helm-external-secrets/config/crds/bases/external-secrets.io_clusterpushsecrets.yaml

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  labels:
    external-secrets.io/component: controller
  name: clusterpushsecrets.external-secrets.io
spec:
  group: external-secrets.io
  names:
    categories:
    - external-secrets
    kind: ClusterPushSecret
    listKind: ClusterPushSecretList
    plural: clusterpushsecrets
    singular: clusterpushsecret
  scope: Cluster
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: AGE
      type: date
    - jsonPath: .status.conditions[?(@.type=="Ready")].reason
      name: Status
      type: string
    name: v1alpha1
    schema:
      openAPIV3Schema:
        description: ClusterPushSecret is the Schema for the ClusterPushSecrets API
          that enables cluster-wide management of pushing Kubernetes secrets to external
          providers.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: ClusterPushSecretSpec defines the configuration for a ClusterPushSecret
              resource.
            properties:
              namespaceSelectors:
                description: A list of labels to select by to find the Namespaces
                  to create the ExternalSecrets in. The selectors are ORed.
                items:
                  description: |-
                    A label selector is a label query over a set of resources. The result of matchLabels and
                    matchExpressions are ANDed. An empty label selector matches all objects. A null
                    label selector matches no objects.
                  properties:
                    matchExpressions:
                      description: matchExpressions is a list of label selector requirements.
                        The requirements are ANDed.
                      items:
                        description: |-
                          A label selector requirement is a selector that contains values, a key, and an operator that
                          relates the key and values.
                        properties:
                          key:
                            description: key is the label key that the selector applies
                              to.
                            type: string
                          operator:
                            description: |-
                              operator represents a key's relationship to a set of values.
                              Valid operators are In, NotIn, Exists and DoesNotExist.
                            type: string
                          values:
                            description: |-
                              values is an array of string values. If the operator is In or NotIn,
                              the values array must be non-empty. If the operator is Exists or DoesNotExist,
                              the values array must be empty. This array is replaced during a strategic
                              merge patch.
                            items:
                              type: string
                            type: array
                            x-kubernetes-list-type: atomic
                        required:
                        - key
                        - operator
                        type: object
                      type: array
                      x-kubernetes-list-type: atomic
                    matchLabels:
                      additionalProperties:
                        type: string
                      description: |-
                        matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                        map is equivalent to an element of matchExpressions, whose key field is "key", the
                        operator is "In", and the values array contains only "value". The requirements are ANDed.
                      type: object
                  type: object
                  x-kubernetes-map-type: atomic
                type: array
              pushSecretMetadata:
                description: The metadata of the external secrets to be created
                properties:
                  annotations:
                    additionalProperties:
                      type: string
                    type: object
                  labels:
                    additionalProperties:
                      type: string
                    type: object
                type: object
              pushSecretName:
                description: |-
                  The name of the push secrets to be created.
                  Defaults to the name of the ClusterPushSecret
                maxLength: 253
                minLength: 1
                pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                type: string
              pushSecretSpec:
                description: PushSecretSpec defines what to do with the secrets.
                properties:
                  data:
                    description: Secret Data that should be pushed to providers
                    items:
                      description: PushSecretData defines data to be pushed to the
                        provider and associated metadata.
                      properties:
                        conversionStrategy:
                          default: None
                          description: Used to define a conversion Strategy for the
                            secret keys
                          enum:
                          - None
                          - ReverseUnicode
                          type: string
                        match:
                          description: Match a given Secret Key to be pushed to the
                            provider.
                          properties:
                            remoteRef:
                              description: Remote Refs to push to providers.
                              properties:
                                property:
                                  description: Name of the property in the resulting
                                    secret
                                  type: string
                                remoteKey:
                                  description: Name of the resulting provider secret.
                                  type: string
                              required:
                              - remoteKey
                              type: object
                            secretKey:
                              description: Secret Key to be pushed
                              type: string
                          required:
                          - remoteRef
                          type: object
                        metadata:
                          description: |-
                            Metadata is metadata attached to the secret.
