From 1c33776bfde5dc6335fb94ef7f447f36c13bf588 Mon Sep 17 00:00:00 2001
From: dvirlabs <114520947+dvirlabs@users.noreply.github.com>
Date: Thu, 8 May 2025 09:50:58 +0300
Subject: [PATCH] Add vault and external-secrets
---
application-template.yaml | 21 +
argocd-apps/external-secrets.yaml | 21 +
argocd-apps/vault.yaml | 21 +
charts/external-secrets/Chart.lock | 6 +
charts/external-secrets/Chart.yaml | 20 +
charts/external-secrets/README.md | 243 +
.../charts/bitwarden-sdk-server/.helmignore | 23 +
.../charts/bitwarden-sdk-server/Chart.yaml | 6 +
.../bitwarden-sdk-server/templates/NOTES.txt | 22 +
.../templates/_helpers.tpl | 62 +
.../templates/deployment.yaml | 77 +
.../templates/service.yaml | 14 +
.../templates/serviceaccount.yaml | 12 +
.../__snapshot__/deployment_test.yaml.snap | 60 +
.../tests/deployment_test.yaml | 9 +
.../charts/bitwarden-sdk-server/values.yaml | 98 +
.../files/monitoring/grafana-dashboard.json | 1961 ++++
charts/external-secrets/templates/NOTES.txt | 7 +
.../external-secrets/templates/_helpers.tpl | 221 +
.../templates/cert-controller-deployment.yaml | 124 +
.../cert-controller-poddisruptionbudget.yaml | 19 +
.../templates/cert-controller-rbac.yaml | 86 +
.../templates/cert-controller-service.yaml | 28 +
.../cert-controller-serviceaccount.yaml | 16 +
.../templates/crds/acraccesstoken.yaml | 214 +
.../templates/crds/clusterexternalsecret.yaml | 1463 +++
.../templates/crds/clustergenerator.yaml | 1837 ++++
.../templates/crds/clusterpushsecret.yaml | 523 ++
.../templates/crds/clustersecretstore.yaml | 8311 +++++++++++++++++
.../templates/crds/ecrauthorizationtoken.yaml | 202 +
.../templates/crds/externalsecret.yaml | 1215 +++
.../external-secrets/templates/crds/fake.yaml | 73 +
.../templates/crds/gcraccesstoken.yaml | 140 +
.../templates/crds/generatorstate.yaml | 110 +
.../templates/crds/githubaccesstoken.yaml | 120 +
.../templates/crds/grafana.yaml | 139 +
.../templates/crds/password.yaml | 95 +
.../templates/crds/pushsecret.yaml | 481 +
.../templates/crds/quayaccesstoken.yaml | 95 +
.../templates/crds/secretstore.yaml | 8311 +++++++++++++++++
.../templates/crds/stssessiontoken.yaml | 216 +
.../external-secrets/templates/crds/uuid.yaml | 58 +
.../templates/crds/vaultdynamicsecret.yaml | 861 ++
.../templates/crds/webhook.yaml | 228 +
.../templates/deployment.yaml | 150 +
.../templates/extra-manifests.yaml | 4 +
.../templates/grafana-dashboard.yaml | 16 +
.../templates/poddisruptionbudget.yaml | 19 +
charts/external-secrets/templates/rbac.yaml | 392 +
.../external-secrets/templates/service.yaml | 28 +
.../templates/serviceaccount.yaml | 16 +
.../templates/servicemonitor.yaml | 98 +
.../templates/validatingwebhook.yaml | 84 +
.../templates/webhook-certificate.yaml | 33 +
.../templates/webhook-deployment.yaml | 128 +
.../webhook-poddisruptionbudget.yaml | 20 +
.../templates/webhook-secret.yaml | 14 +
.../templates/webhook-service.yaml | 35 +
.../templates/webhook-serviceaccount.yaml | 16 +
charts/external-secrets/values.schema.json | 970 ++
charts/external-secrets/values.yaml | 584 ++
charts/vault/.helmignore | 29 +
charts/vault/CHANGELOG.md | 606 ++
charts/vault/CODEOWNERS | 1 +
charts/vault/CONTRIBUTING.md | 247 +
charts/vault/Chart.yaml | 23 +
charts/vault/LICENSE | 355 +
charts/vault/Makefile | 101 +
charts/vault/README.md | 43 +
charts/vault/templates/NOTES.txt | 14 +
charts/vault/templates/_helpers.tpl | 1114 +++
.../vault/templates/csi-agent-configmap.yaml | 34 +
charts/vault/templates/csi-clusterrole.yaml | 23 +
.../templates/csi-clusterrolebinding.yaml | 24 +
charts/vault/templates/csi-daemonset.yaml | 162 +
charts/vault/templates/csi-role.yaml | 32 +
charts/vault/templates/csi-rolebinding.yaml | 25 +
.../vault/templates/csi-serviceaccount.yaml | 21 +
.../templates/injector-certs-secret.yaml | 19 +
.../vault/templates/injector-clusterrole.yaml | 30 +
.../injector-clusterrolebinding.yaml | 24 +
.../vault/templates/injector-deployment.yaml | 179 +
.../templates/injector-disruptionbudget.yaml | 25 +
.../templates/injector-mutating-webhook.yaml | 45 +
.../templates/injector-network-policy.yaml | 29 +
charts/vault/templates/injector-psp-role.yaml | 25 +
.../templates/injector-psp-rolebinding.yaml | 26 +
charts/vault/templates/injector-psp.yaml | 51 +
charts/vault/templates/injector-role.yaml | 38 +
.../vault/templates/injector-rolebinding.yaml | 27 +
charts/vault/templates/injector-service.yaml | 27 +
.../templates/injector-serviceaccount.yaml | 18 +
.../templates/prometheus-prometheusrules.yaml | 31 +
.../templates/prometheus-servicemonitor.yaml | 58 +
.../templates/server-clusterrolebinding.yaml | 29 +
.../templates/server-config-configmap.yaml | 31 +
.../templates/server-discovery-role.yaml | 26 +
.../server-discovery-rolebinding.yaml | 34 +
.../templates/server-disruptionbudget.yaml | 31 +
.../templates/server-ha-active-service.yaml | 64 +
.../templates/server-ha-standby-service.yaml | 63 +
.../templates/server-headless-service.yaml | 47 +
charts/vault/templates/server-ingress.yaml | 69 +
.../templates/server-network-policy.yaml | 24 +
charts/vault/templates/server-psp-role.yaml | 25 +
.../templates/server-psp-rolebinding.yaml | 26 +
charts/vault/templates/server-psp.yaml | 54 +
charts/vault/templates/server-route.yaml | 39 +
charts/vault/templates/server-service.yaml | 59 +
.../server-serviceaccount-secret.yaml | 21 +
.../templates/server-serviceaccount.yaml | 22 +
.../vault/templates/server-statefulset.yaml | 240 +
charts/vault/templates/tests/server-test.yaml | 60 +
charts/vault/templates/ui-service.yaml | 50 +
charts/vault/values.openshift.yaml | 24 +
charts/vault/values.schema.json | 1315 +++
charts/vault/values.yaml | 1353 +++
manifests/external-secrets/values.yaml | 10 +
manifests/vault/values.yaml | 26 +
119 files changed, 37724 insertions(+)
create mode 100644 application-template.yaml
create mode 100644 argocd-apps/external-secrets.yaml
create mode 100644 argocd-apps/vault.yaml
create mode 100644 charts/external-secrets/Chart.lock
create mode 100644 charts/external-secrets/Chart.yaml
create mode 100644 charts/external-secrets/README.md
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/.helmignore
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/Chart.yaml
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/templates/NOTES.txt
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/templates/_helpers.tpl
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/templates/deployment.yaml
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/templates/service.yaml
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/templates/serviceaccount.yaml
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/tests/__snapshot__/deployment_test.yaml.snap
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/tests/deployment_test.yaml
create mode 100644 charts/external-secrets/charts/bitwarden-sdk-server/values.yaml
create mode 100644 charts/external-secrets/files/monitoring/grafana-dashboard.json
create mode 100644 charts/external-secrets/templates/NOTES.txt
create mode 100644 charts/external-secrets/templates/_helpers.tpl
create mode 100644 charts/external-secrets/templates/cert-controller-deployment.yaml
create mode 100644 charts/external-secrets/templates/cert-controller-poddisruptionbudget.yaml
create mode 100644 charts/external-secrets/templates/cert-controller-rbac.yaml
create mode 100644 charts/external-secrets/templates/cert-controller-service.yaml
create mode 100644 charts/external-secrets/templates/cert-controller-serviceaccount.yaml
create mode 100644 charts/external-secrets/templates/crds/acraccesstoken.yaml
create mode 100644 charts/external-secrets/templates/crds/clusterexternalsecret.yaml
create mode 100644 charts/external-secrets/templates/crds/clustergenerator.yaml
create mode 100644 charts/external-secrets/templates/crds/clusterpushsecret.yaml
create mode 100644 charts/external-secrets/templates/crds/clustersecretstore.yaml
create mode 100644 charts/external-secrets/templates/crds/ecrauthorizationtoken.yaml
create mode 100644 charts/external-secrets/templates/crds/externalsecret.yaml
create mode 100644 charts/external-secrets/templates/crds/fake.yaml
create mode 100644 charts/external-secrets/templates/crds/gcraccesstoken.yaml
create mode 100644 charts/external-secrets/templates/crds/generatorstate.yaml
create mode 100644 charts/external-secrets/templates/crds/githubaccesstoken.yaml
create mode 100644 charts/external-secrets/templates/crds/grafana.yaml
create mode 100644 charts/external-secrets/templates/crds/password.yaml
create mode 100644 charts/external-secrets/templates/crds/pushsecret.yaml
create mode 100644 charts/external-secrets/templates/crds/quayaccesstoken.yaml
create mode 100644 charts/external-secrets/templates/crds/secretstore.yaml
create mode 100644 charts/external-secrets/templates/crds/stssessiontoken.yaml
create mode 100644 charts/external-secrets/templates/crds/uuid.yaml
create mode 100644 charts/external-secrets/templates/crds/vaultdynamicsecret.yaml
create mode 100644 charts/external-secrets/templates/crds/webhook.yaml
create mode 100644 charts/external-secrets/templates/deployment.yaml
create mode 100644 charts/external-secrets/templates/extra-manifests.yaml
create mode 100644 charts/external-secrets/templates/grafana-dashboard.yaml
create mode 100644 charts/external-secrets/templates/poddisruptionbudget.yaml
create mode 100644 charts/external-secrets/templates/rbac.yaml
create mode 100644 charts/external-secrets/templates/service.yaml
create mode 100644 charts/external-secrets/templates/serviceaccount.yaml
create mode 100644 charts/external-secrets/templates/servicemonitor.yaml
create mode 100644 charts/external-secrets/templates/validatingwebhook.yaml
create mode 100644 charts/external-secrets/templates/webhook-certificate.yaml
create mode 100644 charts/external-secrets/templates/webhook-deployment.yaml
create mode 100644 charts/external-secrets/templates/webhook-poddisruptionbudget.yaml
create mode 100644 charts/external-secrets/templates/webhook-secret.yaml
create mode 100644 charts/external-secrets/templates/webhook-service.yaml
create mode 100644 charts/external-secrets/templates/webhook-serviceaccount.yaml
create mode 100644 charts/external-secrets/values.schema.json
create mode 100644 charts/external-secrets/values.yaml
create mode 100644 charts/vault/.helmignore
create mode 100644 charts/vault/CHANGELOG.md
create mode 100644 charts/vault/CODEOWNERS
create mode 100644 charts/vault/CONTRIBUTING.md
create mode 100644 charts/vault/Chart.yaml
create mode 100644 charts/vault/LICENSE
create mode 100644 charts/vault/Makefile
create mode 100644 charts/vault/README.md
create mode 100644 charts/vault/templates/NOTES.txt
create mode 100644 charts/vault/templates/_helpers.tpl
create mode 100644 charts/vault/templates/csi-agent-configmap.yaml
create mode 100644 charts/vault/templates/csi-clusterrole.yaml
create mode 100644 charts/vault/templates/csi-clusterrolebinding.yaml
create mode 100644 charts/vault/templates/csi-daemonset.yaml
create mode 100644 charts/vault/templates/csi-role.yaml
create mode 100644 charts/vault/templates/csi-rolebinding.yaml
create mode 100644 charts/vault/templates/csi-serviceaccount.yaml
create mode 100644 charts/vault/templates/injector-certs-secret.yaml
create mode 100644 charts/vault/templates/injector-clusterrole.yaml
create mode 100644 charts/vault/templates/injector-clusterrolebinding.yaml
create mode 100644 charts/vault/templates/injector-deployment.yaml
create mode 100644 charts/vault/templates/injector-disruptionbudget.yaml
create mode 100644 charts/vault/templates/injector-mutating-webhook.yaml
create mode 100644 charts/vault/templates/injector-network-policy.yaml
create mode 100644 charts/vault/templates/injector-psp-role.yaml
create mode 100644 charts/vault/templates/injector-psp-rolebinding.yaml
create mode 100644 charts/vault/templates/injector-psp.yaml
create mode 100644 charts/vault/templates/injector-role.yaml
create mode 100644 charts/vault/templates/injector-rolebinding.yaml
create mode 100644 charts/vault/templates/injector-service.yaml
create mode 100644 charts/vault/templates/injector-serviceaccount.yaml
create mode 100644 charts/vault/templates/prometheus-prometheusrules.yaml
create mode 100644 charts/vault/templates/prometheus-servicemonitor.yaml
create mode 100644 charts/vault/templates/server-clusterrolebinding.yaml
create mode 100644 charts/vault/templates/server-config-configmap.yaml
create mode 100644 charts/vault/templates/server-discovery-role.yaml
create mode 100644 charts/vault/templates/server-discovery-rolebinding.yaml
create mode 100644 charts/vault/templates/server-disruptionbudget.yaml
create mode 100644 charts/vault/templates/server-ha-active-service.yaml
create mode 100644 charts/vault/templates/server-ha-standby-service.yaml
create mode 100644 charts/vault/templates/server-headless-service.yaml
create mode 100644 charts/vault/templates/server-ingress.yaml
create mode 100644 charts/vault/templates/server-network-policy.yaml
create mode 100644 charts/vault/templates/server-psp-role.yaml
create mode 100644 charts/vault/templates/server-psp-rolebinding.yaml
create mode 100644 charts/vault/templates/server-psp.yaml
create mode 100644 charts/vault/templates/server-route.yaml
create mode 100644 charts/vault/templates/server-service.yaml
create mode 100644 charts/vault/templates/server-serviceaccount-secret.yaml
create mode 100644 charts/vault/templates/server-serviceaccount.yaml
create mode 100644 charts/vault/templates/server-statefulset.yaml
create mode 100644 charts/vault/templates/tests/server-test.yaml
create mode 100644 charts/vault/templates/ui-service.yaml
create mode 100644 charts/vault/values.openshift.yaml
create mode 100644 charts/vault/values.schema.json
create mode 100644 charts/vault/values.yaml
create mode 100644 manifests/external-secrets/values.yaml
create mode 100644 manifests/vault/values.yaml
diff --git a/application-template.yaml b/application-template.yaml
new file mode 100644
index 0000000..3978b05
--- /dev/null
+++ b/application-template.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+ name: application-template
+ namespace: argocd
+spec:
+ project: dev-tools
+ source:
+ repoURL: 'https://git.dvirlabs.com/dvirlabs/dev-tools.git'
+ targetRevision: HEAD
+ path: charts/application-template
+ helm:
+ valueFiles:
+ - ../../manifests/application-template/values.yaml
+ destination:
+ server: https://kubernetes.default.svc
+ namespace: dev-tools
+ syncPolicy:
+ automated:
+ prune: true
+ selfHeal: true
diff --git a/argocd-apps/external-secrets.yaml b/argocd-apps/external-secrets.yaml
new file mode 100644
index 0000000..3c37a4e
--- /dev/null
+++ b/argocd-apps/external-secrets.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+ name: external-secrets
+ namespace: argocd
+spec:
+ project: dev-tools
+ source:
+ repoURL: 'https://git.dvirlabs.com/dvirlabs/dev-tools.git'
+ targetRevision: HEAD
+ path: charts/external-secrets
+ helm:
+ valueFiles:
+ - ../../manifests/external-secrets/values.yaml
+ destination:
+ server: https://kubernetes.default.svc
+ namespace: dev-tools
+ syncPolicy:
+ automated:
+ prune: true
+ selfHeal: true
diff --git a/argocd-apps/vault.yaml b/argocd-apps/vault.yaml
new file mode 100644
index 0000000..cf274bb
--- /dev/null
+++ b/argocd-apps/vault.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+ name: vault
+ namespace: argocd
+spec:
+ project: dev-tools
+ source:
+ repoURL: 'https://git.dvirlabs.com/dvirlabs/dev-tools.git'
+ targetRevision: HEAD
+ path: charts/vault
+ helm:
+ valueFiles:
+ - ../../manifests/vault/values.yaml
+ destination:
+ server: https://kubernetes.default.svc
+ namespace: dev-tools
+ syncPolicy:
+ automated:
+ prune: true
+ selfHeal: true
diff --git a/charts/external-secrets/Chart.lock b/charts/external-secrets/Chart.lock
new file mode 100644
index 0000000..f9abae8
--- /dev/null
+++ b/charts/external-secrets/Chart.lock
@@ -0,0 +1,6 @@
+dependencies:
+- name: bitwarden-sdk-server
+ repository: oci://ghcr.io/external-secrets/charts
+ version: v0.3.1
+digest: sha256:2d01e9083fc32c18dca4f9614625e0172e338a663138c2670e5b911645b6b8ee
+generated: "2024-09-20T12:57:07.63511+02:00"
diff --git a/charts/external-secrets/Chart.yaml b/charts/external-secrets/Chart.yaml
new file mode 100644
index 0000000..44236fa
--- /dev/null
+++ b/charts/external-secrets/Chart.yaml
@@ -0,0 +1,20 @@
+apiVersion: v2
+appVersion: v0.16.2
+dependencies:
+- condition: bitwarden-sdk-server.enabled
+ name: bitwarden-sdk-server
+ repository: oci://ghcr.io/external-secrets/charts
+ version: v0.3.1
+description: External secret management for Kubernetes
+home: https://github.com/external-secrets/external-secrets
+icon: https://raw.githubusercontent.com/external-secrets/external-secrets/main/assets/eso-logo-large.png
+keywords:
+- kubernetes-external-secrets
+- secrets
+kubeVersion: '>= 1.19.0-0'
+maintainers:
+- email: kellinmcavoy@gmail.com
+ name: mcavoyk
+name: external-secrets
+type: application
+version: 0.16.2
diff --git a/charts/external-secrets/README.md b/charts/external-secrets/README.md
new file mode 100644
index 0000000..44da66b
--- /dev/null
+++ b/charts/external-secrets/README.md
@@ -0,0 +1,243 @@
+# External Secrets
+
+
+
+[//]: # (README.md generated by gotmpl. DO NOT EDIT.)
+
+ 
+
+External secret management for Kubernetes
+
+## TL;DR
+```bash
+helm repo add external-secrets https://charts.external-secrets.io
+helm install external-secrets external-secrets/external-secrets
+```
+
+## Installing the Chart
+To install the chart with the release name `external-secrets`:
+```bash
+helm install external-secrets external-secrets/external-secrets
+```
+
+### Custom Resources
+By default, the chart will install external-secrets CRDs, this can be controlled with `installCRDs` value.
+
+## Uninstalling the Chart
+To uninstall the `external-secrets` deployment:
+```bash
+helm uninstall external-secrets
+```
+The command removes all the Kubernetes components associated with the chart and deletes the release.
