secrets.hashicorp.com_hcpvaultsecretsapps.yaml

# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1

---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.19.0
  name: hcpvaultsecretsapps.secrets.hashicorp.com
spec:
  group: secrets.hashicorp.com
  names:
    kind: HCPVaultSecretsApp
    listKind: HCPVaultSecretsAppList
    plural: hcpvaultsecretsapps
    singular: hcpvaultsecretsapp
  scope: Namespaced
  versions:
  - name: v1beta1
    schema:
      openAPIV3Schema:
        description: HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps
          API
        properties:
          apiVersion:
            description: |-
              APIVersion defines the versioned schema of this representation of an object.
              Servers should convert recognized schemas to the latest internal value, and
              may reject unrecognized values.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
            type: string
          kind:
            description: |-
              Kind is a string value representing the REST resource this object represents.
              Servers may infer this from the endpoint the client submits requests to.
              Cannot be updated.
              In CamelCase.
              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
            type: string
          metadata:
            type: object
          spec:
            description: HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp
            properties:
              appName:
                description: AppName of the Vault Secrets Application that is to be
                  synced.
                type: string
              destination:
                description: |-
                  Destination provides configuration necessary for syncing the HCP Vault
                  Application secrets to Kubernetes.
                properties:
                  annotations:
                    additionalProperties:
                      type: string
                    description: Annotations to apply to the Secret. Requires Create
                      to be set to true.
                    type: object
                  create:
                    default: false
                    description: |-
                      Create the destination Secret.
                      If the Secret already exists this should be set to false.
                    type: boolean
                  labels:
                    additionalProperties:
                      type: string
                    description: Labels to apply to the Secret. Requires Create to
                      be set to true.
                    type: object
                  name:
                    description: Name of the Secret
                    type: string
                  overwrite:
                    default: false
                    description: |-
                      Overwrite the destination Secret if it exists and Create is true. This is
                      useful when migrating to VSO from a previous secret deployment strategy.
                    type: boolean
                  transformation:
                    description: |-
                      Transformation provides configuration for transforming the secret data before
                      it is stored in the Destination.
                    properties:
                      excludeRaw:
                        description: |-
                          ExcludeRaw data from the destination Secret. Exclusion policy can be set
                          globally by including 'exclude-raw` in the '--global-transformation-options'
                          command line flag. If set, the command line flag always takes precedence over
                          this configuration.
                        type: boolean
                      excludes:
                        description: |-
                          Excludes contains regex patterns used to filter top-level source secret data
                          fields for exclusion from the final K8s Secret data. These pattern filters are
                          never applied to templated fields as defined in Templates. They are always
                          applied before any inclusion patterns. To exclude all source secret data
                          fields, you can configure the single pattern ".*".
                        items:
                          type: string
                        type: array
                      includes:
                        description: |-
                          Includes contains regex patterns used to filter top-level source secret data
                          fields for inclusion in the final K8s Secret data. These pattern filters are
                          never applied to templated fields as defined in Templates. They are always
                          applied last.
                        items:
                          type: string
                        type: array
                      templates:
                        additionalProperties:
                          description: Template provides templating configuration.
                          properties:
                            name:
                              description: Name of the Template
                              type: string
                            text:
                              description: |-
                                Text contains the Go text template format. The template
                                references attributes from the data structure of the source secret.
                                Refer to https://pkg.go.dev/text/template for more information.
                              type: string
                          required:
                          - text
                          type: object
                        description: |-
                          Templates maps a template name to its Template. Templates are always included
                          in the rendered K8s Secret, and take precedence over templates defined in a
                          SecretTransformation.
                        type: object
                      transformationRefs:
                        description: |-
                          TransformationRefs contain references to template configuration from
                          SecretTransformation.
                        items:
                          description: |-
                            TransformationRef contains the configuration for accessing templates from an
                            SecretTransformation resource. TransformationRefs can be shared across all
                            syncable secret custom resources.
                          properties:
                            ignoreExcludes:
                              description: |-
                                IgnoreExcludes controls whether to use the SecretTransformation's Excludes
                                data key filters.
                              type: boolean
                            ignoreIncludes:
                              description: |-
                                IgnoreIncludes controls whether to use the SecretTransformation's Includes
                                data key filters.
                              type: boolean
                            name:
                              description: Name of the SecretTransformation resource.
                              type: string
                            namespace:
                              description: Namespace of the SecretTransformation resource.
                              type: string
                            templateRefs:
                              description: |-
                                TemplateRefs map to a Template found in this TransformationRef. If empty, then
                                all templates from the SecretTransformation will be rendered to the K8s Secret.
                              items:
                                description: |-
                                  TemplateRef points to templating text that is stored in a
                                  SecretTransformation custom resource.
                                properties:
                                  keyOverride:
                                    description: |-
                                      KeyOverride to the rendered template in the Destination secret. If Key is
                                      empty, then the Key from reference spec will be used. Set this to override the
                                      Key set from the reference spec.
                                    type: string
                                  name:
                                    description: |-
                                      Name of the Template in SecretTransformationSpec.Templates.
                                      the rendered secret data.
                                    type: string
                                required:
                                - name
                                type: object
                              type: array
                          required:
                          - name
                          type: object
                        type: array
                    type: object
                  type:
                    description: |-
                      Type of Kubernetes Secret. Requires Create to be set to true.
                      Defaults to Opaque.
                    type: string
                required:
                - name
                type: object
              hcpAuthRef:
                description: |-
                  HCPAuthRef to the HCPAuth resource, can be prefixed with a namespace, eg:
                  `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default
                  to the namespace of the HCPAuth CR. If no value is specified for HCPAuthRef the
                  Operator will default to the `default` HCPAuth, configured in the operator's
                  namespace.
                type: string
              refreshAfter:
                default: 600s
                description: RefreshAfter a period of time, in duration notation e.g.
                  30s, 1m, 24h
                pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
                type: string
              rolloutRestartTargets:
                description: |-
                  RolloutRestartTargets should be configured whenever the application(s)
                  consuming the HCP Vault Secrets App does not support dynamically reloading a
                  rotated secret. In that case one, or more RolloutRestartTarget(s) can be
                  configured here. The Operator will trigger a "rollout-restart" for each target
                  whenever the Vault secret changes between reconciliation events. See
                  RolloutRestartTarget for more details.
                items:
                  description: |-
                    RolloutRestartTarget provides the configuration required to perform a
                    rollout-restart of the supported resources upon Vault Secret rotation.
                    The rollout-restart is triggered by patching the target resource's
                    'spec.template.metadata.annotations' to include 'vso.secrets.hashicorp.com/restartedAt'
                    with a timestamp value of when the trigger was executed.
                    E.g. vso.secrets.hashicorp.com/restartedAt: "2023-03-23T13:39:31Z"

