Skip to content

Commit 2bc3a75

Browse files
mionomiono
authored
Add secret-sync.gke.io/secretsync_v1 (#777)
1 parent f86819e commit 2bc3a75

File tree

1 file changed

+215
-0
lines changed

1 file changed

+215
-0
lines changed

‎secret-sync.gke.io/secretsync_v1.json‎

Lines changed: 215 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,215 @@
1+
{
2+
"description": "SecretSync represents the desired and observed state of the secret synchronization process.\nThe SecretSync name is used as the name of the secret object created by the controller.",
3+
"properties": {
4+
"apiVersion": {
5+
"description": "APIVersion defines the versioned schema of this representation of an object.\nServers should convert recognized schemas to the latest internal value, and\nmay reject unrecognized values.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
6+
"type": "string"
7+
},
8+
"kind": {
9+
"description": "Kind is a string value representing the REST resource this object represents.\nServers may infer this from the endpoint the client submits requests to.\nCannot be updated.\nIn CamelCase.\nMore info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
10+
"type": "string"
11+
},
12+
"metadata": {
13+
"type": "object"
14+
},
15+
"spec": {
16+
"description": "SecretSyncSpec defines the desired state for synchronizing secret.",
17+
"properties": {
18+
"forceSynchronization": {
19+
"description": "forceSynchronization can be used to force the secret synchronization. The secret synchronization is\ntriggered by changing the value in this field.\nThis field is not used to resolve synchronization conflicts.\nIt is not related with the force query parameter in the Apply operation.\nhttps://kubernetes.io/docs/reference/using-api/server-side-apply/#conflicts",
20+
"maxLength": 253,
21+
"pattern": "^[A-Za-z0-9]([-A-Za-z0-9]+([-._a-zA-Z0-9]?[A-Za-z0-9])*)?",
22+
"type": "string"
23+
},
24+
"secretObject": {
25+
"description": "secretObject specifies the configuration for the synchronized Kubernetes secret object.",
26+
"properties": {
27+
"annotations": {
28+
"additionalProperties": {
29+
"type": "string"
30+
},
31+
"description": "annotations contains key-value pairs representing annotations associated with the Kubernetes secret object.\nThe following annotation prefix is reserved: secrets-store.sync.x-k8s.io/.\nCreation fails if the annotation key is specified in the SecretSync object by the user.",
32+
"type": "object",
33+
"x-kubernetes-validations": [
34+
{
35+
"message": "Annotations should have < 253 characters for both keys and values.",
36+
"rule": "(self.all(x, x.size() < 253 && self[x].size() < 253) == true)"
37+
},
38+
{
39+
"message": "Annotations should not contain secrets-store.sync.x-k8s.io. This key is reserved for the controller.",
40+
"rule": "(self.all(x, x.startsWith('secrets-store.sync.x-k8s.io') == false))"
41+
}
42+
]
43+
},
44+
"data": {
45+
"description": "data is a list of SecretObjectData containing secret data source from the Secret Provider Class and the\ncorresponding data field key used in the Kubernetes secret object.",
46+
"items": {
47+
"description": "SecretObjectData defines the desired state of synchronized data within a Kubernetes secret object.",
48+
"properties": {
49+
"sourcePath": {
50+
"description": "sourcePath is the data source value of the secret defined in the Secret Provider Class.\nThis matches the path of a file in the MountResponse returned from the provider.",
51+
"maxLength": 253,
52+
"minLength": 1,
53+
"pattern": "^[A-Za-z0-9.]([-A-Za-z0-9]+([-._a-zA-Z0-9]?[A-Za-z0-9])*)?(\\/([0-9]+))*$",
54+
"type": "string"
55+
},
56+
"targetKey": {
57+
"description": "targetKey is the key in the Kubernetes secret's data field as described in the Kubernetes API reference:\nhttps://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/",
