Skip to content

Commit bffc8a7

Browse files
slntoppslntopp
committed
fix: generate crds
1 parent b4bb4b9 commit bffc8a7

File tree

2 files changed

+89
-7
lines changed

2 files changed

+89
-7
lines changed

‎charts/mondoo-operator/crds/k8s.mondoo.com_mondooauditconfigs.yaml‎

Lines changed: 86 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,7 @@ spec:
393393
description: |-
394394
KubeconfigSecretRef references a Secret containing kubeconfig for the remote cluster.
395395
The Secret must have a key "kubeconfig" with the kubeconfig content.
396-
Mutually exclusive with ServiceAccountAuth and WorkloadIdentity.
396+
Mutually exclusive with ServiceAccountAuth, WorkloadIdentity, SPIFFEAuth, and VaultAuth.
397397
properties:
398398
name:
399399
default: ""
@@ -436,7 +436,7 @@ spec:
436436
serviceAccountAuth:
437437
description: |-
438438
ServiceAccountAuth configures authentication using a service account token.
439-
Mutually exclusive with KubeconfigSecretRef and WorkloadIdentity.
439+
Mutually exclusive with KubeconfigSecretRef, WorkloadIdentity, SPIFFEAuth, and VaultAuth.
440440
properties:
441441
credentialsSecretRef:
442442
description: |-
@@ -473,7 +473,7 @@ spec:
473473
spiffeAuth:
474474
description: |-
475475
SPIFFEAuth configures SPIFFE/SPIRE-based authentication using X.509 SVIDs.
476-
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, and WorkloadIdentity.
476+
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, WorkloadIdentity, and VaultAuth.
477477
properties:
478478
audience:
479479
description: |-
@@ -512,10 +512,92 @@ spec:
512512
- server
513513
- trustBundleSecretRef
514514
type: object
515+
vaultAuth:
516+
description: |-
517+
VaultAuth configures HashiCorp Vault Kubernetes secrets engine for dynamic credential generation.
518+
The operator authenticates to Vault during reconciliation using its own service account token,
519+
fetches short-lived credentials, and writes a kubeconfig Secret that the CronJob mounts.
520+
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, WorkloadIdentity, and SPIFFEAuth.
521+
properties:
522+
authPath:
523+
default: auth/kubernetes
524+
description: AuthPath is the Vault Kubernetes auth method
525+
mount path.
526+
type: string
527+
authRole:
528+
description: AuthRole is the Vault role for authenticating
529+
the pod's service account.
530+
type: string
531+
caCertSecretRef:
532+
description: |-
533+
CACertSecretRef references a Secret containing Vault's CA certificate
534+
for TLS verification. The Secret must have a key "ca.crt".
535+
properties:
536+
name:
537+
default: ""
538+
description: |-
539+
Name of the referent.
540+
This field is effectively required, but due to backwards compatibility is
541+
allowed to be empty. Instances of this type with an empty value here are
542+
almost certainly wrong.
543+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
544+
type: string
545+
type: object
546+
x-kubernetes-map-type: atomic
547+
credsRole:
548+
description: CredsRole is the Vault role for generating
549+
target cluster credentials.
550+
type: string
551+
kubernetesNamespace:
552+
description: KubernetesNamespace is the target namespace
553+
for the generated service account token.
554+
type: string
555+
secretsPath:
556+
default: kubernetes
557+
description: SecretsPath is the Vault Kubernetes secrets
558+
engine mount path.
559+
type: string
560+
server:
561+
description: |-
562+
Server is the URL of the target Kubernetes API server.
563+
Example: "https://target-cluster.example.com:6443"
564+
pattern: ^https://.*
565+
type: string
566+
targetCACertSecretRef:
567+
description: |-
568+
TargetCACertSecretRef references a Secret containing the target cluster's
569+
CA certificate for TLS verification. The Secret must have a key "ca.crt".
570+
properties:
571+
name:
572+
default: ""
573+
description: |-
574+
Name of the referent.
575+
This field is effectively required, but due to backwards compatibility is
576+
allowed to be empty. Instances of this type with an empty value here are
577+
almost certainly wrong.
578+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
579+
type: string
580+
type: object
581+
x-kubernetes-map-type: atomic
582+
ttl:
583+
description: TTL is the requested TTL for the generated
584+
credentials (e.g. "1h", "30m").
585+
type: string
586+
vaultAddr:
587+
description: |-
588+
VaultAddr is the address of the Vault server.
589+
Example: "https://vault.example.com:8200"
590+
type: string
591+
required:
592+
- authRole
593+
- credsRole
594+
- server
595+
- vaultAddr
596+
type: object
515597
workloadIdentity:
516598
description: |-
517599
WorkloadIdentity configures cloud-native Workload Identity Federation authentication.
518-
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, and SPIFFEAuth.
600+
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, SPIFFEAuth, and VaultAuth.
519601
properties:
520602
aks:
521603
description: |-

‎config/crd/bases/k8s.mondoo.com_mondooauditconfigs.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -393,7 +393,7 @@ spec:
393393
description: |-
394394
KubeconfigSecretRef references a Secret containing kubeconfig for the remote cluster.
395395
The Secret must have a key "kubeconfig" with the kubeconfig content.
396-
Mutually exclusive with ServiceAccountAuth and WorkloadIdentity.
396+
Mutually exclusive with ServiceAccountAuth, WorkloadIdentity, SPIFFEAuth, and VaultAuth.
397397
properties:
398398
name:
399399
default: ""
@@ -436,7 +436,7 @@ spec:
436436
serviceAccountAuth:
437437
description: |-
438438
ServiceAccountAuth configures authentication using a service account token.
439-
Mutually exclusive with KubeconfigSecretRef and WorkloadIdentity.
439+
Mutually exclusive with KubeconfigSecretRef, WorkloadIdentity, SPIFFEAuth, and VaultAuth.
440440
properties:
441441
credentialsSecretRef:
442442
description: |-
@@ -597,7 +597,7 @@ spec:
597597
workloadIdentity:
598598
description: |-
599599
WorkloadIdentity configures cloud-native Workload Identity Federation authentication.
600-
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, and SPIFFEAuth.
600+
Mutually exclusive with KubeconfigSecretRef, ServiceAccountAuth, SPIFFEAuth, and VaultAuth.
601601
properties:
602602
aks:
603603
description: |-

0 commit comments

Comments
 (0)