or GCP Workload Identity then this audiences
|
|
|
- will be appended to the list
|
|
|
+ description: |-
|
|
|
+ Audience specifies the `aud` claim for the service account token
|
|
|
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
|
|
+ then this audiences will be appended to the list
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -191,10 +198,9 @@ spec:
|
|
|
being referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped.
|
|
|
- cluster-scoped defaults to the namespace of
|
|
|
- the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
@@ -218,62 +224,57 @@ spec:
|
|
|
description: The AccessKeyID is used for authentication
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret
|
|
|
- resource's `data` field to be used. Some instances
|
|
|
- of this field may be defaulted, in others it
|
|
|
- may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped.
|
|
|
- cluster-scoped defaults to the namespace of
|
|
|
- the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
secretAccessKeySecretRef:
|
|
|
description: The SecretAccessKey is used for authentication
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret
|
|
|
- resource's `data` field to be used. Some instances
|
|
|
- of this field may be defaulted, in others it
|
|
|
- may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped.
|
|
|
- cluster-scoped defaults to the namespace of
|
|
|
- the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
sessionTokenSecretRef:
|
|
|
- description: 'The SessionToken used for authentication
|
|
|
- This must be defined if AccessKeyID and SecretAccessKey
|
|
|
- are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html'
|
|
|
+ description: |-
|
|
|
+ The SessionToken used for authentication
|
|
|
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
|
|
|
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret
|
|
|
- resource's `data` field to be used. Some instances
|
|
|
- of this field may be defaulted, in others it
|
|
|
- may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped.
|
|
|
- cluster-scoped defaults to the namespace of
|
|
|
- the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
type: object
|
|
|
@@ -292,29 +293,31 @@ spec:
|
|
|
- vaultRole
|
|
|
type: object
|
|
|
jwt:
|
|
|
- description: Jwt authenticates with Vault by passing role
|
|
|
- and JWT token using the JWT/OIDC authentication method
|
|
|
+ description: |-
|
|
|
+ Jwt authenticates with Vault by passing role and JWT token using the
|
|
|
+ JWT/OIDC authentication method
|
|
|
properties:
|
|
|
kubernetesServiceAccountToken:
|
|
|
- description: Optional ServiceAccountToken specifies the
|
|
|
- Kubernetes service account for which to request a token
|
|
|
- for with the `TokenRequest` API.
|
|
|
+ description: |-
|
|
|
+ Optional ServiceAccountToken specifies the Kubernetes service account for which to request
|
|
|
+ a token for with the `TokenRequest` API.
|
|
|
properties:
|
|
|
audiences:
|
|
|
- description: 'Optional audiences field that will be
|
|
|
- used to request a temporary Kubernetes service account
|
|
|
- token for the service account referenced by `serviceAccountRef`.
|
|
|
+ description: |-
|
|
|
+ Optional audiences field that will be used to request a temporary Kubernetes service
|
|
|
+ account token for the service account referenced by `serviceAccountRef`.
|
|
|
Defaults to a single audience `vault` it not specified.
|
|
|
- Deprecated: use serviceAccountRef.Audiences instead'
|
|
|
+ Deprecated: use serviceAccountRef.Audiences instead
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
expirationSeconds:
|
|
|
- description: 'Optional expiration time in seconds
|
|
|
- that will be used to request a temporary Kubernetes
|
|
|
- service account token for the service account referenced
|
|
|
- by `serviceAccountRef`. Deprecated: this will be
|
|
|
- removed in the future. Defaults to 10 minutes.'
|
|
|
+ description: |-
|
|
|
+ Optional expiration time in seconds that will be used to request a temporary
|
|
|
+ Kubernetes service account token for the service account referenced by
|
|
|
+ `serviceAccountRef`.
|
|
|
+ Deprecated: this will be removed in the future.
|
|
|
+ Defaults to 10 minutes.
|
|
|
format: int64
|
|
|
type: integer
|
|
|
serviceAccountRef:
|
|
|
@@ -322,11 +325,10 @@ spec:
|
|
|
name of a kubernetes ServiceAccount.