58+
"maxLength": 253,
59+
"minLength": 1,
60+
"pattern": "^[A-Za-z0-9.]([-A-Za-z0-9]+([-._a-zA-Z0-9]?[A-Za-z0-9])*)?(\\/([0-9]+))*$",
61+
"type": "string"
62+
}
63+
},
64+
"required": [
65+
"sourcePath",
66+
"targetKey"
67+
],
68+
"type": "object",
69+
"additionalProperties": false
70+
},
71+
"minItems": 1,
72+
"type": "array",
73+
"x-kubernetes-list-map-keys": [
74+
"targetKey"
75+
],
76+
"x-kubernetes-list-type": "map"
77+
},
78+
"labels": {
79+
"additionalProperties": {
80+
"type": "string"
81+
},
82+
"description": "labels contains key-value pairs representing labels associated with the Kubernetes secret object.\nThe labels are used to identify the secret object created by the controller.\nOn secret creation, the following label is added: secrets-store.sync.x-k8s.io/secretsync=<secret-sync-name>.\nThe following label prefix is reserved: secrets-store.sync.x-k8s.io/.\nCreation fails if the label is specified in the SecretSync object with a different value.\nOn secret update, if the validation admission policy is set, the controller will check if the label\nsecrets-store.sync.x-k8s.io/secretsync=<secret-sync-name> is present. If the label is not present,\ncontroller fails to update the secret.",
83+
"type": "object",
84+
"x-kubernetes-validations": [
85+
{
86+
"message": "Labels should have < 63 characters for both keys and values.",
87+
"rule": "(self.all(x, x.size() < 63 && self[x].size() < 63) == true)"
88+
},
89+
{
90+
"message": "Labels should not contain secrets-store.sync.x-k8s.io. This key is reserved for the controller.",
91+
"rule": "(self.all(x, x.startsWith('secrets-store.sync.x-k8s.io') == false))"
92+
}
93+
]
94+
},
95+
"type": {
96+
"description": "type specifies the type of the Kubernetes secret object,\ne.g. \"Opaque\";\"kubernetes.io/basic-auth\";\"kubernetes.io/ssh-auth\";\"kubernetes.io/tls\"\nThe controller must have permission to create secrets of the specified type.",
97+
"maxLength": 253,
98+
"minLength": 1,
99+
"type": "string"
100+
}
101+
},
102+
"required": [
103+
"data",
104+
"type"
105+
],
106+
"type": "object",
107+
"additionalProperties": false
108+
},
109+
"secretProviderClassName": {
110+
"description": "secretProviderClassName specifies the name of the secret provider class used to pass information to\naccess the secret store.",
111+
"maxLength": 253,
112+
"minLength": 1,
113+
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
114+
"type": "string"
115+
},
116+
"secretSyncControllerName": {
117+
"default": "",
118+
"description": "secretSyncControllerName specifies the name of the secrets store sync controller used to synchronize\nthe secret.",
119+
"type": "string"
120+
},
121+
"serviceAccountName": {
122+
"description": "serviceAccountName specifies the name of the service account used to access the secret store.\nThe audience field in the service account token must be passed as parameter in the controller configuration.\nThe audience is used when requesting a token from the API server for the service account; the supported\naudiences are defined by each provider.",
123+
"maxLength": 253,
124+
"minLength": 1,
125+
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$",
126+
"type": "string"
127+
}
128+
},
129+
"required": [
130+
"secretObject",
131+
"secretProviderClassName",
132+
"serviceAccountName"
133+
],
134+
"type": "object",
135+
"additionalProperties": false
136+
},
137+
"status": {
138+
"description": "SecretSyncStatus defines the observed state of the secret synchronization process.",
139+
"properties": {
140+
"conditions": {
141+
"items": {
142+