                            The structure of metadata is provider specific, please look it up in the provider documentation.
                          x-kubernetes-preserve-unknown-fields: true
                      required:
                      - match
                      type: object
                    type: array
                  dataTo:
                    description: DataTo defines bulk push rules that expand source
                      Secret keys into provider entries.
                    items:
                      description: PushSecretDataTo defines how to bulk-push secrets
                        to providers without explicit per-key mappings.
                      properties:
                        conversionStrategy:
                          default: None
                          description: Used to define a conversion Strategy for the
                            secret keys
                          enum:
                          - None
                          - ReverseUnicode
                          type: string
                        match:
                          description: |-
                            Match pattern for selecting keys from the source Secret.
                            If not specified, all keys are selected.
                          properties:
                            regexp:
                              description: |-
                                Regexp matches keys by regular expression.
                                If not specified, all keys are matched.
                              type: string
                          type: object
                        metadata:
                          description: |-
                            Metadata is metadata attached to the secret.
                            The structure of metadata is provider specific, please look it up in the provider documentation.
                          x-kubernetes-preserve-unknown-fields: true
                        remoteKey:
                          description: |-
                            RemoteKey is the name of the single provider secret that will receive ALL
                            matched keys bundled as a JSON object (e.g. {"DB_HOST":"...","DB_USER":"..."}).
                            When set, per-key expansion is skipped and a single push is performed.
                            The provider's store prefix (if any) is still prepended to this value.
                            When not set, each matched key is pushed as its own individual provider secret.
                          type: string
                        rewrite:
                          description: |-
                            Rewrite operations to transform keys before pushing to the provider.
                            Operations are applied sequentially.
                          items:
                            description: PushSecretRewrite defines how to transform
                              secret keys before pushing.
                            properties:
                              regexp:
                                description: Used to rewrite with regular expressions.
                                properties:
                                  source:
                                    description: Used to define the regular expression
                                      of a re.Compiler.
                                    type: string
                                  target:
                                    description: Used to define the target pattern
                                      of a ReplaceAll operation.
                                    type: string
                                required:
                                - source
                                - target
                                type: object
                              transform:
                                description: Used to apply string transformation on
                                  the secrets.
                                properties:
                                  template:
                                    description: |-
                                      Used to define the template to apply on the secret name.
                                      `.value ` will specify the secret name in the template.
                                    type: string
                                required:
                                - template
                                type: object
                            type: object
                            x-kubernetes-validations:
                            - message: exactly one of regexp or transform must be
                                set
                              rule: (has(self.regexp) && !has(self.transform)) ||
                                (!has(self.regexp) && has(self.transform))
                          type: array
                        storeRef:
                          description: StoreRef specifies which SecretStore to push
                            to. Required.
                          properties:
                            kind:
                              default: SecretStore
                              description: Kind of the SecretStore resource (SecretStore
                                or ClusterSecretStore)
                              enum:
                              - SecretStore
                              - ClusterSecretStore
                              type: string
                            labelSelector:
                              description: Optionally, sync to secret stores with
                                label selector
                              properties:
                                matchExpressions:
                                  description: matchExpressions is a list of label
                                    selector requirements. The requirements are ANDed.
                                  items:
                                    description: |-
                                      A label selector requirement is a selector that contains values, a key, and an operator that
                                      relates the key and values.
                                    properties:
                                      key:
                                        description: key is the label key that the
                                          selector applies to.
                                        type: string
                                      operator:
                                        description: |-
                                          operator represents a key's relationship to a set of values.
                                          Valid operators are In, NotIn, Exists and DoesNotExist.
                                        type: string
                                      values:
                                        description: |-
                                          values is an array of string values. If the operator is In or NotIn,
                                          the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                          the values array must be empty. This array is replaced during a strategic
                                          merge patch.
