Skip to content

api-reference.md

Latest commit

 

History

History
1415 lines (767 loc) · 68.7 KB

api-reference.md

File metadata and controls

1415 lines (767 loc) · 68.7 KB
Raw

API Reference

Packages

secrets.hashicorp.com/v1beta1

Package v1beta1 contains API Schema definitions for the secrets v1beta1 API group

Resource Types

AccessControl

AccessControl provides configuration for controlling access to the secret. It allows specifying the namespaces, service account, pod names, and pod labels that should be allowed to access the secret.

Appears in:

Field Description Default Validation
serviceAccountPattern string ServiceAccountPattern is the name of the service account that should be used to
access the secret. It can be specified as a regex pattern.
A valid service account is always required.
namespacePatterns string array NamespacePatterns is a list of namespace name regex patterns that are allowed access.
podNamePatterns string array PodNamePatterns is a list of pod name regex patterns that should be allowed access.
podLabels object (keys:string, values:string) PodLabels is a map of pod label key-value pairs that should be allowed access.
matchPolicy string MatchPolicy is the policy to use when matching the access control rules. If
set to "any", only one of the rules should match. If set to "all", all the
rules should match.		 all Enum: [any all]

CSISecrets

CSISecrets is the Schema for the csisecrets API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string CSISecrets
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec CSISecretsSpec

CSISecretsList

CSISecretsList contains a list of CSISecrets

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string CSISecretsList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items CSISecrets array

CSISecretsSpec

CSISecretsSpec defines the desired state of CSISecrets. It contains the configuration for the CSI driver to populate the secret data.

Appears in:

Field Description Default Validation
namespace string Namespace is the Vault namespace where the secret is located.
accessControl AccessControl AccessControl provides configuration for controlling access to the secret.
secrets SecretCollection Secrets that will be synced with the CSI driver.
syncConfig CSISyncConfig SyncConfig provides configuration for syncing the secret data with the CSI driver.
vaultAuthRef VaultAuthRef VaultAuthRef is the reference to the VaultAuth resource.

CSISyncConfig

Appears in:

Field Description Default Validation
containerState ContainerState ContainerState is the state of the container that the CSI driver always sync
on. This configuration is useful to sync when the last state of the container
is in the terminated state and the restart count is greater than 0.

ContainerState

Appears in:

Field Description Default Validation
namePattern string NamePattern of the container. Can be expressed as a regular expression.
imagePattern string ImagePattern of the container. Can be expressed as a regular expression.

Destination

Destination provides the configuration that will be applied to the destination Kubernetes Secret during a Vault Secret -> K8s Secret sync.

Appears in:

Field Description Default Validation
name string Name of the Secret
create boolean Create the destination Secret.
If the Secret already exists this should be set to false.		 false
overwrite boolean Overwrite the destination Secret if it exists and Create is true. This is
useful when migrating to VSO from a previous secret deployment strategy.		 false
labels object (keys:string, values:string) Labels to apply to the Secret. Requires Create to be set to true.
annotations object (keys:string, values:string) Annotations to apply to the Secret. Requires Create to be set to true.
type SecretType Type of Kubernetes Secret. Requires Create to be set to true.
Defaults to Opaque.
transformation Transformation Transformation provides configuration for transforming the secret data before
it is stored in the Destination.

HCPAuth

HCPAuth is the Schema for the hcpauths API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string HCPAuth
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec HCPAuthSpec

HCPAuthList

HCPAuthList contains a list of HCPAuth

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string HCPAuthList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items HCPAuth array

HCPAuthServicePrincipal

HCPAuthServicePrincipal provides HCPAuth configuration options needed for authenticating to HCP using a service principal configured in SecretRef.

Appears in:

Field Description Default Validation
secretRef string SecretRef is the name of a Kubernetes secret in the consumer's
(VDS/VSS/PKI/HCP) namespace which provides the HCP ServicePrincipal clientID,
and clientSecret.
The secret data must have the following structure {
"clientID": "clientID",
"clientSecret": "clientSecret",
}

HCPAuthSpec

HCPAuthSpec defines the desired state of HCPAuth

Appears in:

Field Description Default Validation
organizationID string OrganizationID of the HCP organization.
projectID string ProjectID of the HCP project.
allowedNamespaces string array AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod.
This field allows administrators to customize which Kubernetes namespaces are authorized to
use with this AuthMethod. While Vault will still enforce its own rules, this has the added
configurability of restricting which HCPAuthMethods can be used by which namespaces.
Accepted values:
[]{"*"} - wildcard, all namespaces.
[]{"a", "b"} - list of namespaces.
unset - disallow all namespaces except the Operator's the HCPAuthMethod's namespace, this
is the default behavior.
method string Method to use when authenticating to Vault. servicePrincipal Enum: [servicePrincipal]
servicePrincipal HCPAuthServicePrincipal ServicePrincipal provides the necessary configuration for authenticating to
HCP using a service principal. For security reasons, only project-level
service principals should ever be used.

