-
Notifications
You must be signed in to change notification settings - Fork 142
Expand file tree
/
Copy pathsecrets.hashicorp.com_hcpauths.yaml
More file actions
188 lines (184 loc) · 8.43 KB
/
Copy pathsecrets.hashicorp.com_hcpauths.yaml
File metadata and controls
188 lines (184 loc) · 8.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
# Copyright (c) HashiCorp, Inc.
# SPDX-License-Identifier: BUSL-1.1
---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.19.0
name: hcpauths.secrets.hashicorp.com
spec:
group: secrets.hashicorp.com
names:
kind: HCPAuth
listKind: HCPAuthList
plural: hcpauths
singular: hcpauth
scope: Namespaced
versions:
- deprecated: true
deprecationWarning: HCPAuth is deprecated and will be removed in a future release
of the Vault Secrets Operator. HCP Vault Secrets support is being retired; migrate
off HCP Vault Secrets before upgrading to the removal release.
name: v1beta1
schema:
openAPIV3Schema:
description: |-
HCPAuth is the Schema for the hcpauths API
Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
removed in a future release of the Vault Secrets Operator. Migrate off HCP
Vault Secrets before upgrading to the removal release.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: |-
HCPAuthSpec defines the desired state of HCPAuth
Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
removed in a future release of the Vault Secrets Operator. Migrate off HCP
Vault Secrets before upgrading to the removal release.
properties:
allowedNamespaces:
description: |-
AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod.
This field allows administrators to customize which Kubernetes namespaces are authorized to
use with this AuthMethod. While Vault will still enforce its own rules, this has the added
configurability of restricting which HCPAuthMethods can be used by which namespaces.
Accepted values:
[]{"*"} - wildcard, all namespaces.
[]{"a", "b"} - list of namespaces.
unset - disallow all namespaces except the Operator's the HCPAuthMethod's namespace, this
is the default behavior.
items:
type: string
type: array
method:
default: servicePrincipal
description: Method to use when authenticating to Vault.
enum:
- servicePrincipal
type: string
organizationID:
description: OrganizationID of the HCP organization.
type: string
projectID:
description: ProjectID of the HCP project.
type: string
servicePrincipal:
description: |-
ServicePrincipal provides the necessary configuration for authenticating to
HCP using a service principal. For security reasons, only project-level
service principals should ever be used.
properties:
secretRef:
description: |-
SecretRef is the name of a Kubernetes secret in the consumer's
(VDS/VSS/PKI/HCP) namespace which provides the HCP ServicePrincipal clientID,
and clientSecret.
The secret data must have the following structure {
"clientID": "clientID",
"clientSecret": "clientSecret",
}
type: string
required:
- secretRef
type: object
required:
- organizationID
- projectID
type: object
status:
description: |-
HCPAuthStatus defines the observed state of HCPAuth
Deprecated: HCPAuth and HCP Vault Secrets support are deprecated and will be
removed in a future release of the Vault Secrets Operator. Migrate off HCP
Vault Secrets before upgrading to the removal release.
properties:
conditions:
description: |-
Conditions hold information that can be used by other apps to determine the
health of the resource instance.
items:
description: Condition contains details for one aspect of the current
state of this API Resource.
properties:
lastTransitionTime:
description: |-
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format: date-time
type: string
message:
description: |-
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength: 32768
type: string
observedGeneration:
description: |-
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format: int64
minimum: 0
type: integer
reason:
description: |-
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
maxLength: 1024
minLength: 1
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
type: string
status:
description: status of the condition, one of True, False, Unknown.
enum:
- "True"
- "False"
- Unknown
type: string
type:
description: type of condition in CamelCase or in foo.example.com/CamelCase.
maxLength: 316
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
type: string
required:
- lastTransitionTime
- message
- reason
- status
- type
type: object
type: array
error:
type: string
valid:
description: Valid auth mechanism.
type: boolean
required:
- error
- valid
type: object
type: object
served: true
storage: true
subresources:
status: {}