|
|
|
properties:
|
|
|
audiences:
|
|
|
- description: Audience specifies the `aud` claim
|
|
|
- for the service account token If the service
|
|
|
- account uses a well-known annotation for e.g.
|
|
|
- IRSA or GCP Workload Identity then this audiences
|
|
|
- will be appended to the list
|
|
|
+ description: |-
|
|
|
+ Audience specifies the `aud` claim for the service account token
|
|
|
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
|
|
+ then this audiences will be appended to the list
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -335,10 +337,9 @@ spec:
|
|
|
being referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped.
|
|
|
- cluster-scoped defaults to the namespace of
|
|
|
- the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
@@ -348,87 +349,88 @@ spec:
|
|
|
type: object
|
|
|
path:
|
|
|
default: jwt
|
|
|
- description: 'Path where the JWT authentication backend
|
|
|
- is mounted in Vault, e.g: "jwt"'
|
|
|
+ description: |-
|
|
|
+ Path where the JWT authentication backend is mounted
|
|
|
+ in Vault, e.g: "jwt"
|
|
|
type: string
|
|
|
role:
|
|
|
- description: Role is a JWT role to authenticate using
|
|
|
- the JWT/OIDC Vault authentication method
|
|
|
+ description: |-
|
|
|
+ Role is a JWT role to authenticate using the JWT/OIDC Vault
|
|
|
+ authentication method
|
|
|
type: string
|
|
|
secretRef:
|
|
|
- description: Optional SecretRef that refers to a key in
|
|
|
- a Secret resource containing JWT token to authenticate
|
|
|
- with Vault using the JWT/OIDC authentication method.
|
|
|
+ description: |-
|
|
|
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
|
|
|
+ authenticate with Vault using the JWT/OIDC authentication method.
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
required:
|
|
|
- path
|
|
|
type: object
|
|
|
kubernetes:
|
|
|
- description: Kubernetes authenticates with Vault by passing
|
|
|
- the ServiceAccount token stored in the named Secret resource
|
|
|
- to the Vault server.
|
|
|
+ description: |-
|
|
|
+ Kubernetes authenticates with Vault by passing the ServiceAccount
|
|
|
+ token stored in the named Secret resource to the Vault server.
|
|
|
properties:
|
|
|
mountPath:
|
|
|
default: kubernetes
|
|
|
- description: 'Path where the Kubernetes authentication
|
|
|
- backend is mounted in Vault, e.g: "kubernetes"'
|
|
|
+ description: |-
|
|
|
+ Path where the Kubernetes authentication backend is mounted in Vault, e.g:
|
|
|
+ "kubernetes"
|
|
|
type: string
|
|
|
role:
|
|
|
- description: A required field containing the Vault Role
|
|
|
- to assume. A Role binds a Kubernetes ServiceAccount
|
|
|
- with a set of Vault policies.
|
|
|
+ description: |-
|
|
|
+ A required field containing the Vault Role to assume. A Role binds a
|
|
|
+ Kubernetes ServiceAccount with a set of Vault policies.
|
|
|
type: string
|
|
|
secretRef:
|
|
|
- description: Optional secret field containing a Kubernetes
|
|
|
- ServiceAccount JWT used for authenticating with Vault.
|
|
|
- If a name is specified without a key, `token` is the
|
|
|
- default. If one is not specified, the one bound to the
|
|
|
- controller will be used.
|
|
|
+ description: |-
|
|
|
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
|
|
|
+ for authenticating with Vault. If a name is specified without a key,
|
|
|
+ `token` is the default. If one is not specified, the one bound to
|
|
|
+ the controller will be used.