                                        items:
                                          type: string
                                        type: array
                                        x-kubernetes-list-type: atomic
                                    required:
                                    - key
                                    - operator
                                    type: object
                                  type: array
                                  x-kubernetes-list-type: atomic
                                matchLabels:
                                  additionalProperties:
                                    type: string
                                  description: |-
                                    matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                    map is equivalent to an element of matchExpressions, whose key field is "key", the
                                    operator is "In", and the values array contains only "value". The requirements are ANDed.
                                  type: object
                              type: object
                              x-kubernetes-map-type: atomic
                            name:
                              description: Optionally, sync to the SecretStore of
                                the given name
                              maxLength: 253
                              minLength: 1
                              pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                              type: string
                          type: object
                      type: object
                      x-kubernetes-validations:
                      - message: storeRef must specify either name or labelSelector
                        rule: has(self.storeRef) && (has(self.storeRef.name) || has(self.storeRef.labelSelector))
                      - message: 'remoteKey and rewrite are mutually exclusive: rewrite
                          is only supported in per-key mode (without remoteKey)'
                        rule: '!has(self.remoteKey) || !has(self.rewrite) || size(self.rewrite)
                          == 0'
                    type: array
                  deletionPolicy:
                    default: None
                    description: Deletion Policy to handle Secrets in the provider.
                    enum:
                    - Delete
                    - None
                    type: string
                  refreshInterval:
                    default: 1h0m0s
                    description: The Interval to which External Secrets will try to
                      push a secret definition
                    type: string
                  secretStoreRefs:
                    items:
                      description: PushSecretStoreRef contains a reference on how
                        to sync to a SecretStore.
                      properties:
                        kind:
                          default: SecretStore
                          description: Kind of the SecretStore resource (SecretStore
                            or ClusterSecretStore)
                          enum:
                          - SecretStore
                          - ClusterSecretStore
                          type: string
                        labelSelector:
                          description: Optionally, sync to secret stores with label
                            selector
                          properties:
                            matchExpressions:
                              description: matchExpressions is a list of label selector
                                requirements. The requirements are ANDed.
                              items:
                                description: |-
                                  A label selector requirement is a selector that contains values, a key, and an operator that
                                  relates the key and values.
                                properties:
                                  key:
                                    description: key is the label key that the selector
                                      applies to.
                                    type: string
                                  operator:
                                    description: |-
                                      operator represents a key's relationship to a set of values.
                                      Valid operators are In, NotIn, Exists and DoesNotExist.
                                    type: string
                                  values:
                                    description: |-
                                      values is an array of string values. If the operator is In or NotIn,
                                      the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                      the values array must be empty. This array is replaced during a strategic
                                      merge patch.
                                    items:
                                      type: string
                                    type: array
                                    x-kubernetes-list-type: atomic
                                required:
                                - key
                                - operator
                                type: object
                              type: array
                              x-kubernetes-list-type: atomic
                            matchLabels:
                              additionalProperties:
                                type: string
                              description: |-
                                matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                map is equivalent to an element of matchExpressions, whose key field is "key", the
                                operator is "In", and the values array contains only "value". The requirements are ANDed.
                              type: object
                          type: object
                          x-kubernetes-map-type: atomic
                        name:
                          description: Optionally, sync to the SecretStore of the
                            given name
                          maxLength: 253
                          minLength: 1
                          pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                          type: string
                      type: object
                    type: array
                  selector:
                    description: The Secret Selector (k8s source) for the Push Secret
                    maxProperties: 1
                    minProperties: 1
                    properties:
                      generatorRef:
                        description: Point to a generator to create a Secret.