HCPVaultSecretsApp

HCPVaultSecretsApp is the Schema for the hcpvaultsecretsapps API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string HCPVaultSecretsApp
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec HCPVaultSecretsAppSpec

HCPVaultSecretsAppList

HCPVaultSecretsAppList contains a list of HCPVaultSecretsApp

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string HCPVaultSecretsAppList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items HCPVaultSecretsApp array

HCPVaultSecretsAppSpec

HCPVaultSecretsAppSpec defines the desired state of HCPVaultSecretsApp

Appears in:

Field Description Default Validation
appName string AppName of the Vault Secrets Application that is to be synced.
hcpAuthRef string HCPAuthRef to the HCPAuth resource, can be prefixed with a namespace, eg:
namespaceA/vaultAuthRefB. If no namespace prefix is provided it will default
to the namespace of the HCPAuth CR. If no value is specified for HCPAuthRef the
Operator will default to the default HCPAuth, configured in the operator's
namespace.
refreshAfter string RefreshAfter a period of time, in duration notation e.g. 30s, 1m, 24h 600s Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
Type: string
rolloutRestartTargets RolloutRestartTarget array RolloutRestartTargets should be configured whenever the application(s)
consuming the HCP Vault Secrets App does not support dynamically reloading a
rotated secret. In that case one, or more RolloutRestartTarget(s) can be
configured here. The Operator will trigger a "rollout-restart" for each target
whenever the Vault secret changes between reconciliation events. See
RolloutRestartTarget for more details.
destination Destination Destination provides configuration necessary for syncing the HCP Vault
Application secrets to Kubernetes.
syncConfig HVSSyncConfig SyncConfig configures sync behavior from HVS to VSO

HVSDynamicStatus

HVSDynamicStatus defines the observed state of a dynamic secret within an HCP Vault Secrets App

Appears in:

Field Description Default Validation
name string Name of the dynamic secret
createdAt string CreatedAt is the timestamp string of when the dynamic secret was created
expiresAt string ExpiresAt is the timestamp string of when the dynamic secret will expire
ttl string TTL is the time-to-live of the dynamic secret in seconds

HVSDynamicSyncConfig

HVSDynamicSyncConfig configures sync behavior for HVS dynamic secrets.

Appears in:

Field Description Default Validation
renewalPercent integer RenewalPercent is the percent out of 100 of a dynamic secret's TTL when
new secrets are generated. Defaults to 67 percent plus up to 10% jitter.		 67 Maximum: 90
Minimum: 0

HVSSyncConfig

HVSSyncConfig configures sync behavior from HVS to VSO

Appears in:

Field Description Default Validation
dynamic HVSDynamicSyncConfig Dynamic configures sync behavior for dynamic secrets.

MergeStrategy

MergeStrategy provides the configuration for merging HTTP headers and parameters from the referring VaultAuth resource and its VaultAuthGlobal resource.

Appears in:

Field Description Default Validation
headers string Headers configures the merge strategy for HTTP headers that are included in
all Vault requests. Choices are union, replace, or none.
If union is set, the headers from the VaultAuthGlobal and VaultAuth
resources are merged. The headers from the VaultAuth always take precedence.
If replace is set, the first set of non-empty headers taken in order from:
VaultAuth, VaultAuthGlobal auth method, VaultGlobal default headers.
If none is set, the headers from the
VaultAuthGlobal resource are ignored and only the headers from the VaultAuth
resource are used. The default is none.		 Enum: [union replace none]
params string Params configures the merge strategy for HTTP parameters that are included in
all Vault requests. Choices are union, replace, or none.
If union is set, the parameters from the VaultAuthGlobal and VaultAuth
resources are merged. The parameters from the VaultAuth always take
precedence.
If replace is set, the first set of non-empty parameters taken in order from:
VaultAuth, VaultAuthGlobal auth method, VaultGlobal default parameters.
If none is set, the parameters from the VaultAuthGlobal resource are ignored
and only the parameters from the VaultAuth resource are used. The default is
none.		 Enum: [union replace none]

RolloutRestartTarget

RolloutRestartTarget provides the configuration required to perform a rollout-restart of the supported resources upon Vault Secret rotation. The rollout-restart is triggered by patching the target resource's 'spec.template.metadata.annotations' to include 'vso.secrets.hashicorp.com/restartedAt' with a timestamp value of when the trigger was executed. E.g. vso.secrets.hashicorp.com/restartedAt: "2023-03-23T13:39:31Z"

For Strimzi KafkaConnect the annotation is instead applied to 'spec.template.pod.metadata.annotations', which is where Strimzi propagates pod-level annotations from.

Supported resources: Deployment, DaemonSet, StatefulSet, argo.Rollout, KafkaConnect

Appears in:

Field Description Default Validation
kind string Kind of the resource Enum: [Deployment DaemonSet StatefulSet argo.Rollout KafkaConnect]
name string Name of the resource

SecretCollection

Appears in:

Field Description Default Validation
transformation Transformation Transformation provides configuration for transforming the secret data before
it is stored in the CSI volume.
vaultAppRoleSecretIDs VaultAppRoleSecretID array VaultAppRoleSecretIDs is a list of AppRole secret IDs to be used to populate the secret.
vaultStaticSecrets VaultStaticSecretCollectable array VaultStaticSecrets is a list of static secrets to be synced by the CSI driver.