+
+## Values
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| affinity | object | `{}` | |
+| bitwarden-sdk-server.enabled | bool | `false` | |
+| certController.affinity | object | `{}` | |
+| certController.create | bool | `true` | Specifies whether a certificate controller deployment be created. |
+| certController.deploymentAnnotations | object | `{}` | Annotations to add to Deployment |
+| certController.extraArgs | object | `{}` | |
+| certController.extraEnv | list | `[]` | |
+| certController.extraVolumeMounts | list | `[]` | |
+| certController.extraVolumes | list | `[]` | |
+| certController.fullnameOverride | string | `""` | |
+| certController.hostNetwork | bool | `false` | Run the certController on the host network |
+| certController.image.flavour | string | `""` | |
+| certController.image.pullPolicy | string | `"IfNotPresent"` | |
+| certController.image.repository | string | `"oci.external-secrets.io/external-secrets/external-secrets"` | |
+| certController.image.tag | string | `""` | |
+| certController.imagePullSecrets | list | `[]` | |
+| certController.log | object | `{"level":"info","timeEncoding":"epoch"}` | Specifices Log Params to the Certificate Controller |
+| certController.metrics.listen.port | int | `8080` | |
+| certController.metrics.service.annotations | object | `{}` | Additional service annotations |
+| certController.metrics.service.enabled | bool | `false` | Enable if you use another monitoring tool than Prometheus to scrape the metrics |
+| certController.metrics.service.port | int | `8080` | Metrics service port to scrape |
+| certController.nameOverride | string | `""` | |
+| certController.nodeSelector | object | `{}` | |
+| certController.podAnnotations | object | `{}` | Annotations to add to Pod |
+| certController.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
+| certController.podLabels | object | `{}` | |
+| certController.podSecurityContext.enabled | bool | `true` | |
+| certController.priorityClassName | string | `""` | Pod priority class name. |
+| certController.rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. |
+| certController.readinessProbe.address | string | `""` | Address for readiness probe |
+| certController.readinessProbe.port | int | `8081` | ReadinessProbe port for kubelet |
+| certController.replicaCount | int | `1` | |
+| certController.requeueInterval | string | `"5m"` | |
+| certController.resources | object | `{}` | |
+| certController.revisionHistoryLimit | int | `10` | Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
+| certController.securityContext.allowPrivilegeEscalation | bool | `false` | |
+| certController.securityContext.capabilities.drop[0] | string | `"ALL"` | |
+| certController.securityContext.enabled | bool | `true` | |
+| certController.securityContext.readOnlyRootFilesystem | bool | `true` | |
+| certController.securityContext.runAsNonRoot | bool | `true` | |
+| certController.securityContext.runAsUser | int | `1000` | |
+| certController.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
+| certController.serviceAccount.annotations | object | `{}` | Annotations to add to the service account. |
+| certController.serviceAccount.automount | bool | `true` | Automounts the service account token in all containers of the pod |
+| certController.serviceAccount.create | bool | `true` | Specifies whether a service account should be created. |
+| certController.serviceAccount.extraLabels | object | `{}` | Extra Labels to add to the service account. |
+| certController.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. |
+| certController.tolerations | list | `[]` | |
+| certController.topologySpreadConstraints | list | `[]` | |
+| commonLabels | object | `{}` | Additional labels added to all helm chart resources. |
+| concurrent | int | `1` | Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at a time. |
+| controllerClass | string | `""` | If set external secrets will filter matching Secret Stores with the appropriate controller values. |
+| crds.annotations | object | `{}` | |
+| crds.conversion.enabled | bool | `false` | Conversion is disabled by default as we stopped supporting v1alpha1. |
+| crds.createClusterExternalSecret | bool | `true` | If true, create CRDs for Cluster External Secret. |
+| crds.createClusterGenerator | bool | `true` | If true, create CRDs for Cluster Generator. |
+| crds.createClusterPushSecret | bool | `true` | If true, create CRDs for Cluster Push Secret. |
+| crds.createClusterSecretStore | bool | `true` | If true, create CRDs for Cluster Secret Store. |
+| crds.createPushSecret | bool | `true` | If true, create CRDs for Push Secret. |
+| createOperator | bool | `true` | Specifies whether an external secret operator deployment be created. |
+| deploymentAnnotations | object | `{}` | Annotations to add to Deployment |
+| dnsConfig | object | `{}` | Specifies `dnsOptions` to deployment |
+| dnsPolicy | string | `"ClusterFirst"` | Specifies `dnsPolicy` to deployment |
+| extendedMetricLabels | bool | `false` | If true external secrets will use recommended kubernetes annotations as prometheus metric labels. |
+| extraArgs | object | `{}` | |
+| extraContainers | list | `[]` | |
+| extraEnv | list | `[]` | |
+| extraObjects | list | `[]` | |
+| extraVolumeMounts | list | `[]` | |
+| extraVolumes | list | `[]` | |
+| fullnameOverride | string | `""` | |
+| global.affinity | object | `{}` | |
+| global.compatibility.openshift.adaptSecurityContext | string | `"auto"` | Manages the securityContext properties to make them compatible with OpenShift. Possible values: auto - Apply configurations if it is detected that OpenShift is the target platform. force - Always apply configurations. disabled - No modification applied. |
+| global.nodeSelector | object | `{}` | |
+| global.tolerations | list | `[]` | |
+| global.topologySpreadConstraints | list | `[]` | |
+| grafanaDashboard.annotations | object | `{}` | Annotations that ConfigMaps can have to get configured in Grafana, See: sidecar.dashboards.folderAnnotation for specifying the dashboard folder. https://github.com/grafana/helm-charts/tree/main/charts/grafana |
+| grafanaDashboard.enabled | bool | `false` | If true creates a Grafana dashboard. |
+| grafanaDashboard.sidecarLabel | string | `"grafana_dashboard"` | Label that ConfigMaps should have to be loaded as dashboards. |
+| grafanaDashboard.sidecarLabelValue | string | `"1"` | Label value that ConfigMaps should have to be loaded as dashboards. |
+| hostNetwork | bool | `false` | Run the controller on the host network |
+| image.flavour | string | `""` | The flavour of tag you want to use There are different image flavours available, like distroless and ubi. Please see GitHub release notes for image tags for these flavors. By default, the distroless image is used. |
+| image.pullPolicy | string | `"IfNotPresent"` | |
+| image.repository | string | `"oci.external-secrets.io/external-secrets/external-secrets"` | |
+| image.tag | string | `""` | The image tag to use. The default is the chart appVersion. |
+| imagePullSecrets | list | `[]` | |
+| installCRDs | bool | `true` | If set, install and upgrade CRDs through helm chart. |
+| leaderElect | bool | `false` | If true, external-secrets will perform leader election between instances to ensure no more than one instance of external-secrets operates at a time. |
+| log | object | `{"level":"info","timeEncoding":"epoch"}` | Specifices Log Params to the External Secrets Operator |
+| metrics.listen.port | int | `8080` | |
+| metrics.service.annotations | object | `{}` | Additional service annotations |
+| metrics.service.enabled | bool | `false` | Enable if you use another monitoring tool than Prometheus to scrape the metrics |
+| metrics.service.port | int | `8080` | Metrics service port to scrape |
+| nameOverride | string | `""` | |
+| namespaceOverride | string | `""` | |
+| nodeSelector | object | `{}` | |
+| openshiftFinalizers | bool | `true` | If true the OpenShift finalizer permissions will be added to RBAC |
+| podAnnotations | object | `{}` | Annotations to add to Pod |
+| podDisruptionBudget | object | `{"enabled":false,"minAvailable":1}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
+| podLabels | object | `{}` | |
+| podSecurityContext.enabled | bool | `true` | |
+| podSpecExtra | object | `{}` | Any extra pod spec on the deployment |
+| priorityClassName | string | `""` | Pod priority class name. |
+| processClusterExternalSecret | bool | `true` | if true, the operator will process cluster external secret. Else, it will ignore them. |
+| processClusterPushSecret | bool | `true` | if true, the operator will process cluster push secret. Else, it will ignore them. |
+| processClusterStore | bool | `true` | if true, the operator will process cluster store. Else, it will ignore them. |
+| processPushSecret | bool | `true` | if true, the operator will process push secret. Else, it will ignore them. |
+| rbac.aggregateToEdit | bool | `true` | Specifies whether permissions are aggregated to the edit ClusterRole |
+| rbac.aggregateToView | bool | `true` | Specifies whether permissions are aggregated to the view ClusterRole |
+| rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. |
+| rbac.servicebindings.create | bool | `true` | Specifies whether a clusterrole to give servicebindings read access should be created. |
+| replicaCount | int | `1` | |
+| resources | object | `{}` | |
+| revisionHistoryLimit | int | `10` | Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
+| scopedNamespace | string | `""` | If set external secrets are only reconciled in the provided namespace |
+| scopedRBAC | bool | `false` | Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace and implicitly disable cluster stores and cluster external secrets |
+| securityContext.allowPrivilegeEscalation | bool | `false` | |
+| securityContext.capabilities.drop[0] | string | `"ALL"` | |
+| securityContext.enabled | bool | `true` | |
+| securityContext.readOnlyRootFilesystem | bool | `true` | |
+| securityContext.runAsNonRoot | bool | `true` | |
+| securityContext.runAsUser | int | `1000` | |
+| securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
+| service.ipFamilies | list | `[]` | Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6. |
+| service.ipFamilyPolicy | string | `""` | Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services) |
+| serviceAccount.annotations | object | `{}` | Annotations to add to the service account. |
+| serviceAccount.automount | bool | `true` | Automounts the service account token in all containers of the pod |
+| serviceAccount.create | bool | `true` | Specifies whether a service account should be created. |
+| serviceAccount.extraLabels | object | `{}` | Extra Labels to add to the service account. |
+| serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. |
+| serviceMonitor.additionalLabels | object | `{}` | Additional labels |
+| serviceMonitor.enabled | bool | `false` | Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics |
+| serviceMonitor.honorLabels | bool | `false` | Let prometheus add an exported_ prefix to conflicting labels |
+| serviceMonitor.interval | string | `"30s"` | Interval to scrape metrics |
+| serviceMonitor.metricRelabelings | list | `[]` | Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs) |
+| serviceMonitor.namespace | string | `""` | namespace where you want to install ServiceMonitors |
+| serviceMonitor.relabelings | list | `[]` | Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config) |
+| serviceMonitor.scrapeTimeout | string | `"25s"` | Timeout if metrics can't be retrieved in given time interval |
+| tolerations | list | `[]` | |
+| topologySpreadConstraints | list | `[]` | |
+| webhook.affinity | object | `{}` | |
+| webhook.annotations | object | `{}` | Annotations to place on validating webhook configuration. |
+| webhook.certCheckInterval | string | `"5m"` | Specifices the time to check if the cert is valid |
+| webhook.certDir | string | `"/tmp/certs"` | |
+| webhook.certManager.addInjectorAnnotations | bool | `true` | Automatically add the cert-manager.io/inject-ca-from annotation to the webhooks and CRDs. As long as you have the cert-manager CA Injector enabled, this will automatically setup your webhook's CA to the one used by cert-manager. See https://cert-manager.io/docs/concepts/ca-injector |
+| webhook.certManager.cert.annotations | object | `{}` | Add extra annotations to the Certificate resource. |
+| webhook.certManager.cert.create | bool | `true` | Create a certificate resource within this chart. See https://cert-manager.io/docs/usage/certificate/ |
+| webhook.certManager.cert.duration | string | `"8760h"` | Set the requested duration (i.e. lifetime) of the Certificate. See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec One year by default. |
+| webhook.certManager.cert.issuerRef | object | `{"group":"cert-manager.io","kind":"Issuer","name":"my-issuer"}` | For the Certificate created by this chart, setup the issuer. See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.IssuerSpec |
+| webhook.certManager.cert.renewBefore | string | `""` | How long before the currently issued certificate’s expiry cert-manager should renew the certificate. See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec Note that renewBefore should be greater than .webhook.lookaheadInterval since the webhook will check this far in advance that the certificate is valid. |
+| webhook.certManager.cert.revisionHistoryLimit | int | `0` | Set the revisionHistoryLimit on the Certificate. See https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec Defaults to 0 (ignored). |
+| webhook.certManager.enabled | bool | `false` | Enabling cert-manager support will disable the built in secret and switch to using cert-manager (installed separately) to automatically issue and renew the webhook certificate. This chart does not install cert-manager for you, See https://cert-manager.io/docs/ |
+| webhook.create | bool | `true` | Specifies whether a webhook deployment be created. If set to false, crds.conversion.enabled should also be set to false otherwise the kubeapi will be hammered because the conversion is looking for a webhook endpoint. |
+| webhook.deploymentAnnotations | object | `{}` | Annotations to add to Deployment |
+| webhook.extraArgs | object | `{}` | |
+| webhook.extraEnv | list | `[]` | |
+| webhook.extraVolumeMounts | list | `[]` | |
+| webhook.extraVolumes | list | `[]` | |
+| webhook.failurePolicy | string | `"Fail"` | Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore |
+| webhook.fullnameOverride | string | `""` | |
+| webhook.hostNetwork | bool | `false` | Specifies if webhook pod should use hostNetwork or not. |
+| webhook.image.flavour | string | `""` | The flavour of tag you want to use |
+| webhook.image.pullPolicy | string | `"IfNotPresent"` | |
+| webhook.image.repository | string | `"oci.external-secrets.io/external-secrets/external-secrets"` | |
+| webhook.image.tag | string | `""` | The image tag to use. The default is the chart appVersion. |
+| webhook.imagePullSecrets | list | `[]` | |
+| webhook.log | object | `{"level":"info","timeEncoding":"epoch"}` | Specifices Log Params to the Webhook |
+| webhook.lookaheadInterval | string | `""` | Specifices the lookaheadInterval for certificate validity |
+| webhook.metrics.listen.port | int | `8080` | |
+| webhook.metrics.service.annotations | object | `{}` | Additional service annotations |
+| webhook.metrics.service.enabled | bool | `false` | Enable if you use another monitoring tool than Prometheus to scrape the metrics |
+| webhook.metrics.service.port | int | `8080` | Metrics service port to scrape |
+| webhook.nameOverride | string | `""` | |
+| webhook.nodeSelector | object | `{}` | |
+| webhook.podAnnotations | object | `{}` | Annotations to add to Pod |
+| webhook.podDisruptionBudget | object | `{"enabled":false,"minAvailable":1}` | Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/ |
+| webhook.podLabels | object | `{}` | |
+| webhook.podSecurityContext.enabled | bool | `true` | |
+| webhook.port | int | `10250` | The port the webhook will listen to |
+| webhook.priorityClassName | string | `""` | Pod priority class name. |
+| webhook.rbac.create | bool | `true` | Specifies whether role and rolebinding resources should be created. |
+| webhook.readinessProbe.address | string | `""` | Address for readiness probe |
+| webhook.readinessProbe.port | int | `8081` | ReadinessProbe port for kubelet |
+| webhook.replicaCount | int | `1` | |
+| webhook.resources | object | `{}` | |
+| webhook.revisionHistoryLimit | int | `10` | Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy) |
+| webhook.secretAnnotations | object | `{}` | Annotations to add to Secret |
+| webhook.securityContext.allowPrivilegeEscalation | bool | `false` | |
+| webhook.securityContext.capabilities.drop[0] | string | `"ALL"` | |
+| webhook.securityContext.enabled | bool | `true` | |
+| webhook.securityContext.readOnlyRootFilesystem | bool | `true` | |
+| webhook.securityContext.runAsNonRoot | bool | `true` | |
+| webhook.securityContext.runAsUser | int | `1000` | |
+| webhook.securityContext.seccompProfile.type | string | `"RuntimeDefault"` | |
+| webhook.service | object | `{"annotations":{},"enabled":true,"labels":{},"loadBalancerIP":"","type":"ClusterIP"}` | Manage the service through which the webhook is reached. |
+| webhook.service.annotations | object | `{}` | Custom annotations for the webhook service. |
+| webhook.service.enabled | bool | `true` | Whether the service object should be enabled or not (it is expected to exist). |
+| webhook.service.labels | object | `{}` | Custom labels for the webhook service. |
+| webhook.service.loadBalancerIP | string | `""` | If the webhook service type is LoadBalancer, you can assign a specific load balancer IP here. Check the documentation of your load balancer provider to see if/how this should be used. |
+| webhook.service.type | string | `"ClusterIP"` | The service type of the webhook service. |
+| webhook.serviceAccount.annotations | object | `{}` | Annotations to add to the service account. |
+| webhook.serviceAccount.automount | bool | `true` | Automounts the service account token in all containers of the pod |
+| webhook.serviceAccount.create | bool | `true` | Specifies whether a service account should be created. |
+| webhook.serviceAccount.extraLabels | object | `{}` | Extra Labels to add to the service account. |
+| webhook.serviceAccount.name | string | `""` | The name of the service account to use. If not set and create is true, a name is generated using the fullname template. |
+| webhook.tolerations | list | `[]` | |
+| webhook.topologySpreadConstraints | list | `[]` | |
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/.helmignore b/charts/external-secrets/charts/bitwarden-sdk-server/.helmignore
new file mode 100644
index 0000000..0e8a0eb
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/.helmignore
@@ -0,0 +1,23 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*.orig
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+.vscode/
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/Chart.yaml b/charts/external-secrets/charts/bitwarden-sdk-server/Chart.yaml
new file mode 100644
index 0000000..64d6f38
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+appVersion: v0.3.1
+description: A Helm chart for Kubernetes
+name: bitwarden-sdk-server
+type: application
+version: v0.3.1
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/templates/NOTES.txt b/charts/external-secrets/charts/bitwarden-sdk-server/templates/NOTES.txt
new file mode 100644
index 0000000..46b671c
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/templates/NOTES.txt
@@ -0,0 +1,22 @@
+1. Get the application URL by running these commands:
+{{- if .Values.ingress.enabled }}
+{{- range $host := .Values.ingress.hosts }}
+ {{- range .paths }}
+ http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ .path }}
+ {{- end }}
+{{- end }}
+{{- else if contains "NodePort" .Values.service.type }}
+ export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "bitwarden-sdk-server.fullname" . }})
+ export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
+ echo http://$NODE_IP:$NODE_PORT
+{{- else if contains "LoadBalancer" .Values.service.type }}
+ NOTE: It may take a few minutes for the LoadBalancer IP to be available.
+ You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "bitwarden-sdk-server.fullname" . }}'
+ export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "bitwarden-sdk-server.fullname" . }} --template "{{"{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}"}}")
+ echo http://$SERVICE_IP:{{ .Values.service.port }}
+{{- else if contains "ClusterIP" .Values.service.type }}
+ export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "bitwarden-sdk-server.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
+ export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
+ echo "Visit http://127.0.0.1:8080 to use your application"
+ kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
+{{- end }}
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/templates/_helpers.tpl b/charts/external-secrets/charts/bitwarden-sdk-server/templates/_helpers.tpl
new file mode 100644
index 0000000..a5e0da3
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/templates/_helpers.tpl
@@ -0,0 +1,62 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "bitwarden-sdk-server.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "bitwarden-sdk-server.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "bitwarden-sdk-server.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "bitwarden-sdk-server.labels" -}}
+helm.sh/chart: {{ include "bitwarden-sdk-server.chart" . }}
+{{ include "bitwarden-sdk-server.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "bitwarden-sdk-server.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "bitwarden-sdk-server.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "bitwarden-sdk-server.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "bitwarden-sdk-server.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/templates/deployment.yaml b/charts/external-secrets/charts/bitwarden-sdk-server/templates/deployment.yaml
new file mode 100644
index 0000000..06e2882
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/templates/deployment.yaml
@@ -0,0 +1,77 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "bitwarden-sdk-server.fullname" . }}
+ labels:
+ {{- include "bitwarden-sdk-server.labels" . | nindent 4 }}
+spec:
+ replicas: {{ .Values.replicaCount }}
+ selector:
+ matchLabels:
+ {{- include "bitwarden-sdk-server.selectorLabels" . | nindent 6 }}
+ template:
+ metadata:
+ {{- with .Values.podAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ labels:
+ {{- include "bitwarden-sdk-server.selectorLabels" . | nindent 8 }}
+ spec:
+ {{- with .Values.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ serviceAccountName: {{ include "bitwarden-sdk-server.serviceAccountName" . }}
+ securityContext:
+ {{- toYaml .Values.podSecurityContext | nindent 8 }}
+ containers:
+ - name: {{ .Chart.Name }}
+ {{- if not .Values.image.tls.enabled }}
+ args:
+ - --insecure
+ {{- end }}
+ securityContext:
+ {{- toYaml .Values.securityContext | nindent 12 }}
+ image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ {{- if .Values.image.tls.enabled }}
+ volumeMounts:
+ {{- toYaml .Values.image.tls.volumeMounts | nindent 10 }}
+ {{- end}}
+ ports:
+ - name: http
+ containerPort: {{ .Values.service.port }}
+ protocol: TCP
+ livenessProbe:
+ httpGet:
+ path: /live
+ port: http
+ {{- if .Values.image.tls.enabled }}
+ scheme: HTTPS
+ {{- end }}
+ readinessProbe:
+ httpGet:
+ path: /ready
+ port: http
+ {{- if .Values.image.tls.enabled }}
+ scheme: HTTPS
+ {{- end }}
+ resources:
+ {{- toYaml .Values.resources | nindent 12 }}
+ {{- with .Values.nodeSelector }}
+ nodeSelector:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.affinity }}
+ affinity:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.tolerations }}
+ tolerations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if .Values.image.tls.enabled }}
+ volumes:
+ {{- toYaml .Values.image.tls.volumes | nindent 8 }}
+ {{- end}}
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/templates/service.yaml b/charts/external-secrets/charts/bitwarden-sdk-server/templates/service.yaml
new file mode 100644
index 0000000..88e2d66
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/templates/service.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "bitwarden-sdk-server.fullname" . }}
+ labels:
+ {{- include "bitwarden-sdk-server.labels" . | nindent 4 }}
+spec:
+ type: {{ .Values.service.type }}
+ ports:
+ - port: {{ .Values.service.port }}
+ targetPort: http
+ name: http
+ selector:
+ {{- include "bitwarden-sdk-server.selectorLabels" . | nindent 4 }}
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/templates/serviceaccount.yaml b/charts/external-secrets/charts/bitwarden-sdk-server/templates/serviceaccount.yaml
new file mode 100644
index 0000000..fef7bad
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/templates/serviceaccount.yaml
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ include "bitwarden-sdk-server.serviceAccountName" . }}
+ labels:
+ {{- include "bitwarden-sdk-server.labels" . | nindent 4 }}
+ {{- with .Values.serviceAccount.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/tests/__snapshot__/deployment_test.yaml.snap b/charts/external-secrets/charts/bitwarden-sdk-server/tests/__snapshot__/deployment_test.yaml.snap
new file mode 100644
index 0000000..2fbcdb1
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/tests/__snapshot__/deployment_test.yaml.snap
@@ -0,0 +1,60 @@
+deployment should match snapshot:
+ 1: |
+ apiVersion: apps/v1
+ kind: Deployment
+ metadata:
+ labels:
+ app.kubernetes.io/instance: RELEASE-NAME
+ app.kubernetes.io/managed-by: Helm
+ app.kubernetes.io/name: bitwarden-sdk-server
+ app.kubernetes.io/version: 1.16.0
+ helm.sh/chart: bitwarden-sdk-server-0.1.0
+ name: bitwarden-sdk-server
+ spec:
+ replicas: 1
+ selector:
+ matchLabels:
+ app.kubernetes.io/instance: RELEASE-NAME
+ app.kubernetes.io/name: bitwarden-sdk-server
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/instance: RELEASE-NAME
+ app.kubernetes.io/name: bitwarden-sdk-server
+ spec:
+ containers:
+ - image: ghcr.io/external-secrets/bitwarden-sdk-server:v0.8.0
+ imagePullPolicy: IfNotPresent
+ livenessProbe:
+ httpGet:
+ path: /live
+ port: http
+ scheme: HTTPS
+ name: bitwarden-sdk-server
+ ports:
+ - containerPort: 9998
+ name: http
+ protocol: TCP
+ readinessProbe:
+ httpGet:
+ path: /ready
+ port: http
+ scheme: HTTPS
+ resources: {}
+ securityContext: {}
+ volumeMounts:
+ - mountPath: /certs
+ name: bitwarden-tls-certs
+ securityContext: {}
+ serviceAccountName: bitwarden-sdk-server
+ volumes:
+ - name: bitwarden-tls-certs
+ secret:
+ items:
+ - key: tls.crt
+ path: cert.pem
+ - key: tls.key
+ path: key.pem
+ - key: ca.crt
+ path: ca.pem
+ secretName: bitwarden-tls-certs
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/tests/deployment_test.yaml b/charts/external-secrets/charts/bitwarden-sdk-server/tests/deployment_test.yaml
new file mode 100644
index 0000000..bb4e2f4
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/tests/deployment_test.yaml
@@ -0,0 +1,9 @@
+suite: test deployment
+templates:
+ - deployment.yaml
+tests:
+ - it: deployment should match snapshot
+ set:
+ image.tag: v0.8.0
+ asserts:
+ - matchSnapshot: {}
diff --git a/charts/external-secrets/charts/bitwarden-sdk-server/values.yaml b/charts/external-secrets/charts/bitwarden-sdk-server/values.yaml
new file mode 100644
index 0000000..f0424af
--- /dev/null
+++ b/charts/external-secrets/charts/bitwarden-sdk-server/values.yaml
@@ -0,0 +1,98 @@
+# Default values for bitwarden-sdk-server.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+ repository: ghcr.io/external-secrets/bitwarden-sdk-server
+ pullPolicy: IfNotPresent
+ # Overrides the image tag whose default is the chart appVersion.