                    For Strimzi KafkaConnect the annotation is instead applied to
                    'spec.template.pod.metadata.annotations', which is where Strimzi propagates
                    pod-level annotations from.

                    Supported resources: Deployment, DaemonSet, StatefulSet, argo.Rollout, KafkaConnect
                  properties:
                    kind:
                      description: Kind of the resource
                      enum:
                      - Deployment
                      - DaemonSet
                      - StatefulSet
                      - argo.Rollout
                      - KafkaConnect
                      type: string
                    name:
                      description: Name of the resource
                      type: string
                  required:
                  - kind
                  - name
                  type: object
                type: array
              syncConfig:
                description: SyncConfig configures sync behavior from HVS to VSO
                properties:
                  dynamic:
                    description: Dynamic configures sync behavior for dynamic secrets.
                    properties:
                      renewalPercent:
                        default: 67
                        description: |-
                          RenewalPercent is the percent out of 100 of a dynamic secret's TTL when
                          new secrets are generated. Defaults to 67 percent plus up to 10% jitter.
                        maximum: 90
                        minimum: 0
                        type: integer
                    type: object
                type: object
            required:
            - appName
            - destination
            type: object
          status:
            description: HCPVaultSecretsAppStatus defines the observed state of HCPVaultSecretsApp
            properties:
              conditions:
                description: |-
                  Conditions hold information that can be used by other apps to determine the
                  health of the resource instance.
                items:
                  description: Condition contains details for one aspect of the current
                    state of this API Resource.
                  properties:
                    lastTransitionTime:
                      description: |-
                        lastTransitionTime is the last time the condition transitioned from one status to another.
                        This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
                      format: date-time
                      type: string
                    message:
                      description: |-
                        message is a human readable message indicating details about the transition.
                        This may be an empty string.
                      maxLength: 32768
                      type: string
                    observedGeneration:
                      description: |-
                        observedGeneration represents the .metadata.generation that the condition was set based upon.
                        For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
                        with respect to the current state of the instance.
                      format: int64
                      minimum: 0
                      type: integer
                    reason:
                      description: |-
                        reason contains a programmatic identifier indicating the reason for the condition's last transition.
                        Producers of specific condition types may define expected values and meanings for this field,
                        and whether the values are considered a guaranteed API.
                        The value should be a CamelCase string.
                        This field may not be empty.
                      maxLength: 1024
                      minLength: 1
                      pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
                      type: string
                    status:
                      description: status of the condition, one of True, False, Unknown.
                      enum:
                      - "True"
                      - "False"
                      - Unknown
                      type: string
                    type:
                      description: type of condition in CamelCase or in foo.example.com/CamelCase.
                      maxLength: 316
                      pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
                      type: string
                  required:
                  - lastTransitionTime
                  - message
                  - reason
                  - status
                  - type
                  type: object
                type: array
              dynamicSecrets:
                description: |-
                  DynamicSecrets lists the last observed state of any dynamic secrets
                  within the HCP Vault Secrets App
                items:
                  description: |-
                    HVSDynamicStatus defines the observed state of a dynamic secret within an HCP
                    Vault Secrets App
                  properties:
                    createdAt:
                      description: CreatedAt is the timestamp string of when the dynamic
                        secret was created
                      type: string
                    expiresAt:
                      description: ExpiresAt is the timestamp string of when the dynamic
                        secret will expire
                      type: string
                    name:
                      description: Name of the dynamic secret
                      type: string
                    ttl:
                      description: TTL is the time-to-live of the dynamic secret in
                        seconds
                      type: string
                  type: object
                type: array
              lastGeneration:
                description: LastGeneration is the Generation of the last reconciled
                  resource.
                format: int64
                type: integer
              secretMAC:
                description: |-
                  SecretMAC used when deciding whether new Vault secret data should be synced.

                  The controller will compare the "new" HCP Vault Secrets App data to this value
                  using HMAC, if they are different, then the data will be synced to the
                  Destination.

                  The SecretMac is also used to detect drift in the Destination Secret's Data.
                  If drift is detected the data will be synced to the Destination.
                type: string
            required:
            - lastGeneration
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}