SecretTransformation

SecretTransformation is the Schema for the secrettransformations API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string SecretTransformation
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec SecretTransformationSpec

SecretTransformationList

SecretTransformationList contains a list of SecretTransformation

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string SecretTransformationList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items SecretTransformation array

SecretTransformationSpec

SecretTransformationSpec defines the desired state of SecretTransformation

Appears in:

Field Description Default Validation
templates object (keys:string, values:Template) Templates maps a template name to its Template. Templates are always included
in the rendered secret with the specified key.
sourceTemplates SourceTemplate array SourceTemplates are never included in the rendered secret, they can be
used to provide common template definitions, etc.
includes string array Includes contains regex patterns used to filter top-level source secret data
fields for inclusion in the final secret data. These pattern filters are
never applied to templated fields as defined in Templates. They are always
applied last.
excludes string array Excludes contains regex patterns used to filter top-level source secret data
fields for exclusion from the final secret data. These pattern filters are
never applied to templated fields as defined in Templates. They are always
applied before any inclusion patterns. To exclude all source secret data
fields, you can configure the single pattern ".*".

SourceTemplate

SourceTemplate provides source templating configuration.

Appears in:

Field Description Default Validation
name string
text string Text contains the Go text template format. The template
references attributes from the data structure of the source secret.
Refer to https://pkg.go.dev/text/template for more information.

StorageEncryption

StorageEncryption provides the necessary configuration need to encrypt the storage cache entries using Vault's Transit engine.

Appears in:

Field Description Default Validation
mount string Mount path of the Transit engine in Vault.
keyName string KeyName to use for encrypt/decrypt operations via Vault Transit.

SyncConfig

SyncConfig configures sync behavior from Vault to VSO

Appears in:

Field Description Default Validation
instantUpdates boolean InstantUpdates is a flag to indicate that event-driven updates are
enabled for this VaultStaticSecret

Template

Template provides templating configuration.

Appears in:

Field Description Default Validation
name string Name of the Template
text string Text contains the Go text template format. The template
references attributes from the data structure of the source secret.
Refer to https://pkg.go.dev/text/template for more information.

TemplateRef

TemplateRef points to templating text that is stored in a SecretTransformation custom resource.

Appears in:

Field Description Default Validation
name string Name of the Template in SecretTransformationSpec.Templates.
the rendered secret data.
keyOverride string KeyOverride to the rendered template in the Destination secret. If Key is
empty, then the Key from reference spec will be used. Set this to override the
Key set from the reference spec.

Transformation

Appears in:

Field Description Default Validation
templates object (keys:string, values:Template) Templates maps a template name to its Template. Templates are always included
in the rendered K8s Secret, and take precedence over templates defined in a
SecretTransformation.
transformationRefs TransformationRef array TransformationRefs contain references to template configuration from
SecretTransformation.
includes string array Includes contains regex patterns used to filter top-level source secret data
fields for inclusion in the final K8s Secret data. These pattern filters are
never applied to templated fields as defined in Templates. They are always
applied last.
excludes string array Excludes contains regex patterns used to filter top-level source secret data
fields for exclusion from the final K8s Secret data. These pattern filters are
never applied to templated fields as defined in Templates. They are always
applied before any inclusion patterns. To exclude all source secret data
fields, you can configure the single pattern ".*".
excludeRaw boolean ExcludeRaw data from the destination Secret. Exclusion policy can be set
globally by including 'exclude-raw` in the '--global-transformation-options'
command line flag. If set, the command line flag always takes precedence over
this configuration.

TransformationRef

TransformationRef contains the configuration for accessing templates from an SecretTransformation resource. TransformationRefs can be shared across all syncable secret custom resources.

Appears in:

Field Description Default Validation
namespace string Namespace of the SecretTransformation resource.
name string Name of the SecretTransformation resource.
templateRefs TemplateRef array TemplateRefs map to a Template found in this TransformationRef. If empty, then
all templates from the SecretTransformation will be rendered to the K8s Secret.
ignoreIncludes boolean IgnoreIncludes controls whether to use the SecretTransformation's Includes
data key filters.
ignoreExcludes boolean IgnoreExcludes controls whether to use the SecretTransformation's Excludes
data key filters.

VaultAppRoleSecretID

VaultAppRoleSecretID defines the AppRole secret ID to be used to populate the secret.

Appears in:

Field Description Default Validation
mount string Mount path to the AppRole auth engine.
role string Role is the name of the AppRole.
metadata object (keys:string, values:string) Refer to Kubernetes API documentation for fields of metadata.
cidrList string array CIDRList is the list of CIDR blocks that access the secret ID.
tokenBoundCIDRs string array TokenBoundCIDRs is the list of CIDR blocks that can be used to authenticate
using tokens generated by this secret ID.
ttl string TTL is the TTL for the secret ID, after which it becomes invalid. Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
numUses integer NumUses is the number of times the secret ID can be used.
wrapTTL string WrapTTL is the TTL for the wrapped secret ID. Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
syncRoleID boolean SyncRoleID is the flag to fetch the role ID from the AppRole auth engine.
Requires that the provisioning VaultAuth has the necessary permissions to fetch the role ID.
transformation Transformation Transformation provides configuration for transforming the secret data before
it is stored in the CSI volume.

VaultAuth

VaultAuth is the Schema for the vaultauths API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultAuth
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec VaultAuthSpec

VaultAuthConfigAWS

VaultAuthConfigAWS provides VaultAuth configuration options needed for authenticating to Vault via an AWS AuthMethod. Will use creds from SecretRef or IRSAServiceAccount if provided, in that order. If neither are provided, the underlying node role or instance profile will be used to authenticate to Vault.

