helm-external-secrets/config/crds/bases/provider.external-secrets.io_secretsmanagers.yaml

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: secretsmanagers.provider.external-secrets.io
spec:
  group: provider.external-secrets.io
  names:
    categories:
    - externalsecrets
    kind: SecretsManager
    listKind: SecretsManagerList
    plural: secretsmanagers
    shortNames:
    - sm
    singular: secretsmanager
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .spec.region
      name: Region
      type: string
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    name: v2alpha1
    schema:
      openAPIV3Schema:
        description: SecretsManager is the Schema for AWS Secrets Manager provider
          configuration.
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: SecretsManagerSpec defines the desired state of SecretsManager.
            properties:
              additionalRoles:
                description: AdditionalRoles is a chained list of Role ARNs which
                  the provider will sequentially assume before assuming the Role
                items:
                  type: string
                type: array
              auth:
                description: |-
                  Auth defines the information necessary to authenticate against AWS
                  if not set aws sdk will infer credentials from your environment
                  see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
                properties:
                  jwt:
                    description: AWSJWTAuth stores reference to Authenticate against
                      AWS using service account tokens.
                    properties:
                      serviceAccountRef:
                        description: ServiceAccountSelector is a reference to a ServiceAccount
                          resource.
                        properties:
                          audiences:
                            description: |-
                              Audience specifies the `aud` claim for the service account token
                              If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
                              then this audiences will be appended to the list
                            items:
                              type: string
                            type: array
                          name:
                            description: The name of the ServiceAccount resource being
                              referred to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              Namespace of the resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        required:
                        - name
                        type: object
                    type: object
                  secretRef:
                    description: |-
                      AWSAuthSecretRef holds secret references for AWS credentials
                      both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
                    properties:
                      accessKeyIDSecretRef:
                        description: The AccessKeyID is used for authentication
                        properties:
                          key:
                            description: |-
                              A key in the referenced Secret.
                              Some instances of this field may be defaulted, in others it may be required.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[-._a-zA-Z0-9]+$
                            type: string
                          name:
                            description: The name of the Secret resource being referred
                              to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              The namespace of the Secret resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        type: object
                      secretAccessKeySecretRef:
                        description: The SecretAccessKey is used for authentication
                        properties:
                          key:
                            description: |-
                              A key in the referenced Secret.
                              Some instances of this field may be defaulted, in others it may be required.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[-._a-zA-Z0-9]+$
                            type: string
                          name:
                            description: The name of the Secret resource being referred
                              to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              The namespace of the Secret resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        type: object
                      sessionTokenSecretRef:
                        description: |-
                          The SessionToken used for authentication
                          This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
                          see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
                        properties:
                          key:
                            description: |-
                              A key in the referenced Secret.
                              Some instances of this field may be defaulted, in others it may be required.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[-._a-zA-Z0-9]+$
                            type: string
                          name:
                            description: The name of the Secret resource being referred
                              to.
                            maxLength: 253
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
                            type: string
                          namespace:
                            description: |-
                              The namespace of the Secret resource being referred to.
                              Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
                            maxLength: 63
                            minLength: 1
                            pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
                            type: string
                        type: object
                    type: object
                type: object
              externalID:
                description: AWS External ID set on assumed IAM roles
                type: string
              prefix:
                description: Prefix adds a prefix to all retrieved values.
                type: string
              region:
                description: AWS Region to be used for the provider
                type: string
              role:
                description: Role is a Role ARN which the provider will assume
                type: string
              secretsManager:
                description: SecretsManager defines how the provider behaves when
                  interacting with AWS SecretsManager
                properties:
                  forceDeleteWithoutRecovery:
                    description: |-
                      Specifies whether to delete the secret without any recovery window. You
                      can't use both this parameter and RecoveryWindowInDays in the same call.
                      If you don't use either, then by default Secrets Manager uses a 30 day
                      recovery window.
                      see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery
                    type: boolean
                  recoveryWindowInDays:
                    description: |-
                      The number of days from 7 to 30 that Secrets Manager waits before
                      permanently deleting the secret. You can't use both this parameter and
                      ForceDeleteWithoutRecovery in the same call. If you don't use either,
                      then by default Secrets Manager uses a 30-day recovery window.
                      see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays
                    type: integer
                type: object
              sessionTags:
                description: AWS STS assume role session tags
                items:
                  description: |-
                    Tag is a key-value pair that can be attached to an AWS resource.
                    see: https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html
                  properties:
                    key:
                      type: string
                    value:
                      type: string
                  required:
                  - key
                  - value
                  type: object
                type: array
              transitiveTagKeys:
                description: AWS STS assume role transitive session tags. Required
                  when multiple rules are used with the provider
                items:
                  type: string
                type: array
            required:
            - region
            type: object
          status:
            description: SecretsManagerStatus defines the observed state of SecretsManager.
            properties:
              conditions:
                description: Conditions represent the latest available observations
                  of the resource's state.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}