helm-external-secrets/config/crds/bases/generators.external-secrets.io_stssessiontokens.yaml

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  labels:
    external-secrets.io/component: controller
  name: stssessiontokens.generators.external-secrets.io
spec:
  group: generators.external-secrets.io
  names:
    categories:
    - external-secrets
    - external-secrets-generators
    kind: STSSessionToken
    listKind: STSSessionTokenList
    plural: stssessiontokens
    singular: stssessiontoken
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: |-
          STSSessionToken uses the GetSessionToken API to retrieve an authorization token.
          The authorization token is valid for 12 hours.
          The authorizationToken returned is a base64 encoded string that can be decoded.
          For more information, see GetSessionToken (https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html).
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: STSSessionTokenSpec defines the desired state to generate
              an AWS STS session token.
            properties:
              auth:
                description: Auth defines how to authenticate with AWS
                properties:
                  jwt:
                    description: AWSJWTAuth provides configuration to authenticate
                      against AWS using service account tokens.
                    properties:
                      serviceAccountRef:
                        description: ServiceAccountSelector is a reference to a ServiceAccount
                          resource.
                        properties:
                          audiences:
                            description: |-
                              Audience specifies the `aud` claim for the service account token
                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
                              then this audiences will be appended to the list
                            items:
                              type: string
                            type: array
                          name:
                            description: The name of the ServiceAccount resource being
                              referred to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              Namespace of the resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        required:
                        - name
                        type: object
                    type: object
                  secretRef:
                    description: |-
                      AWSAuthSecretRef holds secret references for AWS credentials
                      both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
                    properties:
                      accessKeyIDSecretRef:
                        description: The AccessKeyID is used for authentication
                        properties:
                          key:
                            description: |-
                              A key in the referenced Secret.
                              Some instances of this field may be defaulted, in others it may be required.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[-._a-zA-Z0-9]+$
                            type: string
                          name:
                            description: The name of the Secret resource being referred
                              to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              The namespace of the Secret resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        type: object
                      secretAccessKeySecretRef:
                        description: The SecretAccessKey is used for authentication
                        properties:
                          key:
                            description: |-
                              A key in the referenced Secret.
                              Some instances of this field may be defaulted, in others it may be required.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[-._a-zA-Z0-9]+$
                            type: string
                          name:
                            description: The name of the Secret resource being referred
                              to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              The namespace of the Secret resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        type: object
                      sessionTokenSecretRef:
                        description: |-
                          The SessionToken used for authentication
                          This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
                          see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
                        properties:
                          key:
                            description: |-
                              A key in the referenced Secret.
                              Some instances of this field may be defaulted, in others it may be required.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[-._a-zA-Z0-9]+$
                            type: string
                          name:
                            description: The name of the Secret resource being referred
                              to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              The namespace of the Secret resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        type: object
                    type: object
                type: object
              region:
                description: Region specifies the region to operate in.
                type: string
              requestParameters:
                description: RequestParameters contains parameters that can be passed
                  to the STS service.
                properties:
                  serialNumber:
                    description: |-
                      SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making
                      the GetSessionToken call.
                      Possible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device
                      (such as arn:aws:iam::123456789012:mfa/user)
                    type: string
                  sessionDuration:
                    format: int32
                    type: integer
                  tokenCode:
                    description: TokenCode is the value provided by the MFA device,
                      if MFA is required.
                    type: string
                type: object
              role:
                description: |-
                  You can assume a role before making calls to the
                  desired AWS service.
                type: string
            required:
            - region
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}