Appears in:

Field Description Default Validation
role string Vault role to use for authenticating
region string AWS Region to use for signing the authentication request
headerValue string The Vault header value to include in the STS signing request
sessionName string The role session name to use when creating a webidentity provider
stsEndpoint string The STS endpoint to use; if not set will use the default
iamEndpoint string The IAM endpoint to use; if not set will use the default
secretRef string SecretRef is the name of a Kubernetes Secret in the consumer's (VDS/VSS/PKI) namespace
which holds credentials for AWS. Expected keys include access_key_id, secret_access_key,
session_token
irsaServiceAccount string IRSAServiceAccount name to use with IAM Roles for Service Accounts
(IRSA), and should be annotated with "eks.amazonaws.com/role-arn". This
ServiceAccount will be checked for other EKS annotations:
eks.amazonaws.com/audience and eks.amazonaws.com/token-expiration

VaultAuthConfigAppRole

VaultAuthConfigAppRole provides VaultAuth configuration options needed for authenticating to Vault via an AppRole AuthMethod.

Appears in:

Field Description Default Validation
roleId string RoleID of the AppRole Role to use for authenticating to Vault.
secretIDPath string SecretIDPath is a file system path pointing to a file containing the plaintext Secret ID for the
AppRole Role to use for authenticating to Vault.
SecretIDPath and SecretRef are mutually exclusive, and only one should be specified.
secretRef string SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which
provides the AppRole Role's SecretID. The secret must have a key named id which holds the
AppRole Role's secretID.
SecretIDPath and SecretRef are mutually exclusive, and only one should be specified.

VaultAuthConfigGCP

VaultAuthConfigGCP provides VaultAuth configuration options needed for authenticating to Vault via a GCP AuthMethod, using workload identity

Appears in:

Field Description Default Validation
role string Vault role to use for authenticating
workloadIdentityServiceAccount string WorkloadIdentityServiceAccount is the name of a Kubernetes service
account (in the same Kubernetes namespace as the Vault*Secret referencing
this resource) which has been configured for workload identity in GKE.
Should be annotated with "iam.gke.io/gcp-service-account".
region string GCP Region of the GKE cluster's identity provider. Defaults to the region
returned from the operator pod's local metadata server.
clusterName string GKE cluster name. Defaults to the cluster-name returned from the operator
pod's local metadata server.
projectID string GCP project ID. Defaults to the project-id returned from the operator
pod's local metadata server.

VaultAuthConfigJWT

VaultAuthConfigJWT provides VaultAuth configuration options needed for authenticating to Vault.

Appears in:

Field Description Default Validation
role string Role to use for authenticating to Vault.
secretRef string SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which
provides the JWT token to authenticate to Vault's JWT authentication backend. The secret must
have a key named jwt which holds the JWT token.
serviceAccount string ServiceAccount to use when creating a ServiceAccount token to authenticate to Vault's
JWT authentication backend.
audiences string array TokenAudiences to include in the ServiceAccount token.
tokenExpirationSeconds integer TokenExpirationSeconds to set the ServiceAccount token. 600 Minimum: 600

VaultAuthConfigKubernetes

VaultAuthConfigKubernetes provides VaultAuth configuration options needed for authenticating to Vault.

Appears in:

Field Description Default Validation
role string Role to use for authenticating to Vault.
serviceAccount string ServiceAccount to use when authenticating to Vault's
authentication backend. This must reside in the consuming secret's (VDS/VSS/PKI) namespace.
audiences string array TokenAudiences to include in the ServiceAccount token.
tokenExpirationSeconds integer TokenExpirationSeconds to set the ServiceAccount token. 600 Minimum: 600

VaultAuthGlobal

VaultAuthGlobal is the Schema for the vaultauthglobals API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultAuthGlobal
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec VaultAuthGlobalSpec

VaultAuthGlobalConfigAWS

Appears in:

Field Description Default Validation
role string Vault role to use for authenticating
region string AWS Region to use for signing the authentication request
headerValue string The Vault header value to include in the STS signing request
sessionName string The role session name to use when creating a webidentity provider
stsEndpoint string The STS endpoint to use; if not set will use the default
iamEndpoint string The IAM endpoint to use; if not set will use the default
secretRef string SecretRef is the name of a Kubernetes Secret in the consumer's (VDS/VSS/PKI) namespace
which holds credentials for AWS. Expected keys include access_key_id, secret_access_key,
session_token
irsaServiceAccount string IRSAServiceAccount name to use with IAM Roles for Service Accounts
(IRSA), and should be annotated with "eks.amazonaws.com/role-arn". This
ServiceAccount will be checked for other EKS annotations:
eks.amazonaws.com/audience and eks.amazonaws.com/token-expiration
namespace string Namespace to auth to in Vault
mount string Mount to use when authenticating to auth method.
params object (keys:string, values:string) Params to use when authenticating to Vault
headers object (keys:string, values:string) Headers to be included in all Vault requests.

VaultAuthGlobalConfigAppRole

Appears in:

Field Description Default Validation
roleId string RoleID of the AppRole Role to use for authenticating to Vault.
secretIDPath string SecretIDPath is a file system path pointing to a file containing the plaintext Secret ID for the
AppRole Role to use for authenticating to Vault.
SecretIDPath and SecretRef are mutually exclusive, and only one should be specified.
secretRef string SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which
provides the AppRole Role's SecretID. The secret must have a key named id which holds the
AppRole Role's secretID.
SecretIDPath and SecretRef are mutually exclusive, and only one should be specified.
namespace string Namespace to auth to in Vault
mount string Mount to use when authenticating to auth method.
params object (keys:string, values:string) Params to use when authenticating to Vault
headers object (keys:string, values:string) Headers to be included in all Vault requests.