"description": "Condition contains details for one aspect of the current state of this API Resource.\n---\nThis struct is intended for direct use as an array at the field path .status.conditions. For example,\n\n\n\ttype FooStatus struct{\n\t // Represents the observations of a foo's current state.\n\t // Known .status.conditions.type are: \"Available\", \"Progressing\", and \"Degraded\"\n\t // +patchMergeKey=type\n\t // +patchStrategy=merge\n\t // +listType=map\n\t // +listMapKey=type\n\t Conditions []metav1.Condition `json:\"conditions,omitempty\" patchStrategy:\"merge\" patchMergeKey:\"type\" protobuf:\"bytes,1,rep,name=conditions\"`\n\n\n\t // other fields\n\t}",
143+
"properties": {
144+
"lastTransitionTime": {
145+
"description": "lastTransitionTime is the last time the condition transitioned from one status to another.\nThis should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.",
146+
"format": "date-time",
147+
"type": "string"
148+
},
149+
"message": {
150+
"description": "message is a human readable message indicating details about the transition.\nThis may be an empty string.",
151+
"maxLength": 32768,
152+
"type": "string"
153+
},
154+
"observedGeneration": {
155+
"description": "observedGeneration represents the .metadata.generation that the condition was set based upon.\nFor instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date\nwith respect to the current state of the instance.",
156+
"format": "int64",
157+
"minimum": 0,
158+
"type": "integer"
159+
},
160+
"reason": {
161+
"description": "reason contains a programmatic identifier indicating the reason for the condition's last transition.\nProducers of specific condition types may define expected values and meanings for this field,\nand whether the values are considered a guaranteed API.\nThe value should be a CamelCase string.\nThis field may not be empty.",
162+
"maxLength": 1024,
163+
"minLength": 1,
164+
"pattern": "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$",
165+
"type": "string"
166+
},
167+
"status": {
168+
"description": "status of the condition, one of True, False, Unknown.",
169+
"enum": [
170+
"True",
171+
"False",
172+
"Unknown"
173+
],
174+
"type": "string"
175+
},
176+
"type": {
177+
"description": "type of condition in CamelCase or in foo.example.com/CamelCase.\n---\nMany .condition.type values are consistent across resources like Available, but because arbitrary conditions can be\nuseful (see .node.status.conditions), the ability to deconflict is important.\nThe regex it matches is (dns1123SubdomainFmt/)?(qualifiedNameFmt)",
178+
"maxLength": 316,
179+
"pattern": "^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$",
180+
"type": "string"
181+
}
182+
},
183+
"required": [
184+
"lastTransitionTime",
185+
"message",
186+
"reason",
187+
"status",
188+
"type"
189+
],
190+
"type": "object",
191+
"additionalProperties": false
192+
},
193+
"maxItems": 16,
194+
"type": "array",
195+
"x-kubernetes-list-map-keys": [
196+
"type"
197+
],
198+
"x-kubernetes-list-type": "map"
199+
},
200+
"lastSuccessfulSyncTime": {
201+
"description": "lastSuccessfulSyncTime represents the last time the secret was retrieved from the Provider and updated.",
202+
"format": "date-time",
203+
"type": "string"
204+
},
205+
"syncHash": {
206+
"description": "syncHash contains the hash of the secret object data, data from the SecretProviderClass (e.g. UID,\nand metadata.generation), and similar data from the SecretSync. This hash is used to\ndetermine if the secret changed.\nThe hash is calculated using the HMAC (Hash-based Message Authentication Code) algorithm, using bcrypt\nhashing, with the SecretsSync's UID as the key.\nThe secret is updated if:\n\t\t1. the hash is different\n\t\t2. the lastSuccessfulSyncTime indicates a rotation is required\n\t\t\t- the rotation poll interval is passed as a parameter in the controller configuration\n\t\t3. the SecretUpdateStatus is 'Failed'",
207+
"type": "string"
208+
}
209+
},
210+
"type": "object",
211+
"additionalProperties": false
212+
}
213+
},
214+
"type": "object"
215+
}

0 commit comments

Comments
 (0)