+ tag: ""
+ tls:
+ enabled: true
+ volumeMounts:
+ - mountPath: "/certs"
+ name: "bitwarden-tls-certs"
+ volumes:
+ - name: "bitwarden-tls-certs"
+ secret:
+ secretName: "bitwarden-tls-certs"
+ items:
+ - key: "tls.crt"
+ path: "cert.pem"
+ - key: "tls.key"
+ path: "key.pem"
+ - key: "ca.crt"
+ path: "ca.pem"
+
+imagePullSecrets: []
+nameOverride: "bitwarden-sdk-server"
+fullnameOverride: "bitwarden-sdk-server"
+
+serviceAccount:
+ # Specifies whether a service account should be created
+ create: true
+ # Annotations to add to the service account
+ annotations: {}
+ # The name of the service account to use.
+ # If not set and create is true, a name is generated using the fullname template
+ name: ""
+
+podAnnotations: {}
+
+podSecurityContext: {}
+ # fsGroup: 2000
+
+securityContext: {}
+ # capabilities:
+ # drop:
+ # - ALL
+ # readOnlyRootFilesystem: true
+ # runAsNonRoot: true
+ # runAsUser: 1000
+
+service:
+ type: ClusterIP
+ port: 9998
+
+ingress:
+ enabled: false
+ className: ""
+ annotations: {}
+ # kubernetes.io/ingress.class: nginx
+ # kubernetes.io/tls-acme: "true"
+ hosts:
+ - host: chart-example.local
+ paths:
+ - path: /
+ pathType: ImplementationSpecific
+ tls: []
+ # - secretName: chart-example-tls
+ # hosts:
+ # - chart-example.local
+
+resources: {}
+ # We usually recommend not to specify default resources and to leave this as a conscious
+ # choice for the user. This also increases chances charts run on environments with little
+ # resources, such as Minikube. If you do want to specify resources, uncomment the following
+ # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+ # limits:
+ # cpu: 100m
+ # memory: 128Mi
+ # requests:
+ # cpu: 100m
+ # memory: 128Mi
+
+autoscaling:
+ enabled: false
+ minReplicas: 1
+ maxReplicas: 100
+ targetCPUUtilizationPercentage: 80
+ # targetMemoryUtilizationPercentage: 80
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
diff --git a/charts/external-secrets/files/monitoring/grafana-dashboard.json b/charts/external-secrets/files/monitoring/grafana-dashboard.json
new file mode 100644
index 0000000..2a299aa
--- /dev/null
+++ b/charts/external-secrets/files/monitoring/grafana-dashboard.json
@@ -0,0 +1,1961 @@
+{
+ "annotations": {
+ "list": [
+ {
+ "builtIn": 1,
+ "datasource": {
+ "type": "grafana",
+ "uid": "-- Grafana --"
+ },
+ "enable": true,
+ "hide": true,
+ "iconColor": "rgba(0, 211, 255, 1)",
+ "name": "Annotations & Alerts",
+ "target": {
+ "limit": 100,
+ "matchAny": false,
+ "tags": [],
+ "type": "dashboard"
+ },
+ "type": "dashboard"
+ }
+ ]
+ },
+ "editable": true,
+ "fiscalYearStartMonth": 0,
+ "graphTooltip": 0,
+ "id": 27,
+ "links": [],
+ "liveNow": false,
+ "panels": [
+ {
+ "collapsed": false,
+ "gridPos": {
+ "h": 1,
+ "w": 24,
+ "x": 0,
+ "y": 0
+ },
+ "id": 99,
+ "panels": [],
+ "title": "SLIs",
+ "type": "row"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 7,
+ "w": 4,
+ "x": 0,
+ "y": 1
+ },
+ "id": 118,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"secretstore\", result=\"error\"}[15m])))\n/\n(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"secretstore\"}[15m])))\n> 0",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "SecretStore error rate [15m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 7,
+ "w": 4,
+ "x": 4,
+ "y": 1
+ },
+ "id": 121,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"clustersecretstore\", result=\"error\"}[15m])))\n/\n(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"clustersecretstore\"}[15m])))\n> 0",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "ClusterSecretStore error rate [15m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 6,
+ "w": 4,
+ "x": 8,
+ "y": 1
+ },
+ "id": 119,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"externalsecret\", result=\"error\"}[15m])))\n/\n(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"externalsecret\"}[15m])))\n> 0",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "ExternalSecret error rate [15m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 6,
+ "w": 4,
+ "x": 12,
+ "y": 1
+ },
+ "id": 120,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "(sum(irate(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"clusterexternalsecret\", result=\"error\"}[15m])))\n/\n(sum(irate(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"clusterexternalsecret\"}[15m])))\n> 0",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "ClusterExternalSecret error rate [15m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 7,
+ "w": 4,
+ "x": 16,
+ "y": 1
+ },
+ "id": 122,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"pushsecret\", result=\"error\"}[15m])))\n/\n(sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"pushsecret\"}[15m])))\n> 0",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "PushSecret error rate [15m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 7,
+ "w": 4,
+ "x": 20,
+ "y": 1
+ },
+ "id": 123,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "sum(increase(externalsecret_provider_api_calls_count{service=~\".*external-secrets.*\", status=\"error\"}[15m]))\n/\nsum(increase(externalsecret_provider_api_calls_count{service=~\".*external-secrets.*\"}[15m]))\n> 0",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "Provider error rate [15m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 10
+ }
+ ]
+ },
+ "unit": "none"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 7,
+ "w": 8,
+ "x": 8,
+ "y": 7
+ },
+ "id": 147,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "sum(\n workqueue_depth{service=~\"external-secrets.*\"}\n) by (name)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "Workqueue depth",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 6,
+ "w": 4,
+ "x": 0,
+ "y": 8
+ },
+ "id": 145,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "sum(increase(controller_runtime_webhook_requests_total{service=~\"external-secrets.*\",code=\"500\"}[15m]))\n/\nsum(increase(controller_runtime_webhook_requests_total{service=~\"external-secrets.*\"}[15m]))",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "Webhook error rate [15m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 100
+ }
+ ]
+ },
+ "unit": "s"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 6,
+ "w": 4,
+ "x": 4,
+ "y": 8
+ },
+ "id": 146,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "histogram_quantile(0.99,\n sum(rate(controller_runtime_webhook_latency_seconds_bucket{service=~\"external-secrets.*\"}[5m])) by (le)\n)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "Webhook latency [5m]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 10
+ }
+ ]
+ },
+ "unit": "s"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 6,
+ "w": 4,
+ "x": 16,
+ "y": 8
+ },
+ "id": 148,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "histogram_quantile(0.99,\n sum(rate(controller_runtime_reconcile_time_seconds_bucket{service=~\"external-secrets.*\"}[5m])) by (le)\n)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "Reconcile latency [p99]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "percentunit"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 6,
+ "w": 4,
+ "x": 20,
+ "y": 8
+ },
+ "id": 149,
+ "options": {
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "showThresholdLabels": false,
+ "showThresholdMarkers": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "sum(increase(controller_runtime_reconcile_total{service=~\"external-secrets.*\",controller=~\"$controller\",result=\"error\"}[1m]))\n/\nsum(increase(controller_runtime_reconcile_total{service=~\"external-secrets.*\",controller=~\"$controller\"}[1m]))\n> 0",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "reconcile error rate [p99]",
+ "type": "gauge"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "min": 0,
+ "thresholds": {
+ "mode": "percentage",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "#EAB839",
+ "value": 1
+ }
+ ]
+ },
+ "unit": "none"
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 8,
+ "x": 0,
+ "y": 14
+ },
+ "id": 124,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "increase(externalsecret_provider_api_calls_count{service=~\".*external-secrets.*\", status=\"error\"}[15m])",
+ "legendFormat": "{{provider}}/{{call}}",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "Provider errors [15m]",
+ "type": "timeseries"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "custom": {
+ "align": "auto",
+ "cellOptions": {
+ "type": "auto"
+ },
+ "filterable": false,
+ "inspect": false
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": [
+ {
+ "matcher": {
+ "id": "byName",
+ "options": "Value"
+ },
+ "properties": [
+ {
+ "id": "custom.hidden",
+ "value": true
+ }
+ ]
+ },
+ {
+ "matcher": {
+ "id": "byName",
+ "options": "Time"
+ },
+ "properties": [
+ {
+ "id": "custom.hidden",
+ "value": true
+ }
+ ]
+ }
+ ]
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 7,
+ "x": 8,
+ "y": 14
+ },
+ "id": 125,
+ "options": {
+ "cellHeight": "sm",
+ "footer": {
+ "countRows": false,
+ "fields": [],
+ "reducer": [
+ "sum"
+ ],
+ "show": false
+ },
+ "showHeader": true
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "exemplar": false,
+ "expr": "sum(externalsecret_status_condition{condition=\"Ready\",status=\"False\"}) by (namespace, name) == 1",
+ "format": "table",
+ "instant": true,
+ "legendFormat": "{{provider}}/{{call}}",
+ "range": false,
+ "refId": "A"
+ }
+ ],
+ "title": "Not Ready ExternalSecrets [15m]",
+ "transformations": [],
+ "type": "table"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 9,
+ "x": 15,
+ "y": 14
+ },
+ "id": 126,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "targets": [
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "editorMode": "code",
+ "expr": "sum(increase(externalsecret_sync_calls_error[15m])) by (name, namespace)",
+ "legendFormat": "{{namespace}}/{{name}}",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "ExternalSecret sync call errors [15m]",
+ "type": "timeseries"
+ },
+ {
+ "collapsed": true,
+ "gridPos": {
+ "h": 1,
+ "w": 24,
+ "x": 0,
+ "y": 22
+ },
+ "id": 27,
+ "panels": [
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 12,
+ "x": 0,
+ "y": 16
+ },
+ "id": 53,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(increase(controller_runtime_webhook_requests_total{service=~\".*external-secrets.*\"}[1m])) by (webhook)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "requests by path per minute",
+ "type": "timeseries"
+ },
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 12,
+ "x": 12,
+ "y": 16
+ },
+ "id": 67,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(controller_runtime_webhook_requests_in_flight{service=~\".*external-secrets.*\"}) by (webhook)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "requests in flight",
+ "type": "timeseries"
+ },
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 12,
+ "x": 0,
+ "y": 24
+ },
+ "id": 80,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(increase(controller_runtime_webhook_requests_total{service=~\".*external-secrets.*\"}[1m])) by (code)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "requests by code per minute",
+ "type": "timeseries"
+ },
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "custom": {
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "scaleDistribution": {
+ "type": "linear"
+ }
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 12,
+ "x": 12,
+ "y": 24
+ },
+ "id": 54,
+ "options": {
+ "calculate": false,
+ "cellGap": 1,
+ "color": {
+ "exponent": 0.5,
+ "fill": "dark-orange",
+ "mode": "scheme",
+ "reverse": false,
+ "scale": "exponential",
+ "scheme": "Oranges",
+ "steps": 64
+ },
+ "exemplars": {
+ "color": "rgba(255,0,255,0.7)"
+ },
+ "filterValues": {
+ "le": 1e-9
+ },
+ "legend": {
+ "show": true
+ },
+ "rowsFrame": {
+ "layout": "auto"
+ },
+ "tooltip": {
+ "show": true,
+ "yHistogram": false
+ },
+ "yAxis": {
+ "axisPlacement": "left",
+ "reverse": false
+ }
+ },
+ "pluginVersion": "9.5.2",
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(rate(controller_runtime_webhook_latency_seconds_bucket{service=~\".*external-secrets.*\"}[$__rate_interval])) by (le)",
+ "legendFormat": "{{le}}",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "webhook latency",
+ "type": "heatmap"
+ }
+ ],
+ "title": "Admission Control Webhook",
+ "type": "row"
+ },
+ {
+ "collapsed": true,
+ "gridPos": {
+ "h": 1,
+ "w": 24,
+ "x": 0,
+ "y": 23
+ },
+ "id": 17,
+ "panels": [
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 7,
+ "x": 0,
+ "y": 17
+ },
+ "id": 2,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(controller_runtime_active_workers{service=~\".*external-secrets.*\",controller=~\"$controller\"}) by (controller)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "active workers by controller",
+ "type": "timeseries"
+ },
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 8,
+ "x": 7,
+ "y": 17
+ },
+ "id": 37,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(workqueue_depth{service=~\".*external-secrets.*\"}) by (name)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "workqueue depth",
+ "type": "timeseries"
+ },
+ {
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 9,
+ "x": 15,
+ "y": 17
+ },
+ "id": 15,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(increase(externalsecret_provider_api_calls_count{service=~\".*external-secrets.*\"}[1m])) by(provider, call, status)",
+ "legendFormat": "{{provider}}/{{call}}={{status}}",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "API calls by provider",
+ "type": "timeseries"
+ },
+ {
+ "datasource": "$datasource",
+ "description": "",
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "thresholds"
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 6,
+ "w": 3.4285714285714284,
+ "x": 0,
+ "y": 25
+ },
+ "id": 5,
+ "maxPerRow": 12,
+ "options": {
+ "colorMode": "value",
+ "graphMode": "area",
+ "justifyMode": "auto",
+ "orientation": "auto",
+ "reduceOptions": {
+ "calcs": [
+ "lastNotNull"
+ ],
+ "fields": "",
+ "values": false
+ },
+ "textMode": "auto"
+ },
+ "pluginVersion": "9.5.2",
+ "repeat": "controller",
+ "repeatDirection": "h",
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(controller_runtime_max_concurrent_reconciles{service=~\".*external-secrets.*\",controller=\"$controller\"}) by (controller)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "max concurrent: $controller",
+ "type": "stat"
+ },
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "color": {
+ "mode": "palette-classic"
+ },
+ "custom": {
+ "axisCenteredZero": false,
+ "axisColorMode": "text",
+ "axisLabel": "",
+ "axisPlacement": "auto",
+ "barAlignment": 0,
+ "drawStyle": "line",
+ "fillOpacity": 0,
+ "gradientMode": "none",
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "lineInterpolation": "linear",
+ "lineWidth": 1,
+ "pointSize": 5,
+ "scaleDistribution": {
+ "type": "linear"
+ },
+ "showPoints": "auto",
+ "spanNulls": false,
+ "stacking": {
+ "group": "A",
+ "mode": "none"
+ },
+ "thresholdsStyle": {
+ "mode": "off"
+ }
+ },
+ "mappings": [],
+ "thresholds": {
+ "mode": "absolute",
+ "steps": [
+ {
+ "color": "green",
+ "value": null
+ },
+ {
+ "color": "red",
+ "value": 80
+ }
+ ]
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 3.4285714285714284,
+ "x": 0,
+ "y": 31
+ },
+ "id": 3,
+ "maxPerRow": 8,
+ "options": {
+ "legend": {
+ "calcs": [],
+ "displayMode": "list",
+ "placement": "bottom",
+ "showLegend": true
+ },
+ "tooltip": {
+ "mode": "single",
+ "sort": "none"
+ }
+ },
+ "repeat": "controller",
+ "repeatDirection": "h",
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "sum(increase(controller_runtime_reconcile_total{service=~\".*external-secrets.*\",controller=~\"$controller\"}[1m])) by (result)",
+ "legendFormat": "__auto",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "reconcile rate per minute: $controller",
+ "type": "timeseries"
+ },
+ {
+ "datasource": "$datasource",
+ "fieldConfig": {
+ "defaults": {
+ "custom": {
+ "hideFrom": {
+ "legend": false,
+ "tooltip": false,
+ "viz": false
+ },
+ "scaleDistribution": {
+ "type": "linear"
+ }
+ }
+ },
+ "overrides": []
+ },
+ "gridPos": {
+ "h": 8,
+ "w": 3.4285714285714284,
+ "x": 0,
+ "y": 39
+ },
+ "id": 39,
+ "maxPerRow": 8,
+ "options": {
+ "calculate": false,
+ "cellGap": 1,
+ "cellValues": {
+ "unit": "short"
+ },
+ "color": {
+ "exponent": 0.5,
+ "fill": "dark-orange",
+ "mode": "scheme",
+ "reverse": false,
+ "scale": "exponential",
+ "scheme": "Oranges",
+ "steps": 10
+ },
+ "exemplars": {
+ "color": "rgba(255,0,255,0.7)"
+ },
+ "filterValues": {
+ "le": 1e-9
+ },
+ "legend": {
+ "show": true
+ },
+ "rowsFrame": {
+ "layout": "auto"
+ },
+ "tooltip": {
+ "show": true,
+ "yHistogram": false
+ },
+ "yAxis": {
+ "axisPlacement": "left",
+ "max": "5",
+ "min": 0,
+ "reverse": false,
+ "unit": "s"
+ }
+ },
+ "pluginVersion": "9.5.2",
+ "repeat": "controller",
+ "repeatDirection": "h",
+ "targets": [
+ {
+ "datasource": "$datasource",
+ "editorMode": "code",
+ "expr": "rate(controller_runtime_reconcile_time_seconds_bucket{service=~\".*external-secrets.*\",controller=~\"$controller\"}[$__rate_interval])",
+ "legendFormat": "{{le}}",
+ "range": true,
+ "refId": "A"
+ }
+ ],
+ "title": "reconcile time latency: $controller",
+ "type": "heatmap"
+ }
+ ],
+ "title": "Controllers",
+ "type": "row"
+ }
+ ],
+ "refresh": "",
+ "revision": 1,
+ "schemaVersion": 38,
+ "style": "dark",
+ "tags": [],
+ "templating": {
+ "list": [
+ {
+ "current": {
+ "selected": false,
+ "text": "Prometheus",
+ "value": "Prometheus"
+ },
+ "hide": 0,
+ "includeAll": false,
+ "multi": false,
+ "name": "datasource",
+ "options": [],
+ "query": "prometheus",
+ "queryValue": "",
+ "refresh": 1,
+ "regex": "",
+ "skipUrlSync": false,
+ "type": "datasource"
+ },
+ {
+ "allValue": ".*",
+ "current": {
+ "selected": false,
+ "text": "All",
+ "value": "$__all"
+ },
+ "datasource": {
+ "type": "prometheus",
+ "uid": "$datasource"
+ },
+ "definition": "label_values(controller_runtime_active_workers{service=~\".*external-secrets.*\"}, controller)",
+ "hide": 0,
+ "includeAll": true,
+ "multi": true,
+ "name": "controller",
+ "options": [],
+ "query": {
+ "query": "label_values(controller_runtime_active_workers{service=~\".*external-secrets.*\"}, controller)",
+ "refId": "StandardVariableQuery"
+ },
+ "refresh": 1,
+ "regex": "",
+ "skipUrlSync": false,
+ "sort": 0,
+ "type": "query"
+ }
+ ]
+ },
+ "time": {
+ "from": "now-1h",
+ "to": "now"
+ },
+ "timepicker": {},
+ "timezone": "",
+ "title": "External Secrets Operator",
+ "uid": "n4IdKaJVk",
+ "version": 9,
+ "weekStart": ""
+}
diff --git a/charts/external-secrets/templates/NOTES.txt b/charts/external-secrets/templates/NOTES.txt
new file mode 100644
index 0000000..ffa0fc7
--- /dev/null
+++ b/charts/external-secrets/templates/NOTES.txt
@@ -0,0 +1,7 @@
+external-secrets has been deployed successfully in namespace {{ template "external-secrets.namespace" . }}!
+
+In order to begin using ExternalSecrets, you will need to set up a SecretStore
+or ClusterSecretStore resource (for example, by creating a 'vault' SecretStore).
+
+More information on the different types of SecretStores and how to configure them
+can be found in our Github: {{ .Chart.Home }}
diff --git a/charts/external-secrets/templates/_helpers.tpl b/charts/external-secrets/templates/_helpers.tpl
new file mode 100644
index 0000000..d47f516
--- /dev/null
+++ b/charts/external-secrets/templates/_helpers.tpl
@@ -0,0 +1,221 @@
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "external-secrets.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+If release name contains chart name it will be used as a full name.