VaultAuthGlobalConfigGCP

Appears in:

Field Description Default Validation
role string Vault role to use for authenticating
workloadIdentityServiceAccount string WorkloadIdentityServiceAccount is the name of a Kubernetes service
account (in the same Kubernetes namespace as the Vault*Secret referencing
this resource) which has been configured for workload identity in GKE.
Should be annotated with "iam.gke.io/gcp-service-account".
region string GCP Region of the GKE cluster's identity provider. Defaults to the region
returned from the operator pod's local metadata server.
clusterName string GKE cluster name. Defaults to the cluster-name returned from the operator
pod's local metadata server.
projectID string GCP project ID. Defaults to the project-id returned from the operator
pod's local metadata server.
namespace string Namespace to auth to in Vault
mount string Mount to use when authenticating to auth method.
params object (keys:string, values:string) Params to use when authenticating to Vault
headers object (keys:string, values:string) Headers to be included in all Vault requests.

VaultAuthGlobalConfigJWT

Appears in:

Field Description Default Validation
role string Role to use for authenticating to Vault.
secretRef string SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which
provides the JWT token to authenticate to Vault's JWT authentication backend. The secret must
have a key named jwt which holds the JWT token.
serviceAccount string ServiceAccount to use when creating a ServiceAccount token to authenticate to Vault's
JWT authentication backend.
audiences string array TokenAudiences to include in the ServiceAccount token.
tokenExpirationSeconds integer TokenExpirationSeconds to set the ServiceAccount token. 600 Minimum: 600
namespace string Namespace to auth to in Vault
mount string Mount to use when authenticating to auth method.
params object (keys:string, values:string) Params to use when authenticating to Vault
headers object (keys:string, values:string) Headers to be included in all Vault requests.

VaultAuthGlobalConfigKubernetes

Appears in:

Field Description Default Validation
role string Role to use for authenticating to Vault.
serviceAccount string ServiceAccount to use when authenticating to Vault's
authentication backend. This must reside in the consuming secret's (VDS/VSS/PKI) namespace.
audiences string array TokenAudiences to include in the ServiceAccount token.
tokenExpirationSeconds integer TokenExpirationSeconds to set the ServiceAccount token. 600 Minimum: 600
namespace string Namespace to auth to in Vault
mount string Mount to use when authenticating to auth method.
params object (keys:string, values:string) Params to use when authenticating to Vault
headers object (keys:string, values:string) Headers to be included in all Vault requests.

VaultAuthGlobalList

VaultAuthGlobalList contains a list of VaultAuthGlobal

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultAuthGlobalList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items VaultAuthGlobal array

VaultAuthGlobalRef

VaultAuthGlobalRef is a reference to a VaultAuthGlobal resource. A referring VaultAuth resource can use the VaultAuthGlobal resource to share common configuration across multiple VaultAuth resources. The VaultAuthGlobal resource is used to store global configuration for VaultAuth resources.

Appears in:

Field Description Default Validation
name string Name of the VaultAuthGlobal resource. Pattern: ^([a-z0-9.-]\{1,253\})$
namespace string Namespace of the VaultAuthGlobal resource. If not provided, the namespace of
the referring VaultAuth resource is used.		 Pattern: ^([a-z0-9-]\{1,63\})$
mergeStrategy MergeStrategy MergeStrategy configures the merge strategy for HTTP headers and parameters
that are included in all Vault authentication requests.
allowDefault boolean AllowDefault when set to true will use the default VaultAuthGlobal resource
as the default if Name is not set. The 'allow-default-globals' option must be
set on the operator's '-global-vault-auth-options' flag
The default VaultAuthGlobal search is conditional.
When a ref Namespace is set, the search for the default
VaultAuthGlobal resource is constrained to that namespace.
Otherwise, the search order is:
1. The default VaultAuthGlobal resource in the referring VaultAuth resource's
namespace.
2. The default VaultAuthGlobal resource in the Operator's namespace.

VaultAuthGlobalSpec

VaultAuthGlobalSpec defines the desired state of VaultAuthGlobal

Appears in:

Field Description Default Validation
allowedNamespaces string array AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with
this VaultAuthGlobal. This field allows administrators to customize which
Kubernetes namespaces are authorized to reference this resource. While Vault
will still enforce its own rules, this has the added configurability of
restricting which VaultAuthMethods can be used by which namespaces. Accepted
values: []{"*"} - wildcard, all namespaces. []{"a", "b"} - list of namespaces.
unset - disallow all namespaces except the Operator's and the referring
VaultAuthMethod's namespace, this is the default behavior.
vaultConnectionRef string VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,
eg: namespaceA/vaultConnectionRefB. If no namespace prefix is provided it will default to
the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the
Operator will default to the default VaultConnection, configured in the operator's namespace.
defaultVaultNamespace string DefaultVaultNamespace to auth to in Vault, if not specified the namespace of the auth
method will be used. This can be used as a default Vault namespace for all
auth methods.
defaultAuthMethod string DefaultAuthMethod to use when authenticating to Vault. Enum: [kubernetes jwt appRole aws gcp]
defaultMount string DefaultMount to use when authenticating to auth method. If not specified the mount of
the auth method configured in Vault will be used.
params object (keys:string, values:string) DefaultParams to use when authenticating to Vault
headers object (keys:string, values:string) DefaultHeaders to be included in all Vault requests.
kubernetes VaultAuthGlobalConfigKubernetes Kubernetes specific auth configuration, requires that the Method be set to kubernetes.
appRole VaultAuthGlobalConfigAppRole AppRole specific auth configuration, requires that the Method be set to appRole.
jwt VaultAuthGlobalConfigJWT JWT specific auth configuration, requires that the Method be set to jwt.
aws VaultAuthGlobalConfigAWS AWS specific auth configuration, requires that Method be set to aws.
gcp VaultAuthGlobalConfigGCP GCP specific auth configuration, requires that Method be set to gcp.