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
serviceAccountRef:
|
|
|
- description: Optional service account field containing
|
|
|
- the name of a kubernetes ServiceAccount. If the service
|
|
|
- account is specified, the service account secret token
|
|
|
- JWT will be used for authenticating with Vault. If the
|
|
|
- service account selector is not supplied, the secretRef
|
|
|
- will be used instead.
|
|
|
+ description: |-
|
|
|
+ Optional service account field containing the name of a kubernetes ServiceAccount.
|
|
|
+ If the service account is specified, the service account secret token JWT will be used
|
|
|
+ for authenticating with Vault. If the service account selector is not supplied,
|
|
|
+ the secretRef will be used instead.
|
|
|
properties:
|
|
|
audiences:
|
|
|
- description: Audience specifies the `aud` claim for
|
|
|
- the service account token If the service account
|
|
|
- uses a well-known annotation for e.g. IRSA or GCP
|
|
|
- Workload Identity then this audiences will be appended
|
|
|
- to the list
|
|
|
+ description: |-
|
|
|
+ Audience specifies the `aud` claim for the service account token
|
|
|
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
|
|
+ then this audiences will be appended to the list
|
|
|
items:
|
|
|
type: string
|
|
|
type: array
|
|
|
@@ -437,9 +439,9 @@ spec:
|
|
|
being referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
required:
|
|
|
- name
|
|
|
@@ -449,37 +451,41 @@ spec:
|
|
|
- role
|
|
|
type: object
|
|
|
ldap:
|
|
|
- description: Ldap authenticates with Vault by passing username/password
|
|
|
- pair using the LDAP authentication method
|
|
|
+ description: |-
|
|
|
+ Ldap authenticates with Vault by passing username/password pair using
|
|
|
+ the LDAP authentication method
|
|
|
properties:
|
|
|
path:
|
|
|
default: ldap
|
|
|
- description: 'Path where the LDAP authentication backend
|
|
|
- is mounted in Vault, e.g: "ldap"'
|
|
|
+ description: |-
|
|
|
+ Path where the LDAP authentication backend is mounted
|
|
|
+ in Vault, e.g: "ldap"
|
|
|
type: string
|
|
|
secretRef:
|
|
|
- description: SecretRef to a key in a Secret resource containing
|
|
|
- password for the LDAP user used to authenticate with
|
|
|
- Vault using the LDAP authentication method
|
|
|
+ description: |-
|
|
|
+ SecretRef to a key in a Secret resource containing password for the LDAP
|
|
|
+ user used to authenticate with Vault using the LDAP authentication
|
|
|
+ method
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
username:
|
|
|
- description: Username is a LDAP user name used to authenticate
|
|
|
- using the LDAP Vault authentication method
|
|
|
+ description: |-
|
|
|
+ Username is a LDAP user name used to authenticate using the LDAP Vault
|
|
|
+ authentication method
|
|
|
type: string
|
|
|
required:
|
|
|
- path
|
|
|
@@ -490,18 +496,18 @@ spec:
|
|
|
a token.
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this field
|
|
|
- may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being referred
|
|
|
to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
userPass:
|
|
|
@@ -510,32 +516,35 @@ spec:
|
|
|
properties:
|
|
|
path:
|
|
|
default: user
|
|
|
- description: 'Path where the UserPassword authentication
|
|
|
- backend is mounted in Vault, e.g: "user"'
|
|
|
+ description: |-
|
|
|
+ Path where the UserPassword authentication backend is mounted
|
|
|
+ in Vault, e.g: "user"
|
|
|
type: string
|
|
|
secretRef:
|
|
|
- description: SecretRef to a key in a Secret resource containing
|
|
|
- password for the user used to authenticate with Vault
|
|
|
- using the UserPass authentication method
|
|
|
+ description: |-
|
|
|
+ SecretRef to a key in a Secret resource containing password for the
|
|
|
+ user used to authenticate with Vault using the UserPass authentication
|
|
|
+ method
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this
|
|
|
- field may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being
|
|
|
referred to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
username:
|
|
|
- description: Username is a user name used to authenticate
|
|
|
- using the UserPass Vault authentication method
|
|
|
+ description: |-
|
|
|
+ Username is a user name used to authenticate using the UserPass Vault
|
|
|
+ authentication method
|
|
|
type: string
|
|
|
required:
|
|
|
- path
|
|
|
@@ -543,11 +552,11 @@ spec:
|
|
|
type: object
|
|
|
type: object
|
|
|
caBundle:
|
|
|
- description: PEM encoded CA bundle used to validate Vault server
|
|
|
- certificate. Only used if the Server URL is using HTTPS protocol.