+*/}}
+{{- define "external-secrets.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Define namespace of chart, useful for multi-namespace deployments
+*/}}
+{{- define "external-secrets.namespace" -}}
+{{- if .Values.namespaceOverride }}
+{{- .Values.namespaceOverride }}
+{{- else }}
+{{- .Release.Namespace }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "external-secrets.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "external-secrets.labels" -}}
+helm.sh/chart: {{ include "external-secrets.chart" . }}
+{{ include "external-secrets.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "external-secrets-webhook.labels" -}}
+helm.sh/chart: {{ include "external-secrets.chart" . }}
+{{ include "external-secrets-webhook.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled }}
+app.kubernetes.io/metrics: "webhook"
+{{- with .Values.webhook.service.labels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "external-secrets-webhook.annotations" -}}
+{{- if or .Values.webhook.service.annotations (and .Values.webhook.metrics.service.enabled .Values.webhook.metrics.service.annotations) -}}
+annotations:
+{{- with .Values.webhook.service.annotations }}
+ {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- if .Values.webhook.metrics.service.enabled }}
+{{- with .Values.webhook.metrics.service.annotations }}
+ {{- toYaml . | nindent 2 }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "external-secrets-webhook-metrics.labels" -}}
+{{ include "external-secrets-webhook.selectorLabels" . }}
+app.kubernetes.io/metrics: "webhook"
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{- define "external-secrets-cert-controller.labels" -}}
+helm.sh/chart: {{ include "external-secrets.chart" . }}
+{{ include "external-secrets-cert-controller.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled }}
+app.kubernetes.io/metrics: "cert-controller"
+{{- end }}
+{{- end }}
+
+{{- define "external-secrets-cert-controller-metrics.labels" -}}
+{{ include "external-secrets-cert-controller.selectorLabels" . }}
+app.kubernetes.io/metrics: "cert-controller"
+{{- with .Values.commonLabels }}
+{{ toYaml . }}
+{{- end }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "external-secrets.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "external-secrets.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+{{- define "external-secrets-webhook.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "external-secrets.name" . }}-webhook
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+{{- define "external-secrets-cert-controller.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "external-secrets.name" . }}-cert-controller
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "external-secrets.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create }}
+{{- default (include "external-secrets.fullname" .) .Values.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "external-secrets-webhook.serviceAccountName" -}}
+{{- if .Values.webhook.serviceAccount.create }}
+{{- default "external-secrets-webhook" .Values.webhook.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.webhook.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "external-secrets-cert-controller.serviceAccountName" -}}
+{{- if .Values.certController.serviceAccount.create }}
+{{- default "external-secrets-cert-controller" .Values.certController.serviceAccount.name }}
+{{- else }}
+{{- default "default" .Values.certController.serviceAccount.name }}
+{{- end }}
+{{- end }}
+
+{{/*
+Determine the image to use, including if using a flavour.
+*/}}
+{{- define "external-secrets.image" -}}
+{{- if .image.flavour -}}
+{{ printf "%s:%s-%s" .image.repository (.image.tag | default .chartAppVersion) .image.flavour }}
+{{- else }}
+{{ printf "%s:%s" .image.repository (.image.tag | default .chartAppVersion) }}
+{{- end }}
+{{- end }}
+
+{{/*
+Renders a complete tree, even values that contains template.
+*/}}
+{{- define "external-secrets.render" -}}
+ {{- if typeIs "string" .value }}
+ {{- tpl .value .context }}
+ {{ else }}
+ {{- tpl (.value | toYaml) .context }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Return true if the OpenShift is the detected platform
+Usage:
+{{- include "external-secrets.isOpenShift" . -}}
+*/}}
+{{- define "external-secrets.isOpenShift" -}}
+{{- if .Capabilities.APIVersions.Has "security.openshift.io/v1" -}}
+{{- true -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Render the securityContext based on the provided securityContext
+ {{- include "external-secrets.renderSecurityContext" (dict "securityContext" .Values.securityContext "context" $) -}}
+*/}}
+{{- define "external-secrets.renderSecurityContext" -}}
+{{- $adaptedContext := .securityContext -}}
+{{- if .context.Values.global.compatibility -}}
+ {{- if .context.Values.global.compatibility.openshift -}}
+ {{- if or (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "force") (and (eq .context.Values.global.compatibility.openshift.adaptSecurityContext "auto") (include "external-secrets.isOpenShift" .context)) -}}
+ {{/* Remove OpenShift managed fields */}}
+ {{- $adaptedContext = omit $adaptedContext "fsGroup" "runAsUser" "runAsGroup" -}}
+ {{- if not .securityContext.seLinuxOptions -}}
+ {{- $adaptedContext = omit $adaptedContext "seLinuxOptions" -}}
+ {{- end -}}
+ {{- end -}}
+ {{- end -}}
+{{- end -}}
+{{- omit $adaptedContext "enabled" | toYaml -}}
+{{- end -}}
diff --git a/charts/external-secrets/templates/cert-controller-deployment.yaml b/charts/external-secrets/templates/cert-controller-deployment.yaml
new file mode 100644
index 0000000..a843f04
--- /dev/null
+++ b/charts/external-secrets/templates/cert-controller-deployment.yaml
@@ -0,0 +1,124 @@
+{{- if and .Values.certController.create (not .Values.webhook.certManager.enabled) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-cert-controller
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+ {{- with .Values.certController.deploymentAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ replicas: {{ .Values.certController.replicaCount }}
+ revisionHistoryLimit: {{ .Values.certController.revisionHistoryLimit }}
+ selector:
+ matchLabels:
+ {{- include "external-secrets-cert-controller.selectorLabels" . | nindent 6 }}
+ template:
+ metadata:
+ {{- with .Values.certController.podAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 8 }}
+ {{- with .Values.certController.podLabels }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ spec:
+ {{- with .Values.certController.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ serviceAccountName: {{ include "external-secrets-cert-controller.serviceAccountName" . }}
+ automountServiceAccountToken: {{ .Values.certController.serviceAccount.automount }}
+ {{- with .Values.certController.podSecurityContext }}
+ {{- if and (.enabled) (gt (keys . | len) 1) }}
+ securityContext:
+ {{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 8 }}
+ {{- end }}
+ {{- end }}
+ hostNetwork: {{ .Values.certController.hostNetwork }}
+ containers:
+ - name: cert-controller
+ {{- with .Values.certController.securityContext }}
+ {{- if and (.enabled) (gt (keys . | len) 1) }}
+ securityContext:
+ {{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ image: {{ include "external-secrets.image" (dict "chartAppVersion" .Chart.AppVersion "image" .Values.certController.image) | trim }}
+ imagePullPolicy: {{ .Values.certController.image.pullPolicy }}
+ args:
+ - certcontroller
+ - --crd-requeue-interval={{ .Values.certController.requeueInterval }}
+ - --service-name={{ include "external-secrets.fullname" . }}-webhook
+ - --service-namespace={{ template "external-secrets.namespace" . }}
+ - --secret-name={{ include "external-secrets.fullname" . }}-webhook
+ - --secret-namespace={{ template "external-secrets.namespace" . }}
+ - --metrics-addr=:{{ .Values.certController.metrics.listen.port }}
+ - --healthz-addr={{ .Values.certController.readinessProbe.address }}:{{ .Values.certController.readinessProbe.port }}
+ - --loglevel={{ .Values.certController.log.level }}
+ - --zap-time-encoding={{ .Values.certController.log.timeEncoding }}
+ {{- if not .Values.crds.createClusterSecretStore }}
+ - --crd-names=externalsecrets.external-secrets.io
+ - --crd-names=secretstores.external-secrets.io
+ {{- end }}
+ {{- if .Values.installCRDs }}
+ - --enable-partial-cache=true
+ {{- end }}
+ {{- range $key, $value := .Values.certController.extraArgs }}
+ {{- if $value }}
+ - --{{ $key }}={{ $value }}
+ {{- else }}
+ - --{{ $key }}
+ {{- end }}
+ {{- end }}
+ ports:
+ - containerPort: {{ .Values.certController.metrics.listen.port }}
+ protocol: TCP
+ name: metrics
+ readinessProbe:
+ httpGet:
+ port: {{ .Values.certController.readinessProbe.port }}
+ path: /readyz
+ initialDelaySeconds: 20
+ periodSeconds: 5
+ {{- with .Values.certController.extraEnv }}
+ env:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.certController.resources }}
+ resources:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- if .Values.certController.extraVolumeMounts }}
+ volumeMounts:
+ {{- toYaml .Values.certController.extraVolumeMounts | nindent 12 }}
+ {{- end }}
+ {{- if .Values.certController.extraVolumes }}
+ volumes:
+ {{- toYaml .Values.certController.extraVolumes | nindent 8 }}
+ {{- end }}
+ {{- with .Values.certController.nodeSelector | default .Values.global.nodeSelector }}
+ nodeSelector:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.certController.affinity | default .Values.global.affinity }}
+ affinity:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.certController.tolerations | default .Values.global.tolerations }}
+ tolerations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.certController.topologySpreadConstraints | default .Values.global.topologySpreadConstraints }}
+ topologySpreadConstraints:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if .Values.certController.priorityClassName }}
+ priorityClassName: {{ .Values.certController.priorityClassName }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/cert-controller-poddisruptionbudget.yaml b/charts/external-secrets/templates/cert-controller-poddisruptionbudget.yaml
new file mode 100644
index 0000000..e61cb8e
--- /dev/null
+++ b/charts/external-secrets/templates/cert-controller-poddisruptionbudget.yaml
@@ -0,0 +1,19 @@
+{{- if and .Values.certController.create .Values.certController.podDisruptionBudget.enabled (not .Values.webhook.certManager.enabled) }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-cert-controller-pdb
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+spec:
+ {{- if .Values.certController.podDisruptionBudget.minAvailable }}
+ minAvailable: {{ .Values.certController.podDisruptionBudget.minAvailable }}
+ {{- end }}
+ {{- if .Values.certController.podDisruptionBudget.maxUnavailable }}
+ maxUnavailable: {{ .Values.certController.podDisruptionBudget.maxUnavailable }}
+ {{- end }}
+ selector:
+ matchLabels:
+ {{- include "external-secrets-cert-controller.selectorLabels" . | nindent 6 }}
+{{- end }}
diff --git a/charts/external-secrets/templates/cert-controller-rbac.yaml b/charts/external-secrets/templates/cert-controller-rbac.yaml
new file mode 100644
index 0000000..84a0c11
--- /dev/null
+++ b/charts/external-secrets/templates/cert-controller-rbac.yaml
@@ -0,0 +1,86 @@
+{{- if and .Values.certController.create .Values.certController.rbac.create (not .Values.webhook.certManager.enabled) -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-cert-controller
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+rules:
+ - apiGroups:
+ - "apiextensions.k8s.io"
+ resources:
+ - "customresourcedefinitions"
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - "update"
+ - "patch"
+ - apiGroups:
+ - "admissionregistration.k8s.io"
+ resources:
+ - "validatingwebhookconfigurations"
+ verbs:
+ - "list"
+ - "watch"
+ - "get"
+ - apiGroups:
+ - "admissionregistration.k8s.io"
+ resources:
+ - "validatingwebhookconfigurations"
+ resourceNames:
+ - "secretstore-validate"
+ - "externalsecret-validate"
+ verbs:
+ - "update"
+ - "patch"
+ - apiGroups:
+ - ""
+ resources:
+ - "endpoints"
+ verbs:
+ - "list"
+ - "get"
+ - "watch"
+ - apiGroups:
+ - ""
+ resources:
+ - "events"
+ verbs:
+ - "create"
+ - "patch"
+ - apiGroups:
+ - ""
+ resources:
+ - "secrets"
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - "update"
+ - "patch"
+ - apiGroups:
+ - "coordination.k8s.io"
+ resources:
+ - "leases"
+ verbs:
+ - "get"
+ - "create"
+ - "update"
+ - "patch"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-cert-controller
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: {{ include "external-secrets.fullname" . }}-cert-controller
+subjects:
+ - name: {{ include "external-secrets-cert-controller.serviceAccountName" . }}
+ namespace: {{ template "external-secrets.namespace" . }}
+ kind: ServiceAccount
+{{- end }}
diff --git a/charts/external-secrets/templates/cert-controller-service.yaml b/charts/external-secrets/templates/cert-controller-service.yaml
new file mode 100644
index 0000000..2114915
--- /dev/null
+++ b/charts/external-secrets/templates/cert-controller-service.yaml
@@ -0,0 +1,28 @@
+{{- if and .Values.certController.create ( or .Values.certController.metrics.service.enabled ( and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled )) (not .Values.webhook.certManager.enabled) }}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-cert-controller-metrics
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+ {{- with .Values.metrics.service.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ type: ClusterIP
+ {{- if .Values.service.ipFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.service.ipFamilies }}
+ ipFamilies: {{ .Values.service.ipFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ ports:
+ - port: {{ .Values.certController.metrics.service.port }}
+ protocol: TCP
+ targetPort: metrics
+ name: metrics
+ selector:
+ {{- include "external-secrets-cert-controller.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/charts/external-secrets/templates/cert-controller-serviceaccount.yaml b/charts/external-secrets/templates/cert-controller-serviceaccount.yaml
new file mode 100644
index 0000000..6a36f9d
--- /dev/null
+++ b/charts/external-secrets/templates/cert-controller-serviceaccount.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.certController.create .Values.certController.serviceAccount.create (not .Values.webhook.certManager.enabled) -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ include "external-secrets-cert-controller.serviceAccountName" . }}
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+ {{- with .Values.certController.serviceAccount.extraLabels }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ {{- with .Values.certController.serviceAccount.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/acraccesstoken.yaml b/charts/external-secrets/templates/crds/acraccesstoken.yaml
new file mode 100644
index 0000000..3caae5c
--- /dev/null
+++ b/charts/external-secrets/templates/crds/acraccesstoken.yaml
@@ -0,0 +1,214 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: acraccesstokens.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: ACRAccessToken
+ listKind: ACRAccessTokenList
+ plural: acraccesstokens
+ singular: acraccesstoken
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ ACRAccessToken returns an Azure Container Registry token
+ that can be used for pushing/pulling images.
+ Note: by default it will return an ACR Refresh Token with full access
+ (depending on the identity).
+ This can be scoped down to the repository level using .spec.scope.
+ In case scope is defined it will return an ACR Access Token.
+
+ See docs: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: |-
+ ACRAccessTokenSpec defines how to generate the access token
+ e.g. how to authenticate and which registry to use.
+ see: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md#overview
+ properties:
+ auth:
+ properties:
+ managedIdentity:
+ description: ManagedIdentity uses Azure Managed Identity to authenticate with Azure.
+ properties:
+ identityId:
+ description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
+ type: string
+ type: object
+ servicePrincipal:
+ description: ServicePrincipal uses Azure Service Principal credentials to authenticate with Azure.
+ properties:
+ secretRef:
+ description: |-
+ Configuration used to authenticate with Azure using static
+ credentials stored in a Kind=Secret.
+ properties:
+ clientId:
+ description: The Azure clientId of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: The Azure ClientSecret of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ workloadIdentity:
+ description: WorkloadIdentity uses Azure Workload Identity to authenticate with Azure.
+ properties:
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: object
+ environmentType:
+ default: PublicCloud
+ description: |-
+ EnvironmentType specifies the Azure cloud environment endpoints to use for
+ connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
+ The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
+ PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
+ enum:
+ - PublicCloud
+ - USGovernmentCloud
+ - ChinaCloud
+ - GermanCloud
+ type: string
+ registry:
+ description: |-
+ the domain name of the ACR registry
+ e.g. foobarexample.azurecr.io
+ type: string
+ scope:
+ description: |-
+ Define the scope for the access token, e.g. pull/push access for a repository.
+ if not provided it will return a refresh token that has full scope.
+ Note: you need to pin it down to the repository level, there is no wildcard available.
+
+ examples:
+ repository:my-repository:pull,push
+ repository:my-repository:pull
+
+ see docs for details: https://docs.docker.com/registry/spec/auth/scope/
+ type: string
+ tenantId:
+ description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.
+ type: string
+ required:
+ - auth
+ - registry
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/clusterexternalsecret.yaml b/charts/external-secrets/templates/crds/clusterexternalsecret.yaml
new file mode 100644
index 0000000..33ecf1c
--- /dev/null
+++ b/charts/external-secrets/templates/crds/clusterexternalsecret.yaml
@@ -0,0 +1,1463 @@
+{{- if and (.Values.installCRDs) (.Values.crds.createClusterExternalSecret) }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: clusterexternalsecrets.external-secrets.io
+spec:
+ group: external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ kind: ClusterExternalSecret
+ listKind: ClusterExternalSecretList
+ plural: clusterexternalsecrets
+ shortNames:
+ - ces
+ singular: clusterexternalsecret
+ scope: Cluster
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .spec.externalSecretSpec.secretStoreRef.name
+ name: Store
+ type: string
+ - jsonPath: .spec.refreshTime
+ name: Refresh Interval
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: ClusterExternalSecret is the Schema for the clusterexternalsecrets API.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: ClusterExternalSecretSpec defines the desired state of ClusterExternalSecret.
+ properties:
+ externalSecretMetadata:
+ description: The metadata of the external secrets to be created
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ externalSecretName:
+ description: |-
+ The name of the external secrets to be created.
+ Defaults to the name of the ClusterExternalSecret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ externalSecretSpec:
+ description: The spec for the ExternalSecrets to be created
+ properties:
+ data:
+ description: Data defines the connection between the Kubernetes Secret keys and the Provider data
+ items:
+ description: ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.
+ properties:
+ remoteRef:
+ description: |-
+ RemoteRef points to the remote secret and defines
+ which secret (version/property/..) to fetch.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ secretKey:
+ description: The key in the Kubernetes Secret to store the value.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ sourceRef:
+ description: |-
+ SourceRef allows you to override the source
+ from which the value will be pulled.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: |-
+ GeneratorRef points to a generator custom resource.
+
+ Deprecated: The generatorRef is not implemented in .data[].
+ this will be removed with v1.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ required:
+ - remoteRef
+ - secretKey
+ type: object
+ type: array
+ dataFrom:
+ description: |-
+ DataFrom is used to fetch all properties from a specific Provider data
+ If multiple entries are specified, the Secret keys are merged in the specified order
+ items:
+ properties:
+ extract:
+ description: |-
+ Used to extract multiple key/value pairs from one secret
+ Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ find:
+ description: |-
+ Used to find secrets based on tags or regular expressions
+ Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ name:
+ description: Finds secrets based on the name.
+ properties:
+ regexp:
+ description: Finds secrets base
+ type: string
+ type: object
+ path:
+ description: A root path to start the find operations.
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: Find secrets based on tags.
+ type: object
+ type: object
+ rewrite:
+ description: |-
+ Used to rewrite secret Keys after getting them from the secret Provider
+ Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)
+ items:
+ properties:
+ regexp:
+ description: |-
+ Used to rewrite with regular expressions.
+ The resulting key will be the output of a regexp.ReplaceAll operation.
+ properties:
+ source:
+ description: Used to define the regular expression of a re.Compiler.
+ type: string
+ target:
+ description: Used to define the target pattern of a ReplaceAll operation.
+ type: string
+ required:
+ - source
+ - target
+ type: object
+ transform:
+ description: |-
+ Used to apply string transformation on the secrets.
+ The resulting key will be the output of the template applied by the operation.
+ properties:
+ template:
+ description: |-
+ Used to define the template to apply on the secret name.
+ `.value ` will specify the secret name in the template.
+ type: string
+ required:
+ - template
+ type: object
+ type: object
+ type: array
+ sourceRef:
+ description: |-
+ SourceRef points to a store or generator
+ which contains secret values ready to use.
+ Use this in combination with Extract or Find pull values out of
+ a specific SecretStore.
+ When sourceRef points to a generator Extract or Find is not supported.
+ The generator returns a static map of values
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: GeneratorRef points to a generator custom resource.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ type: object
+ type: array
+ refreshInterval:
+ default: 1h
+ description: |-
+ RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
+ specified as Golang Duration strings.
+ Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
+ Example values: "1h", "2h30m", "10s"
+ May be set to zero to fetch and create it once. Defaults to 1h.
+ type: string
+ refreshPolicy:
+ description: |-
+ RefreshPolicy determines how the ExternalSecret should be refreshed:
+ - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
+ - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
+ No periodic updates occur if refreshInterval is 0.
+ - OnChange: Only synchronizes the Secret when the ExternalSecret's metadata or specification changes
+ enum:
+ - CreatedOnce
+ - Periodic
+ - OnChange
+ type: string
+ secretStoreRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ target:
+ default:
+ creationPolicy: Owner
+ deletionPolicy: Retain
+ description: |-
+ ExternalSecretTarget defines the Kubernetes Secret to be created
+ There can be only one target per ExternalSecret.
+ properties:
+ creationPolicy:
+ default: Owner
+ description: |-
+ CreationPolicy defines rules on how to create the resulting Secret.
+ Defaults to "Owner"
+ enum:
+ - Owner
+ - Orphan
+ - Merge
+ - None
+ type: string
+ deletionPolicy:
+ default: Retain
+ description: |-
+ DeletionPolicy defines rules on how to delete the resulting Secret.
+ Defaults to "Retain"
+ enum:
+ - Delete
+ - Merge
+ - Retain
+ type: string
+ immutable:
+ description: Immutable defines if the final secret will be immutable
+ type: boolean
+ name:
+ description: |-
+ The name of the Secret resource to be managed.
+ Defaults to the .metadata.name of the ExternalSecret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ template:
+ description: Template defines a blueprint for the created Secret resource.
+ properties:
+ data:
+ additionalProperties:
+ type: string
+ type: object
+ engineVersion:
+ default: v2
+ description: |-
+ EngineVersion specifies the template engine version
+ that should be used to compile/execute the
+ template specified in .data and .templateFrom[].
+ enum:
+ - v2
+ type: string
+ mergePolicy:
+ default: Replace
+ enum:
+ - Replace
+ - Merge
+ type: string
+ metadata:
+ description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ templateFrom:
+ items:
+ properties:
+ configMap:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ literal:
+ type: string
+ secret:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ target:
+ default: Data
+ enum:
+ - Data
+ - Annotations
+ - Labels
+ type: string
+ type: object
+ type: array
+ type:
+ type: string
+ type: object
+ type: object
+ type: object
+ namespaceSelector:
+ description: |-
+ The labels to select by to find the Namespaces to create the ExternalSecrets in.
+ Deprecated: Use NamespaceSelectors instead.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaceSelectors:
+ description: A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.
+ items:
+ description: |-
+ A label selector is a label query over a set of resources. The result of matchLabels and
+ matchExpressions are ANDed. An empty label selector matches all objects. A null
+ label selector matches no objects.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ namespaces:
+ description: |-
+ Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
+ Deprecated: Use NamespaceSelectors instead.
+ items:
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: array
+ refreshTime:
+ description: The time in which the controller should reconcile its objects and recheck namespaces for labels.