                        properties:
                          apiVersion:
                            default: generators.external-secrets.io/v1alpha1
                            description: Specify the apiVersion of the generator resource
                            type: string
                          kind:
                            description: Specify the Kind of the generator resource
                            enum:
                            - ACRAccessToken
                            - BeyondtrustWorkloadCredentialsDynamicSecret
                            - ClusterGenerator
                            - CloudsmithAccessToken
                            - ECRAuthorizationToken
                            - Fake
                            - GCRAccessToken
                            - GithubAccessToken
                            - GitlabDeployToken
                            - QuayAccessToken
                            - Password
                            - SSHKey
                            - STSSessionToken
                            - UUID
                            - VaultDynamicSecret
                            - Webhook
                            - Grafana
                            - MFA
                            type: string
                          name:
                            description: Specify the name of the generator resource
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                        required:
                        - kind
                        - name
                        type: object
                      secret:
                        description: Select a Secret to Push.
                        properties:
                          name:
                            description: |-
                              Name of the Secret.
                              The Secret must exist in the same namespace as the PushSecret manifest.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          selector:
                            description: Selector chooses secrets using a labelSelector.
                            properties:
                              matchExpressions:
                                description: matchExpressions is a list of label selector
                                  requirements. The requirements are ANDed.
                                items:
                                  description: |-
                                    A label selector requirement is a selector that contains values, a key, and an operator that
                                    relates the key and values.
                                  properties:
                                    key:
                                      description: key is the label key that the selector
                                        applies to.
                                      type: string
                                    operator:
                                      description: |-
                                        operator represents a key's relationship to a set of values.
                                        Valid operators are In, NotIn, Exists and DoesNotExist.
                                      type: string
                                    values:
                                      description: |-
                                        values is an array of string values. If the operator is In or NotIn,
                                        the values array must be non-empty. If the operator is Exists or DoesNotExist,
                                        the values array must be empty. This array is replaced during a strategic
                                        merge patch.
                                      items:
                                        type: string
                                      type: array
                                      x-kubernetes-list-type: atomic
                                  required:
                                  - key
                                  - operator
                                  type: object
                                type: array
                                x-kubernetes-list-type: atomic
                              matchLabels:
                                additionalProperties:
                                  type: string
                                description: |-
                                  matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
                                  map is equivalent to an element of matchExpressions, whose key field is "key", the
                                  operator is "In", and the values array contains only "value". The requirements are ANDed.
                                type: object
                            type: object
                            x-kubernetes-map-type: atomic
                        type: object
                    type: object
                  template:
                    description: Template defines a blueprint for the created Secret
                      resource.
                    properties:
                      data:
                        additionalProperties:
                          type: string
                        type: object
                      engineVersion:
                        default: v2
                        description: |-
                          EngineVersion specifies the template engine version
                          that should be used to compile/execute the
                          template specified in .data and .templateFrom[].
                        enum:
                        - v2
                        type: string
                      mergePolicy:
                        default: Replace
                        description: TemplateMergePolicy defines how the rendered
                          template should be merged with the existing Secret data.
                        enum:
                        - Replace
                        - Merge
                        type: string
                      metadata:
                        description: ExternalSecretTemplateMetadata defines metadata
                          fields for the Secret blueprint.
                        properties:
                          annotations:
                            additionalProperties:
                              type: string
                            type: object
                          finalizers:
                            items:
                              type: string
                            type: array
                          labels:
                            additionalProperties:
                              type: string
                            type: object
                        type: object
                      templateFrom:
                        items:
                          description: |-
                            TemplateFrom specifies a source for templates.
                            Each item in the list can either reference a ConfigMap or a Secret resource.
                          properties:
                            configMap:
                              description: TemplateRef specifies a reference to either
                                a ConfigMap or a Secret resource.
                              properties:
                                items:
                                  description: A list of keys in the ConfigMap/Secret
                                    to use as templates for Secret data
                                  items:
                                    description: TemplateRefItem specifies a key in
                                      the ConfigMap/Secret to use as a template for
                                      Secret data.
                                    properties:
                                      key:
                                        description: A key in the ConfigMap/Secret
                                        maxLength: 253
                                        minLength: 1
                                        pattern: ^[-._a-zA-Z0-9]+$
                                        type: string
                                      templateAs:
                                        default: Values
                                        description: TemplateScope specifies how the
                                          template keys should be interpreted.