|
|
|
- This parameter is ignored for plain HTTP protocol connection.
|
|
|
- If not set the system root certificates are used to validate
|
|
|
- the TLS connection.
|
|
|
+ description: |-
|
|
|
+ PEM encoded CA bundle used to validate Vault server certificate. Only used
|
|
|
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
|
|
|
+ plain HTTP protocol connection. If not set the system root certificates
|
|
|
+ are used to validate the TLS connection.
|
|
|
format: byte
|
|
|
type: string
|
|
|
caProvider:
|
|
|
@@ -563,8 +572,9 @@ spec:
|
|
|
type.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: The namespace the Provider type is in. Can only
|
|
|
- be defined when used in a ClusterSecretStore.
|
|
|
+ description: |-
|
|
|
+ The namespace the Provider type is in.
|
|
|
+ Can only be defined when used in a ClusterSecretStore.
|
|
|
type: string
|
|
|
type:
|
|
|
description: The type of provider to use such as "Secret",
|
|
|
@@ -578,88 +588,92 @@ spec:
|
|
|
- type
|
|
|
type: object
|
|
|
forwardInconsistent:
|
|
|
- description: ForwardInconsistent tells Vault to forward read-after-write
|
|
|
- requests to the Vault leader instead of simply retrying within
|
|
|
- a loop. This can increase performance if the option is enabled
|
|
|
- serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
|
|
|
+ description: |-
|
|
|
+ ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
|
|
|
+ leader instead of simply retrying within a loop. This can increase performance if
|
|
|
+ the option is enabled serverside.
|
|
|
+ https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
|
|
|
type: boolean
|
|
|
namespace:
|
|
|
- description: 'Name of the vault namespace. Namespaces is a set
|
|
|
- of features within Vault Enterprise that allows Vault environments
|
|
|
- to support Secure Multi-tenancy. e.g: "ns1". More about namespaces
|
|
|
- can be found here https://www.vaultproject.io/docs/enterprise/namespaces'
|
|
|
+ description: |-
|
|
|
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
|
|
|
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
|
|
|
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
|
|
|
type: string
|
|
|
path:
|
|
|
- description: 'Path is the mount path of the Vault KV backend endpoint,
|
|
|
- e.g: "secret". The v2 KV secret engine version specific "/data"
|
|
|
- path suffix for fetching secrets from Vault is optional and
|
|
|
- will be appended if not present in specified path.'
|
|
|
+ description: |-
|
|
|
+ Path is the mount path of the Vault KV backend endpoint, e.g:
|
|
|
+ "secret". The v2 KV secret engine version specific "/data" path suffix
|
|
|
+ for fetching secrets from Vault is optional and will be appended
|
|
|
+ if not present in specified path.
|
|
|
type: string
|
|
|
readYourWrites:
|
|
|
- description: ReadYourWrites ensures isolated read-after-write
|
|
|
- semantics by providing discovered cluster replication states
|
|
|
- in each request. More information about eventual consistency
|
|
|
- in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency
|
|
|
+ description: |-
|
|
|
+ ReadYourWrites ensures isolated read-after-write semantics by
|
|
|
+ providing discovered cluster replication states in each request.
|
|
|
+ More information about eventual consistency in Vault can be found here
|
|
|
+ https://www.vaultproject.io/docs/enterprise/consistency
|
|
|
type: boolean
|
|
|
server:
|
|
|
description: 'Server is the connection address for the Vault server,
|
|
|
e.g: "https://vault.example.com:8200".'
|
|
|
type: string
|
|
|
tls:
|
|
|
- description: The configuration used for client side related TLS
|
|
|
- communication, when the Vault server requires mutual authentication.