+ type: string
+ required:
+ - externalSecretSpec
+ type: object
+ status:
+ description: ClusterExternalSecretStatus defines the observed state of ClusterExternalSecret.
+ properties:
+ conditions:
+ items:
+ properties:
+ message:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ externalSecretName:
+ description: ExternalSecretName is the name of the ExternalSecrets created by the ClusterExternalSecret
+ type: string
+ failedNamespaces:
+ description: Failed namespaces are the namespaces that failed to apply an ExternalSecret
+ items:
+ description: ClusterExternalSecretNamespaceFailure represents a failed namespace deployment and it's reason.
+ properties:
+ namespace:
+ description: Namespace is the namespace that failed when trying to apply an ExternalSecret
+ type: string
+ reason:
+ description: Reason is why the ExternalSecret failed to apply to the namespace
+ type: string
+ required:
+ - namespace
+ type: object
+ type: array
+ provisionedNamespaces:
+ description: ProvisionedNamespaces are the namespaces where the ClusterExternalSecret has secrets
+ items:
+ type: string
+ type: array
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+ - additionalPrinterColumns:
+ - jsonPath: .spec.externalSecretSpec.secretStoreRef.name
+ name: Store
+ type: string
+ - jsonPath: .spec.refreshTime
+ name: Refresh Interval
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: ClusterExternalSecret is the Schema for the clusterexternalsecrets API.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: ClusterExternalSecretSpec defines the desired state of ClusterExternalSecret.
+ properties:
+ externalSecretMetadata:
+ description: The metadata of the external secrets to be created
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ externalSecretName:
+ description: |-
+ The name of the external secrets to be created.
+ Defaults to the name of the ClusterExternalSecret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ externalSecretSpec:
+ description: The spec for the ExternalSecrets to be created
+ properties:
+ data:
+ description: Data defines the connection between the Kubernetes Secret keys and the Provider data
+ items:
+ description: ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.
+ properties:
+ remoteRef:
+ description: |-
+ RemoteRef points to the remote secret and defines
+ which secret (version/property/..) to fetch.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ secretKey:
+ description: The key in the Kubernetes Secret to store the value.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ sourceRef:
+ description: |-
+ SourceRef allows you to override the source
+ from which the value will be pulled.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: |-
+ GeneratorRef points to a generator custom resource.
+
+ Deprecated: The generatorRef is not implemented in .data[].
+ this will be removed with v1.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ required:
+ - remoteRef
+ - secretKey
+ type: object
+ type: array
+ dataFrom:
+ description: |-
+ DataFrom is used to fetch all properties from a specific Provider data
+ If multiple entries are specified, the Secret keys are merged in the specified order
+ items:
+ properties:
+ extract:
+ description: |-
+ Used to extract multiple key/value pairs from one secret
+ Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ find:
+ description: |-
+ Used to find secrets based on tags or regular expressions
+ Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ name:
+ description: Finds secrets based on the name.
+ properties:
+ regexp:
+ description: Finds secrets base
+ type: string
+ type: object
+ path:
+ description: A root path to start the find operations.
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: Find secrets based on tags.
+ type: object
+ type: object
+ rewrite:
+ description: |-
+ Used to rewrite secret Keys after getting them from the secret Provider
+ Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)
+ items:
+ properties:
+ regexp:
+ description: |-
+ Used to rewrite with regular expressions.
+ The resulting key will be the output of a regexp.ReplaceAll operation.
+ properties:
+ source:
+ description: Used to define the regular expression of a re.Compiler.
+ type: string
+ target:
+ description: Used to define the target pattern of a ReplaceAll operation.
+ type: string
+ required:
+ - source
+ - target
+ type: object
+ transform:
+ description: |-
+ Used to apply string transformation on the secrets.
+ The resulting key will be the output of the template applied by the operation.
+ properties:
+ template:
+ description: |-
+ Used to define the template to apply on the secret name.
+ `.value ` will specify the secret name in the template.
+ type: string
+ required:
+ - template
+ type: object
+ type: object
+ type: array
+ sourceRef:
+ description: |-
+ SourceRef points to a store or generator
+ which contains secret values ready to use.
+ Use this in combination with Extract or Find pull values out of
+ a specific SecretStore.
+ When sourceRef points to a generator Extract or Find is not supported.
+ The generator returns a static map of values
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: GeneratorRef points to a generator custom resource.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ type: object
+ type: array
+ refreshInterval:
+ default: 1h
+ description: |-
+ RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
+ specified as Golang Duration strings.
+ Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
+ Example values: "1h", "2h30m", "10s"
+ May be set to zero to fetch and create it once. Defaults to 1h.
+ type: string
+ refreshPolicy:
+ description: |-
+ RefreshPolicy determines how the ExternalSecret should be refreshed:
+ - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
+ - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
+ No periodic updates occur if refreshInterval is 0.
+ - OnChange: Only synchronizes the Secret when the ExternalSecret's metadata or specification changes
+ enum:
+ - CreatedOnce
+ - Periodic
+ - OnChange
+ type: string
+ secretStoreRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ target:
+ default:
+ creationPolicy: Owner
+ deletionPolicy: Retain
+ description: |-
+ ExternalSecretTarget defines the Kubernetes Secret to be created
+ There can be only one target per ExternalSecret.
+ properties:
+ creationPolicy:
+ default: Owner
+ description: |-
+ CreationPolicy defines rules on how to create the resulting Secret.
+ Defaults to "Owner"
+ enum:
+ - Owner
+ - Orphan
+ - Merge
+ - None
+ type: string
+ deletionPolicy:
+ default: Retain
+ description: |-
+ DeletionPolicy defines rules on how to delete the resulting Secret.
+ Defaults to "Retain"
+ enum:
+ - Delete
+ - Merge
+ - Retain
+ type: string
+ immutable:
+ description: Immutable defines if the final secret will be immutable
+ type: boolean
+ name:
+ description: |-
+ The name of the Secret resource to be managed.
+ Defaults to the .metadata.name of the ExternalSecret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ template:
+ description: Template defines a blueprint for the created Secret resource.
+ properties:
+ data:
+ additionalProperties:
+ type: string
+ type: object
+ engineVersion:
+ default: v2
+ description: |-
+ EngineVersion specifies the template engine version
+ that should be used to compile/execute the
+ template specified in .data and .templateFrom[].
+ enum:
+ - v2
+ type: string
+ mergePolicy:
+ default: Replace
+ enum:
+ - Replace
+ - Merge
+ type: string
+ metadata:
+ description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ templateFrom:
+ items:
+ properties:
+ configMap:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ literal:
+ type: string
+ secret:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ target:
+ default: Data
+ enum:
+ - Data
+ - Annotations
+ - Labels
+ type: string
+ type: object
+ type: array
+ type:
+ type: string
+ type: object
+ type: object
+ type: object
+ namespaceSelector:
+ description: |-
+ The labels to select by to find the Namespaces to create the ExternalSecrets in.
+ Deprecated: Use NamespaceSelectors instead.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaceSelectors:
+ description: A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.
+ items:
+ description: |-
+ A label selector is a label query over a set of resources. The result of matchLabels and
+ matchExpressions are ANDed. An empty label selector matches all objects. A null
+ label selector matches no objects.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ namespaces:
+ description: |-
+ Choose namespaces by name. This field is ORed with anything that NamespaceSelectors ends up choosing.
+ Deprecated: Use NamespaceSelectors instead.
+ items:
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: array
+ refreshTime:
+ description: The time in which the controller should reconcile its objects and recheck namespaces for labels.
+ type: string
+ required:
+ - externalSecretSpec
+ type: object
+ status:
+ description: ClusterExternalSecretStatus defines the observed state of ClusterExternalSecret.
+ properties:
+ conditions:
+ items:
+ properties:
+ message:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ externalSecretName:
+ description: ExternalSecretName is the name of the ExternalSecrets created by the ClusterExternalSecret
+ type: string
+ failedNamespaces:
+ description: Failed namespaces are the namespaces that failed to apply an ExternalSecret
+ items:
+ description: ClusterExternalSecretNamespaceFailure represents a failed namespace deployment and it's reason.
+ properties:
+ namespace:
+ description: Namespace is the namespace that failed when trying to apply an ExternalSecret
+ type: string
+ reason:
+ description: Reason is why the ExternalSecret failed to apply to the namespace
+ type: string
+ required:
+ - namespace
+ type: object
+ type: array
+ provisionedNamespaces:
+ description: ProvisionedNamespaces are the namespaces where the ClusterExternalSecret has secrets
+ items:
+ type: string
+ type: array
+ type: object
+ type: object
+ served: true
+ storage: false
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/clustergenerator.yaml b/charts/external-secrets/templates/crds/clustergenerator.yaml
new file mode 100644
index 0000000..a554443
--- /dev/null
+++ b/charts/external-secrets/templates/crds/clustergenerator.yaml
@@ -0,0 +1,1837 @@
+{{- if and (.Values.installCRDs) (.Values.crds.createClusterGenerator) }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: clustergenerators.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: ClusterGenerator
+ listKind: ClusterGeneratorList
+ plural: clustergenerators
+ singular: clustergenerator
+ scope: Cluster
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: ClusterGenerator represents a cluster-wide generator which can be referenced as part of `generatorRef` fields.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ generator:
+ description: Generator the spec for this generator, must match the kind.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ acrAccessTokenSpec:
+ description: |-
+ ACRAccessTokenSpec defines how to generate the access token
+ e.g. how to authenticate and which registry to use.
+ see: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md#overview
+ properties:
+ auth:
+ properties:
+ managedIdentity:
+ description: ManagedIdentity uses Azure Managed Identity to authenticate with Azure.
+ properties:
+ identityId:
+ description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
+ type: string
+ type: object
+ servicePrincipal:
+ description: ServicePrincipal uses Azure Service Principal credentials to authenticate with Azure.
+ properties:
+ secretRef:
+ description: |-
+ Configuration used to authenticate with Azure using static
+ credentials stored in a Kind=Secret.
+ properties:
+ clientId:
+ description: The Azure clientId of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: The Azure ClientSecret of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ workloadIdentity:
+ description: WorkloadIdentity uses Azure Workload Identity to authenticate with Azure.
+ properties:
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ type: object
+ environmentType:
+ default: PublicCloud
+ description: |-
+ EnvironmentType specifies the Azure cloud environment endpoints to use for
+ connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
+ The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
+ PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
+ enum:
+ - PublicCloud
+ - USGovernmentCloud
+ - ChinaCloud
+ - GermanCloud
+ type: string
+ registry:
+ description: |-
+ the domain name of the ACR registry
+ e.g. foobarexample.azurecr.io
+ type: string
+ scope:
+ description: |-
+ Define the scope for the access token, e.g. pull/push access for a repository.
+ if not provided it will return a refresh token that has full scope.
+ Note: you need to pin it down to the repository level, there is no wildcard available.
+
+ examples:
+ repository:my-repository:pull,push
+ repository:my-repository:pull
+
+ see docs for details: https://docs.docker.com/registry/spec/auth/scope/
+ type: string
+ tenantId:
+ description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.
+ type: string
+ required:
+ - auth
+ - registry
+ type: object
+ ecrAuthorizationTokenSpec:
+ properties:
+ auth:
+ description: Auth defines how to authenticate with AWS
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ region:
+ description: Region specifies the region to operate in.
+ type: string
+ role:
+ description: |-
+ You can assume a role before making calls to the
+ desired AWS service.
+ type: string
+ scope:
+ description: |-
+ Scope specifies the ECR service scope.
+ Valid options are private and public.
+ type: string
+ required:
+ - region
+ type: object
+ fakeSpec:
+ description: FakeSpec contains the static data.
+ properties:
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters VDS based on this property
+ type: string
+ data:
+ additionalProperties:
+ type: string
+ description: |-
+ Data defines the static data returned
+ by this generator.
+ type: object
+ type: object
+ gcrAccessTokenSpec:
+ properties:
+ auth:
+ description: Auth defines the means for authenticating with GCP
+ properties:
+ secretRef:
+ properties:
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ workloadIdentity:
+ properties:
+ clusterLocation:
+ type: string
+ clusterName:
+ type: string
+ clusterProjectID:
+ type: string
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - clusterLocation
+ - clusterName
+ - serviceAccountRef
+ type: object
+ type: object
+ projectID:
+ description: ProjectID defines which project to use to authenticate with
+ type: string
+ required:
+ - auth
+ - projectID
+ type: object
+ githubAccessTokenSpec:
+ properties:
+ appID:
+ type: string
+ auth:
+ description: Auth configures how ESO authenticates with a Github instance.
+ properties:
+ privateKey:
+ properties:
+ secretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - secretRef
+ type: object
+ required:
+ - privateKey
+ type: object
+ installID:
+ type: string
+ permissions:
+ additionalProperties:
+ type: string
+ description: Map of permissions the token will have. If omitted, defaults to all permissions the GitHub App has.
+ type: object
+ repositories:
+ description: |-
+ List of repositories the token will have access to. If omitted, defaults to all repositories the GitHub App
+ is installed to.
+ items:
+ type: string
+ type: array
+ url:
+ description: URL configures the Github instance URL. Defaults to https://github.com/.
+ type: string
+ required:
+ - appID
+ - auth
+ - installID
+ type: object
+ grafanaSpec:
+ description: GrafanaSpec controls the behavior of the grafana generator.
+ properties:
+ auth:
+ description: |-
+ Auth is the authentication configuration to authenticate
+ against the Grafana instance.
+ properties:
+ basic:
+ description: |-
+ Basic auth credentials used to authenticate against the Grafana instance.
+ Note: you need a token which has elevated permissions to create service accounts.
+ See here for the documentation on basic roles offered by Grafana:
+ https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+ properties:
+ password:
+ description: A basic auth password used to authenticate against the Grafana instance.
+ properties:
+ key:
+ description: The key where the token is found.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ username:
+ description: A basic auth username used to authenticate against the Grafana instance.
+ type: string
+ required:
+ - password
+ - username
+ type: object
+ token:
+ description: |-
+ A service account token used to authenticate against the Grafana instance.
+ Note: you need a token which has elevated permissions to create service accounts.
+ See here for the documentation on basic roles offered by Grafana:
+ https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+ properties:
+ key:
+ description: The key where the token is found.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ serviceAccount:
+ description: |-
+ ServiceAccount is the configuration for the service account that
+ is supposed to be generated by the generator.
+ properties:
+ name:
+ description: Name is the name of the service account that will be created by ESO.
+ type: string
+ role:
+ description: |-
+ Role is the role of the service account.
+ See here for the documentation on basic roles offered by Grafana:
+ https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+ type: string
+ required:
+ - name
+ - role
+ type: object
+ url:
+ description: URL is the URL of the Grafana instance.
+ type: string
+ required:
+ - auth
+ - serviceAccount
+ - url
+ type: object
+ passwordSpec:
+ description: PasswordSpec controls the behavior of the password generator.
+ properties:
+ allowRepeat:
+ default: false
+ description: set AllowRepeat to true to allow repeating characters.
+ type: boolean
+ digits:
+ description: |-
+ Digits specifies the number of digits in the generated
+ password. If omitted it defaults to 25% of the length of the password
+ type: integer
+ length:
+ default: 24
+ description: |-
+ Length of the password to be generated.
+ Defaults to 24
+ type: integer
+ noUpper:
+ default: false
+ description: Set NoUpper to disable uppercase characters
+ type: boolean
+ symbolCharacters:
+ description: |-
+ SymbolCharacters specifies the special characters that should be used
+ in the generated password.
+ type: string
+ symbols:
+ description: |-
+ Symbols specifies the number of symbol characters in the generated
+ password. If omitted it defaults to 25% of the length of the password
+ type: integer
+ required:
+ - allowRepeat
+ - length
+ - noUpper
+ type: object
+ quayAccessTokenSpec:
+ properties:
+ robotAccount:
+ description: Name of the robot account you are federating with
+ type: string
+ serviceAccountRef:
+ description: Name of the service account you are federating with
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: URL configures the Quay instance URL. Defaults to quay.io.
+ type: string
+ required:
+ - robotAccount
+ - serviceAccountRef
+ type: object
+ stsSessionTokenSpec:
+ properties:
+ auth:
+ description: Auth defines how to authenticate with AWS
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ region:
+ description: Region specifies the region to operate in.
+ type: string
+ requestParameters:
+ description: RequestParameters contains parameters that can be passed to the STS service.
+ properties:
+ serialNumber:
+ description: |-
+ SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making
+ the GetSessionToken call.
+ Possible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device
+ (such as arn:aws:iam::123456789012:mfa/user)
+ type: string
+ sessionDuration:
+ description: |-
+ SessionDuration The duration, in seconds, that the credentials should remain valid. Acceptable durations for
+ IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with 43,200 seconds
+ (12 hours) as the default.
+ format: int64
+ type: integer
+ tokenCode:
+ description: TokenCode is the value provided by the MFA device, if MFA is required.
+ type: string
+ type: object
+ role:
+ description: |-
+ You can assume a role before making calls to the
+ desired AWS service.
+ type: string
+ required:
+ - region
+ type: object
+ uuidSpec:
+ description: UUIDSpec controls the behavior of the uuid generator.
+ type: object
+ vaultDynamicSecretSpec:
+ properties:
+ allowEmptyResponse:
+ default: false
+ description: Do not fail if no secrets are found. Useful for requests where no data is expected.
+ type: boolean
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters VDS based on this property
+ type: string
+ method:
+ description: Vault API method to use (GET/POST/other)
+ type: string
+ parameters:
+ description: Parameters to pass to Vault write (for non-GET methods)
+ x-kubernetes-preserve-unknown-fields: true
+ path:
+ description: Vault path to obtain the dynamic secret from
+ type: string
+ provider:
+ description: Vault provider common spec
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ default: approle
+ description: |-
+ Path where the App Role authentication backend is mounted
+ in Vault, e.g: "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ roleRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role ID used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role id.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ - secretRef
+ type: object
+ cert:
+ description: |-
+ Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
+ Cert authentication method
+ properties:
+ clientCert:
+ description: |-
+ ClientCert is a certificate to authenticate using the Cert Vault
+ authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing client private key to
+ authenticate with Vault using the Cert authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ iam:
+ description: |-
+ Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
+ AWS IAM authentication method
+ properties:
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ jwt:
+ description: Specify a service account with IRSA enabled
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ path:
+ description: 'Path where the AWS auth method is enabled in Vault, e.g: "aws"'
+ type: string
+ region:
+ description: AWS region
+ type: string
+ role:
+ description: This is the AWS role to be assumed before talking to vault
+ type: string
+ secretRef:
+ description: Specify credentials in a Secret object
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ vaultAwsIamServerID:
+ description: 'X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws'
+ type: string
+ vaultRole:
+ description: Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine
+ type: string
+ required:
+ - vaultRole
+ type: object
+ jwt:
+ description: |-
+ Jwt authenticates with Vault by passing role and JWT token using the
+ JWT/OIDC authentication method
+ properties:
+ kubernetesServiceAccountToken:
+ description: |-
+ Optional ServiceAccountToken specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Optional audiences field that will be used to request a temporary Kubernetes service
+ account token for the service account referenced by `serviceAccountRef`.
+ Defaults to a single audience `vault` it not specified.
+ Deprecated: use serviceAccountRef.Audiences instead
+ items:
+ type: string
+ type: array
+ expirationSeconds:
+ description: |-
+ Optional expiration time in seconds that will be used to request a temporary
+ Kubernetes service account token for the service account referenced by
+ `serviceAccountRef`.
+ Deprecated: this will be removed in the future.
+ Defaults to 10 minutes.
+ format: int64
+ type: integer
+ serviceAccountRef:
+ description: Service account field containing the name of a kubernetes ServiceAccount.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ path:
+ default: jwt
+ description: |-
+ Path where the JWT authentication backend is mounted
+ in Vault, e.g: "jwt"
+ type: string
+ role:
+ description: |-
+ Role is a JWT role to authenticate using the JWT/OIDC Vault
+ authentication method
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Vault using the JWT/OIDC authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ default: kubernetes
+ description: |-
+ Path where the Kubernetes authentication backend is mounted in Vault, e.g:
+ "kubernetes"
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Vault. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - mountPath
+ - role
+ type: object
+ ldap:
+ description: |-
+ Ldap authenticates with Vault by passing username/password pair using
+ the LDAP authentication method
+ properties:
+ path:
+ default: ldap
+ description: |-
+ Path where the LDAP authentication backend is mounted
+ in Vault, e.g: "ldap"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the LDAP
+ user used to authenticate with Vault using the LDAP authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is an LDAP username used to authenticate using the LDAP Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
+ Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ This will default to Vault.Namespace field if set, or empty otherwise
+ type: string
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userPass:
+ description: UserPass authenticates with Vault by passing username/password pair
+ properties:
+ path:
+ default: userpass
+ description: |-
+ Path where the UserPassword authentication backend is mounted
+ in Vault, e.g: "userpass"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the
+ user used to authenticate with Vault using the UserPass authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is a username used to authenticate using the UserPass Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Vault server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Vault server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ forwardInconsistent:
+ description: |-
+ ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
+ leader instead of simply retrying within a loop. This can increase performance if
+ the option is enabled serverside.
+ https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
+ type: boolean
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers to be added in Vault request
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault KV backend endpoint, e.g:
+ "secret". The v2 KV secret engine version specific "/data" path suffix
+ for fetching secrets from Vault is optional and will be appended
+ if not present in specified path.
+ type: string
+ readYourWrites:
+ description: |-
+ ReadYourWrites ensures isolated read-after-write semantics by
+ providing discovered cluster replication states in each request.
+ More information about eventual consistency in Vault can be found here
+ https://www.vaultproject.io/docs/enterprise/consistency
+ type: boolean
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ tls:
+ description: |-
+ The configuration used for client side related TLS communication, when the Vault server
+ requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
+ This parameter is ignored for plain HTTP protocol connection.
+ It's worth noting this configuration is different from the "TLS certificates auth method",
+ which is available under the `auth.cert` section.
+ properties:
+ certSecretRef:
+ description: |-
+ CertSecretRef is a certificate added to the transport layer
+ when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.crt'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ keySecretRef:
+ description: |-
+ KeySecretRef to a key in a Secret resource containing client private key
+ added to the transport layer when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.key'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ version:
+ default: v2
+ description: |-
+ Version is the Vault KV secret engine version. This can be either "v1" or
+ "v2". Version defaults to "v2".