VaultAuthList

VaultAuthList contains a list of VaultAuth

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultAuthList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items VaultAuth array

VaultAuthRef

Appears in:

Field Description Default Validation
name string Name of the VaultAuth resource.
namespace string Namespace of the VaultAuth resource.
trustNamespace boolean TrustNamespace of the referring VaultAuth resource. This means that any Vault
credentials will be provided by resources in the same namespace as the
VaultAuth resource. Otherwise, the credentials will be provided by the secret
resource's namespace.

VaultAuthSpec

VaultAuthSpec defines the desired state of VaultAuth

Appears in:

Field Description Default Validation
vaultConnectionRef string VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,
eg: namespaceA/vaultConnectionRefB. If no namespace prefix is provided it will default to
the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the
Operator will default to the default VaultConnection, configured in the operator's namespace.
vaultAuthGlobalRef VaultAuthGlobalRef VaultAuthGlobalRef.
namespace string Namespace to auth to in Vault
allowedNamespaces string array AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod.
This field allows administrators to customize which Kubernetes namespaces are authorized to
use with this AuthMethod. While Vault will still enforce its own rules, this has the added
configurability of restricting which VaultAuthMethods can be used by which namespaces.
You only need to set allowedNamespaces when you want to control access from a resource in
a different namespace than the VaultAuth it references. Secret resources in
the same namespace as the VaultAuth bypass this check.
Accepted values:
[]{"*"} - wildcard, all namespaces.
[]{"a", "b"} - list of namespaces.
unset - disallow all namespaces except the Operator's the VaultAuthMethod's namespace, this
is the default behavior.
method string Method to use when authenticating to Vault. Enum: [kubernetes jwt appRole aws gcp]
mount string Mount to use when authenticating to auth method.
params object (keys:string, values:string) Params to use when authenticating to Vault
headers object (keys:string, values:string) Headers to be included in all Vault requests.
kubernetes VaultAuthConfigKubernetes Kubernetes specific auth configuration, requires that the Method be set to kubernetes.
appRole VaultAuthConfigAppRole AppRole specific auth configuration, requires that the Method be set to appRole.
jwt VaultAuthConfigJWT JWT specific auth configuration, requires that the Method be set to jwt.
aws VaultAuthConfigAWS AWS specific auth configuration, requires that Method be set to aws.
gcp VaultAuthConfigGCP GCP specific auth configuration, requires that Method be set to gcp.
storageEncryption StorageEncryption StorageEncryption provides the necessary configuration to encrypt the client storage cache.
This should only be configured when client cache persistence with encryption is enabled.
This is done by passing setting the manager's commandline argument
--client-cache-persistence-model=direct-encrypted. Typically, there should only ever
be one VaultAuth configured with StorageEncryption in the Cluster, and it should have
the label: cacheStorageEncryption=true

VaultClientMeta

VaultClientMeta defines the observed state of the last Vault Client used to sync the secret. This status is used during resource reconciliation.

Appears in:

Field Description Default Validation
cacheKey string CacheKey is the unique key used to identify the client cache.
id string ID is the Vault ID of the authenticated client. The ID should never contain
any sensitive information.

VaultConnection

VaultConnection is the Schema for the vaultconnections API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultConnection
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec VaultConnectionSpec

VaultConnectionList

VaultConnectionList contains a list of VaultConnection

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultConnectionList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items VaultConnection array

VaultConnectionSpec

VaultConnectionSpec defines the desired state of VaultConnection

Appears in:

Field Description Default Validation
address string Address of the Vault server
headers object (keys:string, values:string) Headers to be included in all Vault requests.
tlsServerName string TLSServerName to use as the SNI host for TLS connections.
caCertSecretRef string CACertSecretRef is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as ca.crt.
CACertPath and CACertSecretRef are mutually exclusive, and only one should be specified.
caCertPath string CACertPath is the path to a trusted PEM-encoded CA certificate file on the filesystem that can be used to validate
the certificate presented by the Vault server.
CACertPath and CACertSecretRef are mutually exclusive, and only one should be specified.
skipTLSVerify boolean SkipTLSVerify for TLS connections. false
timeout string Timeout applied to all Vault requests for this connection. If not set, the
default timeout from the Vault API client config is used.		 Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
Type: string

VaultDynamicSecret

VaultDynamicSecret is the Schema for the vaultdynamicsecrets API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultDynamicSecret
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec VaultDynamicSecretSpec

VaultDynamicSecretList

VaultDynamicSecretList contains a list of VaultDynamicSecret

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultDynamicSecretList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items VaultDynamicSecret array

VaultDynamicSecretSpec

VaultDynamicSecretSpec defines the desired state of VaultDynamicSecret

Appears in:

Field Description Default Validation
vaultAuthRef string VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: namespaceA/vaultAuthRefB. If no namespace prefix is provided it will default to
the namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator
will default to the default VaultAuth, configured in the operator's namespace.
namespace string Namespace of the secrets engine mount in Vault. If not set, the namespace that's
part of VaultAuth resource will be inferred.
mount string Mount path of the secret's engine in Vault.
requestHTTPMethod string RequestHTTPMethod to use when syncing Secrets from Vault.
Setting a value here is not typically required.
If left unset the Operator will make requests using the GET method.
In the case where Params are specified the Operator will use the PUT method.
Please consult https://developer.hashicorp.com/vault/docs/secrets if you are
uncertain about what method to use.
Of note, the Vault client treats PUT and POST as being equivalent.
The underlying Vault client implementation will always use the PUT method.		 Enum: [GET POST PUT]
path string Path in Vault to get the credentials for, and is relative to Mount.
Please consult https://developer.hashicorp.com/vault/docs/secrets if you are
uncertain about what 'path' should be set to.
params object (keys:string, values:string) Params that can be passed when requesting credentials/secrets.
When Params is set the configured RequestHTTPMethod will be
ignored. See RequestHTTPMethod for more details.
Please consult https://developer.hashicorp.com/vault/docs/secrets if you are
uncertain about what 'params' should/can be set to.
renewalPercent integer RenewalPercent is the percent out of 100 of the lease duration when the
lease is renewed. Defaults to 67 percent plus jitter.		 67 Maximum: 90
Minimum: 0
revoke boolean Revoke the existing lease on VDS resource deletion.
allowStaticCreds boolean AllowStaticCreds should be set when syncing credentials that are periodically
rotated by the Vault server, rather than created upon request. These secrets
are sometimes referred to as "static roles", or "static credentials", with a
request path that contains "static-creds".
rolloutRestartTargets RolloutRestartTarget array RolloutRestartTargets should be configured whenever the application(s) consuming the Vault secret does
not support dynamically reloading a rotated secret.
In that case one, or more RolloutRestartTarget(s) can be configured here. The Operator will
trigger a "rollout-restart" for each target whenever the Vault secret changes between reconciliation events.
See RolloutRestartTarget for more details.
destination Destination Destination provides configuration necessary for syncing the Vault secret to Kubernetes.
refreshAfter string RefreshAfter a period of time for VSO to sync the source secret data, in
duration notation e.g. 30s, 1m, 24h. This value only needs to be set when
syncing from a secret's engine that does not provide a lease TTL in its
response. The value should be within the secret engine's configured ttl or
max_ttl. The source secret's lease duration takes precedence over this
configuration when it is greater than 0.		 Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
Type: string

VaultPKISecret

VaultPKISecret is the Schema for the vaultpkisecrets API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultPKISecret
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec VaultPKISecretSpec

VaultPKISecretList

VaultPKISecretList contains a list of VaultPKISecret

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultPKISecretList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items VaultPKISecret array

VaultPKISecretSpec

VaultPKISecretSpec defines the desired state of VaultPKISecret

Appears in:

Field Description Default Validation
vaultAuthRef string VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: namespaceA/vaultAuthRefB. If no namespace prefix is provided it will default to
the namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator
will default to the default VaultAuth, configured in the operator's namespace.
namespace string Namespace of the secrets engine mount in Vault. If not set, the namespace that's
part of VaultAuth resource will be inferred.
mount string Mount for the secret in Vault
role string Role in Vault to use when issuing TLS certificates.
revoke boolean Revoke the certificate when the resource is deleted.
clear boolean Clear the Kubernetes secret when the resource is deleted.
expiryOffset string ExpiryOffset to use for computing when the certificate should be renewed.
The rotation time will be difference between the expiration and the offset.
Should be in duration notation e.g. 30s, 120s, etc.		 Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
Type: string
issuerRef string IssuerRef reference to an existing PKI issuer, either by Vault-generated
identifier, the literal string default to refer to the currently
configured default issuer, or the name assigned to an issuer.
This parameter is part of the request URL.
rolloutRestartTargets RolloutRestartTarget array RolloutRestartTargets should be configured whenever the application(s) consuming the Vault secret does
not support dynamically reloading a rotated secret.
In that case one, or more RolloutRestartTarget(s) can be configured here. The Operator will
trigger a "rollout-restart" for each target whenever the Vault secret changes between reconciliation events.
See RolloutRestartTarget for more details.
destination Destination Destination provides configuration necessary for syncing the Vault secret
to Kubernetes. If the type is set to "kubernetes.io/tls", "tls.key" will
be set to the "private_key" response from Vault, and "tls.crt" will be
set to "certificate" + "ca_chain" from the Vault response ("issuing_ca"
is used when "ca_chain" is empty). The "remove_roots_from_chain=true"
option is used with Vault to exclude the root CA from the Vault response.
commonName string CommonName to include in the request.
altNames string array AltNames to include in the request
May contain both DNS names and email addresses.
ipSans string array IPSans to include in the request.
uriSans string array The requested URI SANs.
otherSans string array Requested other SANs, in an array with the format
oid;type:value for each entry.
userIDs string array User ID (OID 0.9.2342.19200300.100.1.1) Subject values to be placed on the
signed certificate.
ttl string TTL for the certificate; sets the expiration date.
If not specified the Vault role's default,
backend default, or system default TTL is used, in that order.
Cannot be larger than the mount's max TTL.
Note: this only has an effect when generating a CA cert or signing a CA cert,
not when generating a CSR for an intermediate CA.
Should be in duration notation e.g. 120s, 2h, etc.		 Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h|d))$
Type: string
format string Format for the certificate. Choices: "pem", "der", "pem_bundle".
If "pem_bundle",
any private key and issuing cert will be appended to the certificate pem.
If "der", the value will be base64 encoded.
Default: pem
privateKeyFormat string PrivateKeyFormat, generally the default will be controlled by the Format
parameter as either base64-encoded DER or PEM-encoded DER.
However, this can be set to "pkcs8" to have the returned
private key contain base64-encoded pkcs8 or PEM-encoded
pkcs8 instead.
Default: der
notAfter string NotAfter field of the certificate with specified date value.
The value format should be given in UTC format YYYY-MM-ddTHH:MM:SSZ
excludeCNFromSans boolean ExcludeCNFromSans from DNS or Email Subject Alternate Names.
Default: false