|
|
|
- Only used if the Server URL is using HTTPS protocol. This parameter
|
|
|
- is ignored for plain HTTP protocol connection. It's worth noting
|
|
|
- this configuration is different from the "TLS certificates auth
|
|
|
- method", which is available under the `auth.cert` section.
|
|
|
+ description: |-
|
|
|
+ The configuration used for client side related TLS communication, when the Vault server
|
|
|
+ requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
|
|
|
+ This parameter is ignored for plain HTTP protocol connection.
|
|
|
+ It's worth noting this configuration is different from the "TLS certificates auth method",
|
|
|
+ which is available under the `auth.cert` section.
|
|
|
properties:
|
|
|
certSecretRef:
|
|
|
- description: CertSecretRef is a certificate added to the transport
|
|
|
- layer when communicating with the Vault server. If no key
|
|
|
- for the Secret is specified, external-secret will default
|
|
|
- to 'tls.crt'.
|
|
|
+ description: |-
|
|
|
+ CertSecretRef is a certificate added to the transport layer
|
|
|
+ when communicating with the Vault server.
|
|
|
+ If no key for the Secret is specified, external-secret will default to 'tls.crt'.
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this field
|
|
|
- may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being referred
|
|
|
to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
keySecretRef:
|
|
|
- description: KeySecretRef to a key in a Secret resource containing
|
|
|
- client private key added to the transport layer when communicating
|
|
|
- with the Vault server. If no key for the Secret is specified,
|
|
|
- external-secret will default to 'tls.key'.
|
|
|
+ description: |-
|
|
|
+ KeySecretRef to a key in a Secret resource containing client private key
|
|
|
+ added to the transport layer when communicating with the Vault server.
|
|
|
+ If no key for the Secret is specified, external-secret will default to 'tls.key'.
|
|
|
properties:
|
|
|
key:
|
|
|
- description: The key of the entry in the Secret resource's
|
|
|
- `data` field to be used. Some instances of this field
|
|
|
- may be defaulted, in others it may be required.
|
|
|
+ description: |-
|
|
|
+ The key of the entry in the Secret resource's `data` field to be used. Some instances of this field may be
|
|
|
+ defaulted, in others it may be required.
|
|
|
type: string
|
|
|
name:
|
|
|
description: The name of the Secret resource being referred
|
|
|
to.
|
|
|
type: string
|
|
|
namespace:
|
|
|
- description: Namespace of the resource being referred
|
|
|
- to. Ignored if referent is not cluster-scoped. cluster-scoped
|
|
|
- defaults to the namespace of the referent.
|
|
|
+ description: |-
|
|
|
+ Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults
|
|
|
+ to the namespace of the referent.
|
|
|
type: string
|
|
|
type: object
|
|
|
type: object
|
|
|
version:
|
|
|
default: v2
|
|
|
- description: Version is the Vault KV secret engine version. This
|
|
|
- can be either "v1" or "v2". Version defaults to "v2".
|
|
|
+ description: |-
|
|
|
+ Version is the Vault KV secret engine version. This can be either "v1" or
|
|
|
+ "v2". Version defaults to "v2".
|
|
|
enum:
|
|
|
- v1
|
|
|
- v2
|
|
|
@@ -670,11 +684,12 @@ spec:
|
|
|
type: object
|
|
|
resultType:
|
|
|
default: Data
|
|
|
- description: Result type defines which data is returned from the generator.
|
|
|
- By default it is the "data" section of the Vault API response. When
|
|
|
- using e.g. /auth/token/create the "data" section is empty but the
|
|
|
- "auth" section contains the generated token. Please refer to the
|
|
|
- vault docs regarding the result data structure.
|
|
|
+ description: |-
|
|
|
+ Result type defines which data is returned from the generator.
|
|
|
+ By default it is the "data" section of the Vault API response.
|
|
|
+ When using e.g. /auth/token/create the "data" section is empty but
|
|
|
+ the "auth" section contains the generated token.
|
|
|
+ Please refer to the vault docs regarding the result data structure.
|
|
|
enum:
|
|
|
- Data
|
|
|
- Auth
|
eso-service-account-app[bot]