+ enum:
+ - v1
+ - v2
+ type: string
+ required:
+ - server
+ type: object
+ resultType:
+ default: Data
+ description: |-
+ Result type defines which data is returned from the generator.
+ By default it is the "data" section of the Vault API response.
+ When using e.g. /auth/token/create the "data" section is empty but
+ the "auth" section contains the generated token.
+ Please refer to the vault docs regarding the result data structure.
+ Additionally, accessing the raw response is possibly by using "Raw" result type.
+ enum:
+ - Data
+ - Auth
+ - Raw
+ type: string
+ retrySettings:
+ description: Used to configure http retries if failed
+ properties:
+ maxRetries:
+ format: int32
+ type: integer
+ retryInterval:
+ type: string
+ type: object
+ required:
+ - path
+ - provider
+ type: object
+ webhookSpec:
+ description: WebhookSpec controls the behavior of the external generator. Any body parameters should be passed to the server through the parameters field.
+ properties:
+ auth:
+ description: Auth specifies a authorization protocol. Only one protocol may be set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ ntlm:
+ description: NTLMProtocol configures the store to use NTLM for auth
+ properties:
+ passwordSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ usernameSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecret
+ - usernameSecret
+ type: object
+ type: object
+ body:
+ description: Body
+ type: string
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate webhook server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate webhook server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: The namespace the Provider type is in.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers
+ type: object
+ method:
+ description: Webhook Method
+ type: string
+ result:
+ description: Result formatting
+ properties:
+ jsonPath:
+ description: Json path of return value
+ type: string
+ type: object
+ secrets:
+ description: |-
+ Secrets to fill in templates
+ These secrets will be passed to the templating function as key value pairs under the given name
+ items:
+ properties:
+ name:
+ description: Name of this secret in templates
+ type: string
+ secretRef:
+ description: Secret ref to fill in credentials
+ properties:
+ key:
+ description: The key where the token is found.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ required:
+ - name
+ - secretRef
+ type: object
+ type: array
+ timeout:
+ description: Timeout
+ type: string
+ url:
+ description: Webhook url to call
+ type: string
+ required:
+ - result
+ - url
+ type: object
+ type: object
+ kind:
+ description: Kind the kind of this generator.
+ enum:
+ - ACRAccessToken
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ required:
+ - generator
+ - kind
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/clusterpushsecret.yaml b/charts/external-secrets/templates/crds/clusterpushsecret.yaml
new file mode 100644
index 0000000..93b39bf
--- /dev/null
+++ b/charts/external-secrets/templates/crds/clusterpushsecret.yaml
@@ -0,0 +1,523 @@
+{{- if and (.Values.installCRDs) (.Values.crds.createClusterPushSecret) }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: clusterpushsecrets.external-secrets.io
+spec:
+ group: external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ kind: ClusterPushSecret
+ listKind: ClusterPushSecretList
+ plural: clusterpushsecrets
+ singular: clusterpushsecret
+ scope: Cluster
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .metadata.creationTimestamp
+ name: AGE
+ type: date
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ namespaceSelectors:
+ description: A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.
+ items:
+ description: |-
+ A label selector is a label query over a set of resources. The result of matchLabels and
+ matchExpressions are ANDed. An empty label selector matches all objects. A null
+ label selector matches no objects.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: array
+ pushSecretMetadata:
+ description: The metadata of the external secrets to be created
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ pushSecretName:
+ description: |-
+ The name of the push secrets to be created.
+ Defaults to the name of the ClusterPushSecret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ pushSecretSpec:
+ description: PushSecretSpec defines what to do with the secrets.
+ properties:
+ data:
+ description: Secret Data that should be pushed to providers
+ items:
+ properties:
+ conversionStrategy:
+ default: None
+ description: Used to define a conversion Strategy for the secret keys
+ enum:
+ - None
+ - ReverseUnicode
+ type: string
+ match:
+ description: Match a given Secret Key to be pushed to the provider.
+ properties:
+ remoteRef:
+ description: Remote Refs to push to providers.
+ properties:
+ property:
+ description: Name of the property in the resulting secret
+ type: string
+ remoteKey:
+ description: Name of the resulting provider secret.
+ type: string
+ required:
+ - remoteKey
+ type: object
+ secretKey:
+ description: Secret Key to be pushed
+ type: string
+ required:
+ - remoteRef
+ type: object
+ metadata:
+ description: |-
+ Metadata is metadata attached to the secret.
+ The structure of metadata is provider specific, please look it up in the provider documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ required:
+ - match
+ type: object
+ type: array
+ deletionPolicy:
+ default: None
+ description: Deletion Policy to handle Secrets in the provider.
+ enum:
+ - Delete
+ - None
+ type: string
+ refreshInterval:
+ default: 1h
+ description: The Interval to which External Secrets will try to push a secret definition
+ type: string
+ secretStoreRefs:
+ items:
+ properties:
+ kind:
+ default: SecretStore
+ description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ labelSelector:
+ description: Optionally, sync to secret stores with label selector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ name:
+ description: Optionally, sync to the SecretStore of the given name
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: array
+ selector:
+ description: The Secret Selector (k8s source) for the Push Secret
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: Point to a generator to create a Secret.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ secret:
+ description: Select a Secret to Push.
+ properties:
+ name:
+ description: |-
+ Name of the Secret.
+ The Secret must exist in the same namespace as the PushSecret manifest.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ selector:
+ description: Selector chooses secrets using a labelSelector.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ type: object
+ template:
+ description: Template defines a blueprint for the created Secret resource.
+ properties:
+ data:
+ additionalProperties:
+ type: string
+ type: object
+ engineVersion:
+ default: v2
+ description: |-
+ EngineVersion specifies the template engine version
+ that should be used to compile/execute the
+ template specified in .data and .templateFrom[].
+ enum:
+ - v2
+ type: string
+ mergePolicy:
+ default: Replace
+ enum:
+ - Replace
+ - Merge
+ type: string
+ metadata:
+ description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ templateFrom:
+ items:
+ properties:
+ configMap:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ literal:
+ type: string
+ secret:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ target:
+ default: Data
+ enum:
+ - Data
+ - Annotations
+ - Labels
+ type: string
+ type: object
+ type: array
+ type:
+ type: string
+ type: object
+ updatePolicy:
+ default: Replace
+ description: UpdatePolicy to handle Secrets in the provider.
+ enum:
+ - Replace
+ - IfNotExists
+ type: string
+ required:
+ - secretStoreRefs
+ - selector
+ type: object
+ refreshTime:
+ description: The time in which the controller should reconcile its objects and recheck namespaces for labels.
+ type: string
+ required:
+ - pushSecretSpec
+ type: object
+ status:
+ properties:
+ conditions:
+ items:
+ description: PushSecretStatusCondition indicates the status of the PushSecret.
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ description: PushSecretConditionType indicates the condition of the PushSecret.
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ failedNamespaces:
+ description: Failed namespaces are the namespaces that failed to apply an PushSecret
+ items:
+ description: ClusterPushSecretNamespaceFailure represents a failed namespace deployment and it's reason.
+ properties:
+ namespace:
+ description: Namespace is the namespace that failed when trying to apply an PushSecret
+ type: string
+ reason:
+ description: Reason is why the PushSecret failed to apply to the namespace
+ type: string
+ required:
+ - namespace
+ type: object
+ type: array
+ provisionedNamespaces:
+ description: ProvisionedNamespaces are the namespaces where the ClusterPushSecret has secrets
+ items:
+ type: string
+ type: array
+ pushSecretName:
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/clustersecretstore.yaml b/charts/external-secrets/templates/crds/clustersecretstore.yaml
new file mode 100644
index 0000000..f9ed1b4
--- /dev/null
+++ b/charts/external-secrets/templates/crds/clustersecretstore.yaml
@@ -0,0 +1,8311 @@
+{{- if and (.Values.installCRDs) (.Values.crds.createClusterSecretStore) }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: clustersecretstores.external-secrets.io
+spec:
+ group: external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ kind: ClusterSecretStore
+ listKind: ClusterSecretStoreList
+ plural: clustersecretstores
+ shortNames:
+ - css
+ singular: clustersecretstore
+ scope: Cluster
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .metadata.creationTimestamp
+ name: AGE
+ type: date
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ - jsonPath: .status.capabilities
+ name: Capabilities
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of `storeRef` fields.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: SecretStoreSpec defines the desired state of SecretStore.
+ properties:
+ conditions:
+ description: Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore
+ items:
+ description: |-
+ ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in
+ for a ClusterSecretStore instance.
+ properties:
+ namespaceRegexes:
+ description: Choose namespaces by using regex matching
+ items:
+ type: string
+ type: array
+ namespaceSelector:
+ description: Choose namespace using a labelSelector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: Choose namespaces by name
+ items:
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: array
+ type: object
+ type: array
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters ES based on this property
+ type: string
+ provider:
+ description: Used to configure the provider. Only one provider may be set
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ akeyless:
+ description: Akeyless configures this store to sync secrets using Akeyless Vault provider
+ properties:
+ akeylessGWApiURL:
+ description: Akeyless GW API Url from which the secrets to be fetched from.
+ type: string
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Akeyless.
+ properties:
+ kubernetesAuth:
+ description: |-
+ Kubernetes authenticates with Akeyless by passing the ServiceAccount
+ token stored in the named Secret resource.
+ properties:
+ accessID:
+ description: the Akeyless Kubernetes auth-method access-id
+ type: string
+ k8sConfName:
+ description: Kubernetes-auth configuration name in Akeyless-Gateway
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Akeyless. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Akeyless. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - accessID
+ - k8sConfName
+ type: object
+ secretRef:
+ description: |-
+ Reference to a Secret that contains the details
+ to authenticate with Akeyless.
+ properties:
+ accessID:
+ description: The SecretAccessID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessType:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessTypeParam:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
+ if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Akeyless Gateway certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ required:
+ - akeylessGWApiURL
+ - authSecretRef
+ type: object
+ alibaba:
+ description: Alibaba configures this store to sync secrets using Alibaba Cloud provider
+ properties:
+ auth:
+ description: AlibabaAuth contains a secretRef for credentials.
+ properties:
+ rrsa:
+ description: Authenticate against Alibaba using RRSA.
+ properties:
+ oidcProviderArn:
+ type: string
+ oidcTokenFilePath:
+ type: string
+ roleArn:
+ type: string
+ sessionName:
+ type: string
+ required:
+ - oidcProviderArn
+ - oidcTokenFilePath
+ - roleArn
+ - sessionName
+ type: object
+ secretRef:
+ description: AlibabaAuthSecretRef holds secret references for Alibaba credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ regionID:
+ description: Alibaba Region to be used for the provider
+ type: string
+ required:
+ - auth
+ - regionID
+ type: object
+ aws:
+ description: AWS configures this store to sync secrets using AWS Secret Manager provider
+ properties:
+ additionalRoles:
+ description: AdditionalRoles is a chained list of Role ARNs which the provider will sequentially assume before assuming the Role
+ items:
+ type: string
+ type: array
+ auth:
+ description: |-
+ Auth defines the information necessary to authenticate against AWS
+ if not set aws sdk will infer credentials from your environment
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ prefix:
+ description: Prefix adds a prefix to all retrieved values.
+ type: string
+ region:
+ description: AWS Region to be used for the provider
+ type: string
+ role:
+ description: Role is a Role ARN which the provider will assume
+ type: string
+ secretsManager:
+ description: SecretsManager defines how the provider behaves when interacting with AWS SecretsManager
+ properties:
+ forceDeleteWithoutRecovery:
+ description: |-
+ Specifies whether to delete the secret without any recovery window. You
+ can't use both this parameter and RecoveryWindowInDays in the same call.
+ If you don't use either, then by default Secrets Manager uses a 30 day
+ recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery
+ type: boolean
+ recoveryWindowInDays:
+ description: |-
+ The number of days from 7 to 30 that Secrets Manager waits before
+ permanently deleting the secret. You can't use both this parameter and
+ ForceDeleteWithoutRecovery in the same call. If you don't use either,
+ then by default Secrets Manager uses a 30 day recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays
+ format: int64
+ type: integer
+ type: object
+ service:
+ description: Service defines which service should be used to fetch the secrets
+ enum:
+ - SecretsManager
+ - ParameterStore
+ type: string
+ sessionTags:
+ description: AWS STS assume role session tags
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ transitiveTagKeys:
+ description: AWS STS assume role transitive session tags. Required when multiple rules are used with the provider
+ items:
+ type: string
+ type: array
+ required:
+ - region
+ - service
+ type: object
+ azurekv:
+ description: AzureKV configures this store to sync secrets using Azure Key Vault provider
+ properties:
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ properties:
+ clientCertificate:
+ description: The Azure ClientCertificate of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientId:
+ description: The Azure clientId of the service principle or managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: The Azure ClientSecret of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ tenantId:
+ description: The Azure tenantId of the managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ authType:
+ default: ServicePrincipal
+ description: |-
+ Auth type defines how to authenticate to the keyvault service.
+ Valid values are:
+ - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret)
+ - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity)
+ enum:
+ - ServicePrincipal
+ - ManagedIdentity
+ - WorkloadIdentity
+ type: string
+ environmentType:
+ default: PublicCloud
+ description: |-
+ EnvironmentType specifies the Azure cloud environment endpoints to use for
+ connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
+ The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
+ PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
+ enum:
+ - PublicCloud
+ - USGovernmentCloud
+ - ChinaCloud
+ - GermanCloud
+ type: string
+ identityId:
+ description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ tenantId:
+ description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ type: string
+ vaultUrl:
+ description: Vault Url from which the secrets to be fetched from.
+ type: string
+ required:
+ - vaultUrl
+ type: object
+ beyondtrust:
+ description: Beyondtrust configures this store to sync secrets using Password Safe provider.
+ properties:
+ auth:
+ description: Auth configures how the operator authenticates with Beyondtrust.
+ properties:
+ apiKey:
+ description: APIKey If not provided then ClientID/ClientSecret become required.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificate:
+ description: Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificateKey:
+ description: Certificate private key (key.pem). For use when authenticating with an OAuth client Id
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientId:
+ description: ClientID is the API OAuth Client ID.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the API OAuth Client Secret.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ type: object
+ server:
+ description: Auth configures how API server works.
+ properties:
+ apiUrl:
+ type: string
+ apiVersion:
+ type: string
+ clientTimeOutSeconds:
+ description: Timeout specifies a time limit for requests made by this Client. The timeout includes connection time, any redirects, and reading the response body. Defaults to 45 seconds.
+ type: integer
+ retrievalType:
+ description: The secret retrieval type. SECRET = Secrets Safe (credential, text, file). MANAGED_ACCOUNT = Password Safe account associated with a system.
+ type: string
+ separator:
+ description: A character that separates the folder names.
+ type: string
+ verifyCA:
+ type: boolean
+ required:
+ - apiUrl
+ - verifyCA
+ type: object
+ required:
+ - auth
+ - server
+ type: object
+ bitwardensecretsmanager:
+ description: BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider
+ properties:
+ apiURL:
+ type: string
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with a bitwarden machine account instance.
+ Make sure that the token being used has permissions on the given secret.
+ properties:
+ secretRef:
+ description: BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.
+ properties:
+ credentials:
+ description: AccessToken used for the bitwarden instance.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - credentials
+ type: object
+ required:
+ - secretRef
+ type: object
+ bitwardenServerSDKURL:
+ type: string
+ caBundle:
+ description: |-
+ Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
+ can be performed.
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ identityURL:
+ type: string
+ organizationID:
+ description: OrganizationID determines which organization this secret store manages.
+ type: string
+ projectID:
+ description: ProjectID determines which project this secret store manages.
+ type: string
+ required:
+ - auth
+ - organizationID
+ - projectID
+ type: object
+ chef:
+ description: Chef configures this store to sync secrets with chef server
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against chef Server
+ properties:
+ secretRef:
+ description: ChefAuthSecretRef holds secret references for chef server login credentials.
+ properties:
+ privateKeySecretRef:
+ description: SecretKey is the Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKeySecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ serverUrl:
+ description: ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
+ type: string
+ username:
+ description: UserName should be the user ID on the chef server
+ type: string
+ required:
+ - auth
+ - serverUrl
+ - username
+ type: object
+ cloudrusm:
+ description: CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider
+ properties:
+ auth:
+ description: CSMAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: CSMAuthSecretRef holds secret references for Cloud.ru credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ projectID:
+ description: ProjectID is the project, which the secrets are stored in.
+ type: string
+ required:
+ - auth
+ type: object
+ conjur:
+ description: Conjur configures this store to sync secrets using conjur provider
+ properties:
+ auth:
+ description: Defines authentication settings for connecting to Conjur.
+ properties:
+ apikey:
+ description: Authenticates with Conjur using an API key.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ apiKeyRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur API key
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur username
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - account
+ - apiKeyRef
+ - userRef
+ type: object
+ jwt:
+ description: Jwt enables JWT authentication using Kubernetes service account tokens.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ hostId:
+ description: |-
+ Optional HostID for JWT authentication. This may be used depending
+ on how the Conjur JWT authenticator policy is configured.
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Conjur using the JWT authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional ServiceAccountRef specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ serviceID:
+ description: The conjur authn jwt webservice id
+ type: string
+ required:
+ - account
+ - serviceID
+ type: object
+ type: object
+ caBundle:
+ description: CABundle is a PEM encoded CA bundle that will be used to validate the Conjur server certificate.
+ type: string
+ caProvider:
+ description: |-
+ Used to provide custom certificate authority (CA) certificates
+ for a secret store. The CAProvider points to a Secret or ConfigMap resource
+ that contains a PEM-encoded certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ description: URL is the endpoint of the Conjur instance.
+ type: string
+ required:
+ - auth
+ - url
+ type: object
+ delinea:
+ description: |-
+ Delinea DevOps Secrets Vault
+ https://docs.delinea.com/online-help/products/devops-secrets-vault/current
+ properties:
+ clientId:
+ description: ClientID is the non-secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ tenant:
+ description: Tenant is the chosen hostname / site name.
+ type: string
+ tld:
+ description: |-
+ TLD is based on the server location that was chosen during provisioning.
+ If unset, defaults to "com".
+ type: string
+ urlTemplate:
+ description: |-
+ URLTemplate
+ If unset, defaults to "https://%s.secretsvaultcloud.%s/v1/%s%s".
+ type: string
+ required:
+ - clientId
+ - clientSecret
+ - tenant
+ type: object
+ device42:
+ description: Device42 configures this store to sync secrets using the Device42 provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Device42 instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ host:
+ description: URL configures the Device42 instance URL.
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ doppler:
+ description: Doppler configures this store to sync secrets using the Doppler provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Doppler API
+ properties:
+ secretRef:
+ properties:
+ dopplerToken:
+ description: |-
+ The DopplerToken is used for authentication.
+ See https://docs.doppler.com/reference/api#authentication for auth token types.
+ The Key attribute defaults to dopplerToken if not specified.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - dopplerToken
+ type: object
+ required:
+ - secretRef
+ type: object
+ config:
+ description: Doppler config (required if not using a Service Token)
+ type: string
+ format:
+ description: Format enables the downloading of secrets as a file (string)
+ enum:
+ - json
+ - dotnet-json
+ - env
+ - yaml
+ - docker
+ type: string
+ nameTransformer:
+ description: Environment variable compatible name transforms that change secret names to a different format
+ enum:
+ - upper-camel
+ - camel
+ - lower-snake
+ - tf-var
+ - dotnet-env
+ - lower-kebab
+ type: string
+ project:
+ description: Doppler project (required if not using a Service Token)
+ type: string
+ required:
+ - auth
+ type: object
+ fake:
+ description: Fake configures a store with static key/value pairs
+ properties:
+ data:
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ version:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ required:
+ - data
+ type: object
+ fortanix:
+ description: Fortanix configures this store to sync secrets using the Fortanix provider
+ properties:
+ apiKey:
+ description: APIKey is the API token to access SDKMS Applications.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the SDKMS API Key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ description: APIURL is the URL of SDKMS API. Defaults to `sdkms.fortanix.com`.
+ type: string
+ type: object
+ gcpsm:
+ description: GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against GCP
+ properties:
+ secretRef:
+ properties:
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ workloadIdentity:
+ properties:
+ clusterLocation:
+ description: |-
+ ClusterLocation is the location of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterName:
+ description: |-
+ ClusterName is the name of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterProjectID:
+ description: |-
+ ClusterProjectID is the project ID of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ type: object
+ location:
+ description: Location optionally defines a location for a secret
+ type: string
+ projectID:
+ description: ProjectID project where secret is located
+ type: string
+ type: object
+ github:
+ description: Github configures this store to push Github Action secrets using Github API provider
+ properties:
+ appID:
+ description: appID specifies the Github APP that will be used to authenticate the client
+ format: int64
+ type: integer
+ auth:
+ description: auth configures how secret-manager authenticates with a Github instance.
+ properties:
+ privateKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKey
+ type: object
+ environment:
+ description: environment will be used to fetch secrets from a particular environment within a github repository
+ type: string
+ installationID:
+ description: installationID specifies the Github APP installation that will be used to authenticate the client
+ format: int64
+ type: integer
+ organization:
+ description: organization will be used to fetch secrets from the Github organization
+ type: string
+ repository:
+ description: repository will be used to fetch secrets from the Github repository within an organization
+ type: string
+ uploadURL:
+ description: Upload URL for enterprise instances. Default to URL.
+ type: string
+ url:
+ default: https://github.com/
+ description: URL configures the Github instance URL. Defaults to https://github.com/.
+ type: string
+ required:
+ - appID
+ - auth
+ - installationID
+ - organization
+ type: object
+ gitlab:
+ description: GitLab configures this store to sync secrets using GitLab Variables provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a GitLab instance.
+ properties:
+ SecretRef:
+ properties:
+ accessToken:
+ description: AccessToken is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - SecretRef
+ type: object
+ environment:
+ description: Environment environment_scope of gitlab CI/CD variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment on how to create environments)
+ type: string
+ groupIDs:
+ description: GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables.