VaultSecretLease

Appears in:

Field Description Default Validation
id string ID of the Vault secret.
duration integer LeaseDuration of the Vault secret.
renewable boolean Renewable Vault secret lease
requestID string RequestID of the Vault secret request.

VaultStaticCredsMetaData

Appears in:

Field Description Default Validation
lastVaultRotation integer LastVaultRotation represents the last time Vault rotated the password
rotationPeriod integer RotationPeriod is number in seconds between each rotation, effectively a
"time to live". This value is compared to the LastVaultRotation to
determine if a password needs to be rotated
rotationSchedule string RotationSchedule is a "cron style" string representing the allowed
schedule for each rotation.
e.g. "1 0 * * *" would rotate at one minute past midnight (00:01) every
day.
ttl integer TTL is the seconds remaining before the next rotation.

VaultStaticSecret

VaultStaticSecret is the Schema for the vaultstaticsecrets API

Appears in:

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultStaticSecret
metadata ObjectMeta Refer to Kubernetes API documentation for fields of metadata.
spec VaultStaticSecretSpec

VaultStaticSecretCollectable

Appears in:

Field Description Default Validation
mount string Mount for the secret in Vault
path string Path of the secret in Vault, corresponds to the path parameter for:
kv-v1: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v1#read-secret
kv-v2: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#read-secret-version
version integer Version of the secret to fetch. Only valid for type kv-v2. Corresponds to version query parameter:
https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#version		 Minimum: 0
type string Type of the Vault static secret Enum: [kv-v1 kv-v2]
transformation Transformation Transformation provides configuration for transforming the secret data before
it is stored in the CSI volume.

VaultStaticSecretCommon

Appears in:

Field Description Default Validation
mount string Mount for the secret in Vault
path string Path of the secret in Vault, corresponds to the path parameter for:
kv-v1: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v1#read-secret
kv-v2: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#read-secret-version
version integer Version of the secret to fetch. Only valid for type kv-v2. Corresponds to version query parameter:
https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#version		 Minimum: 0
type string Type of the Vault static secret Enum: [kv-v1 kv-v2]

VaultStaticSecretList

VaultStaticSecretList contains a list of VaultStaticSecret

Field Description Default Validation
apiVersion string secrets.hashicorp.com/v1beta1
kind string VaultStaticSecretList
metadata ListMeta Refer to Kubernetes API documentation for fields of metadata.
items VaultStaticSecret array

VaultStaticSecretSpec

VaultStaticSecretSpec defines the desired state of VaultStaticSecret

Appears in:

Field Description Default Validation
vaultAuthRef string VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: namespaceA/vaultAuthRefB. If no namespace prefix is provided it will default to the
namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will
default to the default VaultAuth, configured in the operator's namespace.
namespace string Namespace of the secrets engine mount in Vault. If not set, the namespace that's
part of VaultAuth resource will be inferred.
refreshAfter string RefreshAfter a period of time, in duration notation e.g. 30s, 1m, 24h Pattern: ^([0-9]+(\.[0-9]+)?(s|m|h))$
Type: string
hmacSecretData boolean HMACSecretData determines whether the Operator computes the
HMAC of the Secret's data. The MAC value will be stored in
the resource's Status.SecretMac field, and will be used for drift detection
and during incoming Vault secret comparison.
Enabling this feature is recommended to ensure that Secret's data stays consistent with Vault.		 true
rolloutRestartTargets RolloutRestartTarget array RolloutRestartTargets should be configured whenever the application(s) consuming the Vault secret does
not support dynamically reloading a rotated secret.
In that case one, or more RolloutRestartTarget(s) can be configured here. The Operator will
trigger a "rollout-restart" for each target whenever the Vault secret changes between reconciliation events.
All configured targets will be ignored if HMACSecretData is set to false.
See RolloutRestartTarget for more details.
destination Destination Destination provides configuration necessary for syncing the Vault secret to Kubernetes.
syncConfig SyncConfig SyncConfig configures sync behavior from Vault to VSO
mount string Mount for the secret in Vault
path string Path of the secret in Vault, corresponds to the path parameter for:
kv-v1: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v1#read-secret
kv-v2: https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#read-secret-version
version integer Version of the secret to fetch. Only valid for type kv-v2. Corresponds to version query parameter:
https://developer.hashicorp.com/vault/api-docs/secret/kv/kv-v2#version		 Minimum: 0
type string Type of the Vault static secret Enum: [kv-v1 kv-v2]