                                        enum:
                                        - Values
                                        - KeysAndValues
                                        type: string
                                    required:
                                    - key
                                    type: object
                                  type: array
                                name:
                                  description: The name of the ConfigMap/Secret resource
                                  maxLength: 253
                                  minLength: 1
                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                  type: string
                              required:
                              - items
                              - name
                              type: object
                            literal:
                              type: string
                            secret:
                              description: TemplateRef specifies a reference to either
                                a ConfigMap or a Secret resource.
                              properties:
                                items:
                                  description: A list of keys in the ConfigMap/Secret
                                    to use as templates for Secret data
                                  items:
                                    description: TemplateRefItem specifies a key in
                                      the ConfigMap/Secret to use as a template for
                                      Secret data.
                                    properties:
                                      key:
                                        description: A key in the ConfigMap/Secret
                                        maxLength: 253
                                        minLength: 1
                                        pattern: ^[-._a-zA-Z0-9]+$
                                        type: string
                                      templateAs:
                                        default: Values
                                        description: TemplateScope specifies how the
                                          template keys should be interpreted.
                                        enum:
                                        - Values
                                        - KeysAndValues
                                        type: string
                                    required:
                                    - key
                                    type: object
                                  type: array
                                name:
                                  description: The name of the ConfigMap/Secret resource
                                  maxLength: 253
                                  minLength: 1
                                  pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                                  type: string
                              required:
                              - items
                              - name
                              type: object
                            target:
                              default: Data
                              description: |-
                                Target specifies where to place the template result.
                                For Secret resources the accepted values are empty, "Data", "Annotations" and "Labels";
                                any other value is rejected because it would allow writes to privileged Secret fields.
                                For custom resources (when spec.target.manifest is set), this supports
                                nested paths like "spec.database.config" or "data".
                              type: string
                            valuesDecodingStrategy:
                              description: |-
                                Used to define a decoding Strategy for the rendered template values.
                                Defaults to None when omitted.
                              enum:
                              - Auto
                              - Base64
                              - Base64URL
                              - None
                              type: string
                          type: object
                        type: array
                      type:
                        type: string
                    type: object
                  updatePolicy:
                    default: Replace
                    description: UpdatePolicy to handle Secrets in the provider.
                    enum:
                    - Replace
                    - IfNotExists
                    type: string
                required:
                - secretStoreRefs
                - selector
                type: object
              refreshTime:
                description: The time in which the controller should reconcile its
                  objects and recheck namespaces for labels.
                type: string
            required:
            - pushSecretSpec
            type: object
          status:
            description: ClusterPushSecretStatus contains the status information for
              the ClusterPushSecret resource.
            properties:
              conditions:
                items:
                  description: PushSecretStatusCondition indicates the status of the
                    PushSecret.
                  properties:
                    lastTransitionTime:
                      format: date-time
                      type: string
                    message:
                      type: string
                    reason:
                      type: string
                    status:
                      type: string
                    type:
                      description: PushSecretConditionType indicates the condition
                        of the PushSecret.
                      type: string
                  required:
                  - status
                  - type
                  type: object
                type: array
              failedNamespaces:
                description: Failed namespaces are the namespaces that failed to apply
                  an PushSecret
                items:
                  description: ClusterPushSecretNamespaceFailure represents a failed
                    namespace deployment and it's reason.
                  properties:
                    namespace:
                      description: Namespace is the namespace that failed when trying
                        to apply an PushSecret
                      type: string
                    reason:
                      description: Reason is why the PushSecret failed to apply to
                        the namespace
                      type: string
                  required:
                  - namespace
                  type: object
                type: array
              provisionedNamespaces:
                description: ProvisionedNamespaces are the namespaces where the ClusterPushSecret
                  has secrets
                items:
                  type: string
                type: array
              pushSecretName:
                type: string
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}