+ items:
+ type: string
+ type: array
+ inheritFromGroups:
+ description: InheritFromGroups specifies whether parent groups should be discovered and checked for secrets.
+ type: boolean
+ projectID:
+ description: ProjectID specifies a project where secrets are located.
+ type: string
+ url:
+ description: URL configures the GitLab instance URL. Defaults to https://gitlab.com/.
+ type: string
+ required:
+ - auth
+ type: object
+ ibm:
+ description: IBM configures this store to sync secrets using IBM Cloud provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the IBM secrets manager.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ containerAuth:
+ description: IBM Container-based auth with IAM Trusted Profile.
+ properties:
+ iamEndpoint:
+ type: string
+ profile:
+ description: the IBM Trusted Profile
+ type: string
+ tokenLocation:
+ description: Location the token is mounted on the pod
+ type: string
+ required:
+ - profile
+ type: object
+ secretRef:
+ properties:
+ secretApiKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ serviceUrl:
+ description: ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance
+ type: string
+ required:
+ - auth
+ type: object
+ infisical:
+ description: Infisical configures this store to sync secrets using the Infisical provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Infisical API
+ properties:
+ universalAuthCredentials:
+ properties:
+ clientId:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecret
+ type: object
+ type: object
+ hostAPI:
+ default: https://app.infisical.com/api
+ description: HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
+ type: string
+ secretsScope:
+ description: SecretsScope defines the scope of the secrets within the workspace
+ properties:
+ environmentSlug:
+ description: EnvironmentSlug is the required slug identifier for the environment.
+ type: string
+ expandSecretReferences:
+ default: true
+ description: ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+ type: boolean
+ projectSlug:
+ description: ProjectSlug is the required slug identifier for the project.
+ type: string
+ recursive:
+ default: false
+ description: Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
+ type: boolean
+ secretsPath:
+ default: /
+ description: SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
+ type: string
+ required:
+ - environmentSlug
+ - projectSlug
+ type: object
+ required:
+ - auth
+ - secretsScope
+ type: object
+ keepersecurity:
+ description: KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider
+ properties:
+ authRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ folderID:
+ type: string
+ required:
+ - authRef
+ - folderID
+ type: object
+ kubernetes:
+ description: Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Kubernetes instance.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ cert:
+ description: has both clientCert and clientKey as secretKeySelector
+ properties:
+ clientCert:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ serviceAccount:
+ description: points to a service account that should be used for authentication
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ token:
+ description: use static token to authenticate with
+ properties:
+ bearerToken:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ authRef:
+ description: A reference to a secret that contains the auth information.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ remoteNamespace:
+ default: default
+ description: Remote namespace to fetch the secrets from
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ server:
+ description: configures the Kubernetes server Address.
+ properties:
+ caBundle:
+ description: CABundle is a base64-encoded CA certificate
+ format: byte
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ default: kubernetes.default
+ description: configures the Kubernetes server Address.
+ type: string
+ type: object
+ type: object
+ onboardbase:
+ description: Onboardbase configures this store to sync secrets using the Onboardbase provider
+ properties:
+ apiHost:
+ default: https://public.onboardbase.com/api/v1/
+ description: APIHost use this to configure the host url for the API for selfhosted installation, default is https://public.onboardbase.com/api/v1/
+ type: string
+ auth:
+ description: Auth configures how the Operator authenticates with the Onboardbase API
+ properties:
+ apiKeyRef:
+ description: |-
+ OnboardbaseAPIKey is the APIKey generated by an admin account.
+ It is used to recognize and authorize access to a project and environment within onboardbase
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ passcodeRef:
+ description: OnboardbasePasscode is the passcode attached to the API Key
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - apiKeyRef
+ - passcodeRef
+ type: object
+ environment:
+ default: development
+ description: Environment is the name of an environmnent within a project to pull the secrets from
+ type: string
+ project:
+ default: development
+ description: Project is an onboardbase project that the secrets should be pulled from
+ type: string
+ required:
+ - apiHost
+ - auth
+ - environment
+ - project
+ type: object
+ onepassword:
+ description: OnePassword configures this store to sync secrets using the 1Password Cloud provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against OnePassword Connect Server
+ properties:
+ secretRef:
+ description: OnePasswordAuthSecretRef holds secret references for 1Password credentials.
+ properties:
+ connectTokenSecretRef:
+ description: The ConnectToken is used for authentication to a 1Password Connect Server.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - connectTokenSecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ connectHost:
+ description: ConnectHost defines the OnePassword Connect Server to connect to
+ type: string
+ vaults:
+ additionalProperties:
+ type: integer
+ description: Vaults defines which OnePassword vaults to search in which order
+ type: object
+ required:
+ - auth
+ - connectHost
+ - vaults
+ type: object
+ oracle:
+ description: Oracle configures this store to sync secrets using Oracle Vault provider
+ properties:
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with the Oracle Vault.
+ If empty, use the instance principal, otherwise the user credentials specified in Auth.
+ properties:
+ secretRef:
+ description: SecretRef to pass through sensitive information.
+ properties:
+ fingerprint:
+ description: Fingerprint is the fingerprint of the API private key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privatekey:
+ description: PrivateKey is the user's API Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - fingerprint
+ - privatekey
+ type: object
+ tenancy:
+ description: Tenancy is the tenancy OCID where user is located.
+ type: string
+ user:
+ description: User is an access OCID specific to the account.
+ type: string
+ required:
+ - secretRef
+ - tenancy
+ - user
+ type: object
+ compartment:
+ description: |-
+ Compartment is the vault compartment OCID.
+ Required for PushSecret
+ type: string
+ encryptionKey:
+ description: |-
+ EncryptionKey is the OCID of the encryption key within the vault.
+ Required for PushSecret
+ type: string
+ principalType:
+ description: |-
+ The type of principal to use for authentication. If left blank, the Auth struct will
+ determine the principal type. This optional field must be specified if using
+ workload identity.
+ enum:
+ - ""
+ - UserPrincipal
+ - InstancePrincipal
+ - Workload
+ type: string
+ region:
+ description: Region is the region where vault is located.
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ vault:
+ description: Vault is the vault's OCID of the specific vault where secret is located.
+ type: string
+ required:
+ - region
+ - vault
+ type: object
+ passbolt:
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against Passbolt Server
+ properties:
+ passwordSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privateKeySecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecretRef
+ - privateKeySecretRef
+ type: object
+ host:
+ description: Host defines the Passbolt Server to connect to
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ passworddepot:
+ description: Configures a store to sync secrets with a Password Depot instance.
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Password Depot instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ database:
+ description: Database to use as source
+ type: string
+ host:
+ description: URL configures the Password Depot instance URL.
+ type: string
+ required:
+ - auth
+ - database
+ - host
+ type: object
+ previder:
+ description: Previder configures this store to sync secrets using the Previder provider
+ properties:
+ auth:
+ description: PreviderAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: PreviderAuthSecretRef holds secret references for Previder Vault credentials.
+ properties:
+ accessToken:
+ description: The AccessToken is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessToken
+ type: object
+ type: object
+ baseUri:
+ type: string
+ required:
+ - auth
+ type: object
+ pulumi:
+ description: Pulumi configures this store to sync secrets using the Pulumi provider
+ properties:
+ accessToken:
+ description: AccessToken is the access tokens to sign in to the Pulumi Cloud Console.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the Pulumi API token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ default: https://api.pulumi.com/api/esc
+ description: APIURL is the URL of the Pulumi API.
+ type: string
+ environment:
+ description: |-
+ Environment are YAML documents composed of static key-value pairs, programmatic expressions,
+ dynamically retrieved values from supported providers including all major clouds,
+ and other Pulumi ESC environments.
+ To create a new environment, visit https://www.pulumi.com/docs/esc/environments/ for more information.
+ type: string
+ organization:
+ description: |-
+ Organization are a space to collaborate on shared projects and stacks.
+ To create a new organization, visit https://app.pulumi.com/ and click "New Organization".
+ type: string
+ project:
+ description: Project is the name of the Pulumi ESC project the environment belongs to.
+ type: string
+ required:
+ - accessToken
+ - environment
+ - organization
+ - project
+ type: object
+ scaleway:
+ description: Scaleway
+ properties:
+ accessKey:
+ description: AccessKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ apiUrl:
+ description: APIURL is the url of the api to use. Defaults to https://api.scaleway.com
+ type: string
+ projectId:
+ description: 'ProjectID is the id of your project, which you can find in the console: https://console.scaleway.com/project/settings'
+ type: string
+ region:
+ description: 'Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone'
+ type: string
+ secretKey:
+ description: SecretKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - accessKey
+ - projectId
+ - region
+ - secretKey
+ type: object
+ secretserver:
+ description: |-
+ SecretServer configures this store to sync secrets using SecretServer provider
+ https://docs.delinea.com/online-help/secret-server/start.htm
+ properties:
+ password:
+ description: Password is the secret server account password.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ serverURL:
+ description: |-
+ ServerURL
+ URL to your secret server installation
+ type: string
+ username:
+ description: Username is the secret server account username.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - password
+ - serverURL
+ - username
+ type: object
+ senhasegura:
+ description: Senhasegura configures this store to sync secrets using senhasegura provider
+ properties:
+ auth:
+ description: Auth defines parameters to authenticate in senhasegura
+ properties:
+ clientId:
+ type: string
+ clientSecretSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecretSecretRef
+ type: object
+ ignoreSslCertificate:
+ default: false
+ description: IgnoreSslCertificate defines if SSL certificate must be ignored
+ type: boolean
+ module:
+ description: Module defines which senhasegura module should be used to get secrets
+ type: string
+ url:
+ description: URL of senhasegura
+ type: string
+ required:
+ - auth
+ - module
+ - url
+ type: object
+ vault:
+ description: Vault configures this store to sync secrets using Hashi provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ default: approle
+ description: |-
+ Path where the App Role authentication backend is mounted
+ in Vault, e.g: "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ roleRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role ID used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role id.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ - secretRef
+ type: object
+ cert:
+ description: |-
+ Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
+ Cert authentication method
+ properties:
+ clientCert:
+ description: |-
+ ClientCert is a certificate to authenticate using the Cert Vault
+ authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing client private key to
+ authenticate with Vault using the Cert authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ iam:
+ description: |-
+ Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
+ AWS IAM authentication method
+ properties:
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ jwt:
+ description: Specify a service account with IRSA enabled
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ path:
+ description: 'Path where the AWS auth method is enabled in Vault, e.g: "aws"'
+ type: string
+ region:
+ description: AWS region
+ type: string
+ role:
+ description: This is the AWS role to be assumed before talking to vault
+ type: string
+ secretRef:
+ description: Specify credentials in a Secret object
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ vaultAwsIamServerID:
+ description: 'X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws'
+ type: string
+ vaultRole:
+ description: Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine
+ type: string
+ required:
+ - vaultRole
+ type: object
+ jwt:
+ description: |-
+ Jwt authenticates with Vault by passing role and JWT token using the
+ JWT/OIDC authentication method
+ properties:
+ kubernetesServiceAccountToken:
+ description: |-
+ Optional ServiceAccountToken specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Optional audiences field that will be used to request a temporary Kubernetes service
+ account token for the service account referenced by `serviceAccountRef`.
+ Defaults to a single audience `vault` it not specified.
+ Deprecated: use serviceAccountRef.Audiences instead
+ items:
+ type: string
+ type: array
+ expirationSeconds:
+ description: |-
+ Optional expiration time in seconds that will be used to request a temporary
+ Kubernetes service account token for the service account referenced by
+ `serviceAccountRef`.
+ Deprecated: this will be removed in the future.
+ Defaults to 10 minutes.
+ format: int64
+ type: integer
+ serviceAccountRef:
+ description: Service account field containing the name of a kubernetes ServiceAccount.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ path:
+ default: jwt
+ description: |-
+ Path where the JWT authentication backend is mounted
+ in Vault, e.g: "jwt"
+ type: string
+ role:
+ description: |-
+ Role is a JWT role to authenticate using the JWT/OIDC Vault
+ authentication method
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Vault using the JWT/OIDC authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ default: kubernetes
+ description: |-
+ Path where the Kubernetes authentication backend is mounted in Vault, e.g:
+ "kubernetes"
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Vault. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - mountPath
+ - role
+ type: object
+ ldap:
+ description: |-
+ Ldap authenticates with Vault by passing username/password pair using
+ the LDAP authentication method
+ properties:
+ path:
+ default: ldap
+ description: |-
+ Path where the LDAP authentication backend is mounted
+ in Vault, e.g: "ldap"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the LDAP
+ user used to authenticate with Vault using the LDAP authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is an LDAP username used to authenticate using the LDAP Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
+ Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ This will default to Vault.Namespace field if set, or empty otherwise
+ type: string
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userPass:
+ description: UserPass authenticates with Vault by passing username/password pair
+ properties:
+ path:
+ default: userpass
+ description: |-
+ Path where the UserPassword authentication backend is mounted
+ in Vault, e.g: "userpass"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the
+ user used to authenticate with Vault using the UserPass authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is a username used to authenticate using the UserPass Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Vault server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Vault server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ forwardInconsistent:
+ description: |-
+ ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
+ leader instead of simply retrying within a loop. This can increase performance if
+ the option is enabled serverside.
+ https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
+ type: boolean
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers to be added in Vault request
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault KV backend endpoint, e.g:
+ "secret". The v2 KV secret engine version specific "/data" path suffix
+ for fetching secrets from Vault is optional and will be appended
+ if not present in specified path.
+ type: string
+ readYourWrites:
+ description: |-
+ ReadYourWrites ensures isolated read-after-write semantics by
+ providing discovered cluster replication states in each request.
+ More information about eventual consistency in Vault can be found here
+ https://www.vaultproject.io/docs/enterprise/consistency
+ type: boolean
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ tls:
+ description: |-
+ The configuration used for client side related TLS communication, when the Vault server
+ requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
+ This parameter is ignored for plain HTTP protocol connection.
+ It's worth noting this configuration is different from the "TLS certificates auth method",
+ which is available under the `auth.cert` section.
+ properties:
+ certSecretRef:
+ description: |-
+ CertSecretRef is a certificate added to the transport layer
+ when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.crt'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ keySecretRef:
+ description: |-
+ KeySecretRef to a key in a Secret resource containing client private key
+ added to the transport layer when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.key'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ version:
+ default: v2
+ description: |-
+ Version is the Vault KV secret engine version. This can be either "v1" or
+ "v2". Version defaults to "v2".
+ enum:
+ - v1
+ - v2
+ type: string
+ required:
+ - server
+ type: object
+ webhook:
+ description: Webhook configures this store to sync secrets using a generic templated webhook
+ properties:
+ auth:
+ description: Auth specifies a authorization protocol. Only one protocol may be set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ ntlm:
+ description: NTLMProtocol configures the store to use NTLM for auth
+ properties:
+ passwordSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ usernameSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecret
+ - usernameSecret
+ type: object
+ type: object
+ body:
+ description: Body
+ type: string
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate webhook server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate webhook server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: The namespace the Provider type is in.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers
+ type: object
+ method:
+ description: Webhook Method
+ type: string
+ result:
+ description: Result formatting
+ properties:
+ jsonPath:
+ description: Json path of return value
+ type: string
+ type: object
+ secrets:
+ description: |-
+ Secrets to fill in templates
+ These secrets will be passed to the templating function as key value pairs under the given name
+ items:
+ properties:
+ name:
+ description: Name of this secret in templates
+ type: string
+ secretRef:
+ description: Secret ref to fill in credentials
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - name
+ - secretRef
+ type: object
+ type: array
+ timeout:
+ description: Timeout
+ type: string
+ url:
+ description: Webhook url to call
+ type: string
+ required:
+ - result
+ - url
+ type: object
+ yandexcertificatemanager:
+ description: YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Certificate Manager
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ yandexlockbox:
+ description: YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Lockbox
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ type: object
+ refreshInterval:
+ description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.
+ type: integer
+ retrySettings:
+ description: Used to configure http retries if failed
+ properties:
+ maxRetries:
+ format: int32
+ type: integer
+ retryInterval:
+ type: string
+ type: object
+ required:
+ - provider
+ type: object
+ status:
+ description: SecretStoreStatus defines the observed state of the SecretStore.
+ properties:
+ capabilities:
+ description: SecretStoreCapabilities defines the possible operations a SecretStore can do.
+ type: string
+ conditions:
+ items:
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+ - additionalPrinterColumns:
+ - jsonPath: .metadata.creationTimestamp
+ name: AGE
+ type: date
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ - jsonPath: .status.capabilities
+ name: Capabilities
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of `storeRef` fields.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: SecretStoreSpec defines the desired state of SecretStore.
+ properties:
+ conditions:
+ description: Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore
+ items:
+ description: |-
+ ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in
+ for a ClusterSecretStore instance.
+ properties:
+ namespaceRegexes:
+ description: Choose namespaces by using regex matching
+ items:
+ type: string
+ type: array
+ namespaceSelector:
+ description: Choose namespace using a labelSelector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: Choose namespaces by name
+ items:
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: array
+ type: object
+ type: array
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters ES based on this property
+ type: string
+ provider:
+ description: Used to configure the provider. Only one provider may be set
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ akeyless:
+ description: Akeyless configures this store to sync secrets using Akeyless Vault provider
+ properties:
+ akeylessGWApiURL:
+ description: Akeyless GW API Url from which the secrets to be fetched from.
+ type: string
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Akeyless.
+ properties:
+ kubernetesAuth:
+ description: |-
+ Kubernetes authenticates with Akeyless by passing the ServiceAccount
+ token stored in the named Secret resource.
+ properties:
+ accessID:
+ description: the Akeyless Kubernetes auth-method access-id
+ type: string
+ k8sConfName:
+ description: Kubernetes-auth configuration name in Akeyless-Gateway
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Akeyless. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Akeyless. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - accessID
+ - k8sConfName
+ type: object
+ secretRef:
+ description: |-
+ Reference to a Secret that contains the details
+ to authenticate with Akeyless.
+ properties:
+ accessID:
+ description: The SecretAccessID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessType:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessTypeParam:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
+ if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Akeyless Gateway certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ required:
+ - akeylessGWApiURL
+ - authSecretRef
+ type: object
+ alibaba:
+ description: Alibaba configures this store to sync secrets using Alibaba Cloud provider
+ properties:
+ auth:
+ description: AlibabaAuth contains a secretRef for credentials.
+ properties:
+ rrsa:
+ description: Authenticate against Alibaba using RRSA.
+ properties:
+ oidcProviderArn:
+ type: string
+ oidcTokenFilePath:
+ type: string
+ roleArn:
+ type: string
+ sessionName:
+ type: string
+ required:
+ - oidcProviderArn
+ - oidcTokenFilePath
+ - roleArn
+ - sessionName
+ type: object
+ secretRef:
+ description: AlibabaAuthSecretRef holds secret references for Alibaba credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ regionID:
+ description: Alibaba Region to be used for the provider
+ type: string
+ required:
+ - auth
+ - regionID
+ type: object
+ aws:
+ description: AWS configures this store to sync secrets using AWS Secret Manager provider
+ properties:
+ additionalRoles:
+ description: AdditionalRoles is a chained list of Role ARNs which the provider will sequentially assume before assuming the Role
+ items:
+ type: string
+ type: array
+ auth:
+ description: |-
+ Auth defines the information necessary to authenticate against AWS
+ if not set aws sdk will infer credentials from your environment
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ prefix:
+ description: Prefix adds a prefix to all retrieved values.
+ type: string
+ region:
+ description: AWS Region to be used for the provider
+ type: string
+ role:
+ description: Role is a Role ARN which the provider will assume
+ type: string
+ secretsManager:
+ description: SecretsManager defines how the provider behaves when interacting with AWS SecretsManager
+ properties:
+ forceDeleteWithoutRecovery:
+ description: |-
+ Specifies whether to delete the secret without any recovery window. You
+ can't use both this parameter and RecoveryWindowInDays in the same call.
+ If you don't use either, then by default Secrets Manager uses a 30 day
+ recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery
+ type: boolean
+ recoveryWindowInDays:
+ description: |-
+ The number of days from 7 to 30 that Secrets Manager waits before
+ permanently deleting the secret. You can't use both this parameter and
+ ForceDeleteWithoutRecovery in the same call. If you don't use either,
+ then by default Secrets Manager uses a 30 day recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays
+ format: int64
+ type: integer
+ type: object
+ service:
+ description: Service defines which service should be used to fetch the secrets
+ enum:
+ - SecretsManager
+ - ParameterStore
+ type: string
+ sessionTags:
+ description: AWS STS assume role session tags
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ transitiveTagKeys:
+ description: AWS STS assume role transitive session tags. Required when multiple rules are used with the provider
+ items:
+ type: string
+ type: array
+ required:
+ - region
+ - service
+ type: object
+ azurekv:
+ description: AzureKV configures this store to sync secrets using Azure Key Vault provider
+ properties:
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ properties:
+ clientCertificate:
+ description: The Azure ClientCertificate of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientId:
+ description: The Azure clientId of the service principle or managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: The Azure ClientSecret of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ tenantId:
+ description: The Azure tenantId of the managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ authType:
+ default: ServicePrincipal
+ description: |-
+ Auth type defines how to authenticate to the keyvault service.
+ Valid values are:
+ - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret)
+ - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity)
+ enum:
+ - ServicePrincipal
+ - ManagedIdentity
+ - WorkloadIdentity
+ type: string
+ environmentType:
+ default: PublicCloud
+ description: |-
+ EnvironmentType specifies the Azure cloud environment endpoints to use for
+ connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
+ The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
+ PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
+ enum:
+ - PublicCloud
+ - USGovernmentCloud
+ - ChinaCloud
+ - GermanCloud
+ type: string
+ identityId:
+ description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ tenantId:
+ description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ type: string
+ vaultUrl:
+ description: Vault Url from which the secrets to be fetched from.
+ type: string
+ required:
+ - vaultUrl
+ type: object
+ beyondtrust:
+ description: Beyondtrust configures this store to sync secrets using Password Safe provider.
+ properties:
+ auth:
+ description: Auth configures how the operator authenticates with Beyondtrust.
+ properties:
+ apiKey:
+ description: APIKey If not provided then ClientID/ClientSecret become required.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificate:
+ description: Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificateKey:
+ description: Certificate private key (key.pem). For use when authenticating with an OAuth client Id
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientId:
+ description: ClientID is the API OAuth Client ID.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the API OAuth Client Secret.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ type: object
+ server:
+ description: Auth configures how API server works.
+ properties:
+ apiUrl:
+ type: string
+ apiVersion:
+ type: string
+ clientTimeOutSeconds:
+ description: Timeout specifies a time limit for requests made by this Client. The timeout includes connection time, any redirects, and reading the response body. Defaults to 45 seconds.
+ type: integer
+ retrievalType:
+ description: The secret retrieval type. SECRET = Secrets Safe (credential, text, file). MANAGED_ACCOUNT = Password Safe account associated with a system.
+ type: string
+ separator:
+ description: A character that separates the folder names.
+ type: string
+ verifyCA:
+ type: boolean
+ required:
+ - apiUrl
+ - verifyCA
+ type: object
+ required:
+ - auth
+ - server
+ type: object
+ bitwardensecretsmanager:
+ description: BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider
+ properties:
+ apiURL:
+ type: string
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with a bitwarden machine account instance.
+ Make sure that the token being used has permissions on the given secret.
+ properties:
+ secretRef:
+ description: BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.
+ properties:
+ credentials:
+ description: AccessToken used for the bitwarden instance.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - credentials
+ type: object
+ required:
+ - secretRef
+ type: object
+ bitwardenServerSDKURL:
+ type: string
+ caBundle:
+ description: |-
+ Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
+ can be performed.
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ identityURL:
+ type: string
+ organizationID:
+ description: OrganizationID determines which organization this secret store manages.
+ type: string
+ projectID:
+ description: ProjectID determines which project this secret store manages.
+ type: string
+ required:
+ - auth
+ - organizationID
+ - projectID
+ type: object
+ chef:
+ description: Chef configures this store to sync secrets with chef server
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against chef Server
+ properties:
+ secretRef:
+ description: ChefAuthSecretRef holds secret references for chef server login credentials.
+ properties:
+ privateKeySecretRef:
+ description: SecretKey is the Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKeySecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ serverUrl:
+ description: ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
+ type: string
+ username:
+ description: UserName should be the user ID on the chef server
+ type: string
+ required:
+ - auth
+ - serverUrl
+ - username
+ type: object
+ cloudrusm:
+ description: CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider
+ properties:
+ auth:
+ description: CSMAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: CSMAuthSecretRef holds secret references for Cloud.ru credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ projectID:
+ description: ProjectID is the project, which the secrets are stored in.
+ type: string
+ required:
+ - auth
+ type: object
+ conjur:
+ description: Conjur configures this store to sync secrets using conjur provider
+ properties:
+ auth:
+ description: Defines authentication settings for connecting to Conjur.
+ properties:
+ apikey:
+ description: Authenticates with Conjur using an API key.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ apiKeyRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur API key
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur username
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - account
+ - apiKeyRef
+ - userRef
+ type: object
+ jwt:
+ description: Jwt enables JWT authentication using Kubernetes service account tokens.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ hostId:
+ description: |-
+ Optional HostID for JWT authentication. This may be used depending
+ on how the Conjur JWT authenticator policy is configured.
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Conjur using the JWT authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional ServiceAccountRef specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ serviceID:
+ description: The conjur authn jwt webservice id
+ type: string
+ required:
+ - account
+ - serviceID
+ type: object
+ type: object
+ caBundle:
+ description: CABundle is a PEM encoded CA bundle that will be used to validate the Conjur server certificate.
+ type: string
+ caProvider:
+ description: |-
+ Used to provide custom certificate authority (CA) certificates
+ for a secret store. The CAProvider points to a Secret or ConfigMap resource
+ that contains a PEM-encoded certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ description: URL is the endpoint of the Conjur instance.
+ type: string
+ required:
+ - auth
+ - url
+ type: object
+ delinea:
+ description: |-
+ Delinea DevOps Secrets Vault
+ https://docs.delinea.com/online-help/products/devops-secrets-vault/current
+ properties:
+ clientId:
+ description: ClientID is the non-secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ tenant:
+ description: Tenant is the chosen hostname / site name.
+ type: string
+ tld:
+ description: |-
+ TLD is based on the server location that was chosen during provisioning.
+ If unset, defaults to "com".
+ type: string
+ urlTemplate:
+ description: |-
+ URLTemplate
+ If unset, defaults to "https://%s.secretsvaultcloud.%s/v1/%s%s".
+ type: string
+ required:
+ - clientId
+ - clientSecret
+ - tenant
+ type: object
+ device42:
+ description: Device42 configures this store to sync secrets using the Device42 provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Device42 instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ host:
+ description: URL configures the Device42 instance URL.
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ doppler:
+ description: Doppler configures this store to sync secrets using the Doppler provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Doppler API
+ properties:
+ secretRef:
+ properties:
+ dopplerToken:
+ description: |-
+ The DopplerToken is used for authentication.
+ See https://docs.doppler.com/reference/api#authentication for auth token types.
+ The Key attribute defaults to dopplerToken if not specified.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - dopplerToken
+ type: object
+ required:
+ - secretRef
+ type: object
+ config:
+ description: Doppler config (required if not using a Service Token)
+ type: string
+ format:
+ description: Format enables the downloading of secrets as a file (string)
+ enum:
+ - json
+ - dotnet-json
+ - env
+ - yaml
+ - docker
+ type: string
+ nameTransformer:
+ description: Environment variable compatible name transforms that change secret names to a different format
+ enum:
+ - upper-camel
+ - camel
+ - lower-snake
+ - tf-var
+ - dotnet-env
+ - lower-kebab
+ type: string
+ project:
+ description: Doppler project (required if not using a Service Token)
+ type: string
+ required:
+ - auth
+ type: object
+ fake:
+ description: Fake configures a store with static key/value pairs
+ properties:
+ data:
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ version:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ required:
+ - data
+ type: object
+ fortanix:
+ description: Fortanix configures this store to sync secrets using the Fortanix provider
+ properties:
+ apiKey:
+ description: APIKey is the API token to access SDKMS Applications.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the SDKMS API Key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ description: APIURL is the URL of SDKMS API. Defaults to `sdkms.fortanix.com`.
+ type: string
+ type: object
+ gcpsm:
+ description: GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against GCP
+ properties:
+ secretRef:
+ properties:
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ workloadIdentity:
+ properties:
+ clusterLocation:
+ description: |-
+ ClusterLocation is the location of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterName:
+ description: |-
+ ClusterName is the name of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterProjectID:
+ description: |-
+ ClusterProjectID is the project ID of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ type: object
+ location:
+ description: Location optionally defines a location for a secret
+ type: string
+ projectID:
+ description: ProjectID project where secret is located
+ type: string
+ type: object
+ github:
+ description: Github configures this store to push Github Action secrets using Github API provider
+ properties:
+ appID:
+ description: appID specifies the Github APP that will be used to authenticate the client
+ format: int64
+ type: integer
+ auth:
+ description: auth configures how secret-manager authenticates with a Github instance.
+ properties:
+ privateKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKey
+ type: object
+ environment:
+ description: environment will be used to fetch secrets from a particular environment within a github repository
+ type: string
+ installationID:
+ description: installationID specifies the Github APP installation that will be used to authenticate the client
+ format: int64
+ type: integer
+ organization:
+ description: organization will be used to fetch secrets from the Github organization
+ type: string
+ repository:
+ description: repository will be used to fetch secrets from the Github repository within an organization
+ type: string
+ uploadURL:
+ description: Upload URL for enterprise instances. Default to URL.
+ type: string
+ url:
+ default: https://github.com/
+ description: URL configures the Github instance URL. Defaults to https://github.com/.
+ type: string
+ required:
+ - appID
+ - auth
+ - installationID
+ - organization
+ type: object
+ gitlab:
+ description: GitLab configures this store to sync secrets using GitLab Variables provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a GitLab instance.
+ properties:
+ SecretRef:
+ properties:
+ accessToken:
+ description: AccessToken is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - SecretRef
+ type: object
+ environment:
+ description: Environment environment_scope of gitlab CI/CD variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment on how to create environments)
+ type: string
+ groupIDs:
+ description: GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables.
+ items:
+ type: string
+ type: array
+ inheritFromGroups:
+ description: InheritFromGroups specifies whether parent groups should be discovered and checked for secrets.
+ type: boolean
+ projectID:
+ description: ProjectID specifies a project where secrets are located.
+ type: string
+ url:
+ description: URL configures the GitLab instance URL. Defaults to https://gitlab.com/.
+ type: string
+ required:
+ - auth
+ type: object
+ ibm:
+ description: IBM configures this store to sync secrets using IBM Cloud provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the IBM secrets manager.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ containerAuth:
+ description: IBM Container-based auth with IAM Trusted Profile.
+ properties:
+ iamEndpoint:
+ type: string
+ profile:
+ description: the IBM Trusted Profile
+ type: string
+ tokenLocation:
+ description: Location the token is mounted on the pod
+ type: string
+ required:
+ - profile
+ type: object
+ secretRef:
+ properties:
+ secretApiKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ serviceUrl:
+ description: ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance
+ type: string
+ required:
+ - auth
+ type: object
+ infisical:
+ description: Infisical configures this store to sync secrets using the Infisical provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Infisical API
+ properties:
+ universalAuthCredentials:
+ properties:
+ clientId:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecret
+ type: object
+ type: object
+ hostAPI:
+ default: https://app.infisical.com/api
+ description: HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
+ type: string
+ secretsScope:
+ description: SecretsScope defines the scope of the secrets within the workspace
+ properties:
+ environmentSlug:
+ description: EnvironmentSlug is the required slug identifier for the environment.
+ type: string
+ expandSecretReferences:
+ default: true
+ description: ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+ type: boolean
+ projectSlug:
+ description: ProjectSlug is the required slug identifier for the project.
+ type: string
+ recursive:
+ default: false
+ description: Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
+ type: boolean
+ secretsPath:
+ default: /
+ description: SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
+ type: string
+ required:
+ - environmentSlug
+ - projectSlug
+ type: object
+ required:
+ - auth
+ - secretsScope
+ type: object
+ keepersecurity:
+ description: KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider
+ properties:
+ authRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ folderID:
+ type: string
+ required:
+ - authRef
+ - folderID
+ type: object
+ kubernetes:
+ description: Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Kubernetes instance.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ cert:
+ description: has both clientCert and clientKey as secretKeySelector
+ properties:
+ clientCert:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ serviceAccount:
+ description: points to a service account that should be used for authentication
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ token:
+ description: use static token to authenticate with
+ properties:
+ bearerToken:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ authRef:
+ description: A reference to a secret that contains the auth information.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ remoteNamespace:
+ default: default
+ description: Remote namespace to fetch the secrets from
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ server:
+ description: configures the Kubernetes server Address.
+ properties:
+ caBundle:
+ description: CABundle is a base64-encoded CA certificate
+ format: byte
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ default: kubernetes.default
+ description: configures the Kubernetes server Address.
+ type: string
+ type: object
+ type: object
+ onboardbase:
+ description: Onboardbase configures this store to sync secrets using the Onboardbase provider
+ properties:
+ apiHost:
+ default: https://public.onboardbase.com/api/v1/
+ description: APIHost use this to configure the host url for the API for selfhosted installation, default is https://public.onboardbase.com/api/v1/
+ type: string
+ auth:
+ description: Auth configures how the Operator authenticates with the Onboardbase API
+ properties:
+ apiKeyRef:
+ description: |-
+ OnboardbaseAPIKey is the APIKey generated by an admin account.
+ It is used to recognize and authorize access to a project and environment within onboardbase
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ passcodeRef:
+ description: OnboardbasePasscode is the passcode attached to the API Key
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - apiKeyRef
+ - passcodeRef
+ type: object
+ environment:
+ default: development
+ description: Environment is the name of an environmnent within a project to pull the secrets from
+ type: string
+ project:
+ default: development
+ description: Project is an onboardbase project that the secrets should be pulled from
+ type: string
+ required:
+ - apiHost
+ - auth
+ - environment
+ - project
+ type: object
+ onepassword:
+ description: OnePassword configures this store to sync secrets using the 1Password Cloud provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against OnePassword Connect Server
+ properties:
+ secretRef:
+ description: OnePasswordAuthSecretRef holds secret references for 1Password credentials.
+ properties:
+ connectTokenSecretRef:
+ description: The ConnectToken is used for authentication to a 1Password Connect Server.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - connectTokenSecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ connectHost:
+ description: ConnectHost defines the OnePassword Connect Server to connect to
+ type: string
+ vaults:
+ additionalProperties:
+ type: integer
+ description: Vaults defines which OnePassword vaults to search in which order
+ type: object
+ required:
+ - auth
+ - connectHost
+ - vaults
+ type: object
+ oracle:
+ description: Oracle configures this store to sync secrets using Oracle Vault provider
+ properties:
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with the Oracle Vault.
+ If empty, use the instance principal, otherwise the user credentials specified in Auth.
+ properties:
+ secretRef:
+ description: SecretRef to pass through sensitive information.
+ properties:
+ fingerprint:
+ description: Fingerprint is the fingerprint of the API private key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privatekey:
+ description: PrivateKey is the user's API Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - fingerprint
+ - privatekey
+ type: object
+ tenancy:
+ description: Tenancy is the tenancy OCID where user is located.
+ type: string
+ user:
+ description: User is an access OCID specific to the account.
+ type: string
+ required:
+ - secretRef
+ - tenancy
+ - user
+ type: object
+ compartment:
+ description: |-
+ Compartment is the vault compartment OCID.
+ Required for PushSecret
+ type: string
+ encryptionKey:
+ description: |-
+ EncryptionKey is the OCID of the encryption key within the vault.
+ Required for PushSecret
+ type: string
+ principalType:
+ description: |-
+ The type of principal to use for authentication. If left blank, the Auth struct will
+ determine the principal type. This optional field must be specified if using
+ workload identity.
+ enum:
+ - ""
+ - UserPrincipal
+ - InstancePrincipal
+ - Workload
+ type: string
+ region:
+ description: Region is the region where vault is located.
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ vault:
+ description: Vault is the vault's OCID of the specific vault where secret is located.
+ type: string
+ required:
+ - region
+ - vault
+ type: object
+ passbolt:
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against Passbolt Server
+ properties:
+ passwordSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privateKeySecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecretRef
+ - privateKeySecretRef
+ type: object
+ host:
+ description: Host defines the Passbolt Server to connect to
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ passworddepot:
+ description: Configures a store to sync secrets with a Password Depot instance.
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Password Depot instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ database:
+ description: Database to use as source
+ type: string
+ host:
+ description: URL configures the Password Depot instance URL.
+ type: string
+ required:
+ - auth
+ - database
+ - host
+ type: object
+ previder:
+ description: Previder configures this store to sync secrets using the Previder provider
+ properties:
+ auth:
+ description: PreviderAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: PreviderAuthSecretRef holds secret references for Previder Vault credentials.
+ properties:
+ accessToken:
+ description: The AccessToken is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessToken
+ type: object
+ type: object
+ baseUri:
+ type: string
+ required:
+ - auth
+ type: object
+ pulumi:
+ description: Pulumi configures this store to sync secrets using the Pulumi provider
+ properties:
+ accessToken:
+ description: AccessToken is the access tokens to sign in to the Pulumi Cloud Console.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the Pulumi API token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ default: https://api.pulumi.com/api/esc
+ description: APIURL is the URL of the Pulumi API.
+ type: string
+ environment:
+ description: |-
+ Environment are YAML documents composed of static key-value pairs, programmatic expressions,
+ dynamically retrieved values from supported providers including all major clouds,
+ and other Pulumi ESC environments.
+ To create a new environment, visit https://www.pulumi.com/docs/esc/environments/ for more information.
+ type: string
+ organization:
+ description: |-
+ Organization are a space to collaborate on shared projects and stacks.
+ To create a new organization, visit https://app.pulumi.com/ and click "New Organization".
+ type: string
+ project:
+ description: Project is the name of the Pulumi ESC project the environment belongs to.
+ type: string
+ required:
+ - accessToken
+ - environment
+ - organization
+ - project
+ type: object
+ scaleway:
+ description: Scaleway
+ properties:
+ accessKey:
+ description: AccessKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ apiUrl:
+ description: APIURL is the url of the api to use. Defaults to https://api.scaleway.com
+ type: string
+ projectId:
+ description: 'ProjectID is the id of your project, which you can find in the console: https://console.scaleway.com/project/settings'
+ type: string
+ region:
+ description: 'Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone'
+ type: string
+ secretKey:
+ description: SecretKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - accessKey
+ - projectId
+ - region
+ - secretKey
+ type: object
+ secretserver:
+ description: |-
+ SecretServer configures this store to sync secrets using SecretServer provider
+ https://docs.delinea.com/online-help/secret-server/start.htm
+ properties:
+ password:
+ description: Password is the secret server account password.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ serverURL:
+ description: |-
+ ServerURL
+ URL to your secret server installation
+ type: string
+ username:
+ description: Username is the secret server account username.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - password
+ - serverURL
+ - username
+ type: object
+ senhasegura:
+ description: Senhasegura configures this store to sync secrets using senhasegura provider
+ properties:
+ auth:
+ description: Auth defines parameters to authenticate in senhasegura
+ properties:
+ clientId:
+ type: string
+ clientSecretSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecretSecretRef
+ type: object
+ ignoreSslCertificate:
+ default: false
+ description: IgnoreSslCertificate defines if SSL certificate must be ignored
+ type: boolean
+ module:
+ description: Module defines which senhasegura module should be used to get secrets
+ type: string
+ url:
+ description: URL of senhasegura
+ type: string
+ required:
+ - auth
+ - module
+ - url
+ type: object
+ vault:
+ description: Vault configures this store to sync secrets using Hashi provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ default: approle
+ description: |-
+ Path where the App Role authentication backend is mounted
+ in Vault, e.g: "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ roleRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role ID used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role id.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ - secretRef
+ type: object
+ cert:
+ description: |-
+ Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
+ Cert authentication method
+ properties:
+ clientCert:
+ description: |-
+ ClientCert is a certificate to authenticate using the Cert Vault
+ authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing client private key to
+ authenticate with Vault using the Cert authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ iam:
+ description: |-
+ Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
+ AWS IAM authentication method
+ properties:
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ jwt:
+ description: Specify a service account with IRSA enabled
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ path:
+ description: 'Path where the AWS auth method is enabled in Vault, e.g: "aws"'
+ type: string
+ region:
+ description: AWS region
+ type: string
+ role:
+ description: This is the AWS role to be assumed before talking to vault
+ type: string
+ secretRef:
+ description: Specify credentials in a Secret object
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ vaultAwsIamServerID:
+ description: 'X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws'
+ type: string
+ vaultRole:
+ description: Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine
+ type: string
+ required:
+ - vaultRole
+ type: object
+ jwt:
+ description: |-
+ Jwt authenticates with Vault by passing role and JWT token using the
+ JWT/OIDC authentication method
+ properties:
+ kubernetesServiceAccountToken:
+ description: |-
+ Optional ServiceAccountToken specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Optional audiences field that will be used to request a temporary Kubernetes service
+ account token for the service account referenced by `serviceAccountRef`.
+ Defaults to a single audience `vault` it not specified.
+ Deprecated: use serviceAccountRef.Audiences instead
+ items:
+ type: string
+ type: array
+ expirationSeconds:
+ description: |-
+ Optional expiration time in seconds that will be used to request a temporary
+ Kubernetes service account token for the service account referenced by
+ `serviceAccountRef`.
+ Deprecated: this will be removed in the future.
+ Defaults to 10 minutes.
+ format: int64
+ type: integer
+ serviceAccountRef:
+ description: Service account field containing the name of a kubernetes ServiceAccount.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ path:
+ default: jwt
+ description: |-
+ Path where the JWT authentication backend is mounted
+ in Vault, e.g: "jwt"
+ type: string
+ role:
+ description: |-
+ Role is a JWT role to authenticate using the JWT/OIDC Vault
+ authentication method
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Vault using the JWT/OIDC authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ default: kubernetes
+ description: |-
+ Path where the Kubernetes authentication backend is mounted in Vault, e.g:
+ "kubernetes"
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Vault. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - mountPath
+ - role
+ type: object
+ ldap:
+ description: |-
+ Ldap authenticates with Vault by passing username/password pair using
+ the LDAP authentication method
+ properties:
+ path:
+ default: ldap
+ description: |-
+ Path where the LDAP authentication backend is mounted
+ in Vault, e.g: "ldap"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the LDAP
+ user used to authenticate with Vault using the LDAP authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is an LDAP username used to authenticate using the LDAP Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
+ Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ This will default to Vault.Namespace field if set, or empty otherwise
+ type: string
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userPass:
+ description: UserPass authenticates with Vault by passing username/password pair
+ properties:
+ path:
+ default: userpass
+ description: |-
+ Path where the UserPassword authentication backend is mounted
+ in Vault, e.g: "userpass"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the
+ user used to authenticate with Vault using the UserPass authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is a username used to authenticate using the UserPass Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Vault server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Vault server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ forwardInconsistent:
+ description: |-
+ ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
+ leader instead of simply retrying within a loop. This can increase performance if
+ the option is enabled serverside.
+ https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
+ type: boolean
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers to be added in Vault request
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault KV backend endpoint, e.g:
+ "secret". The v2 KV secret engine version specific "/data" path suffix
+ for fetching secrets from Vault is optional and will be appended
+ if not present in specified path.
+ type: string
+ readYourWrites:
+ description: |-
+ ReadYourWrites ensures isolated read-after-write semantics by
+ providing discovered cluster replication states in each request.
+ More information about eventual consistency in Vault can be found here
+ https://www.vaultproject.io/docs/enterprise/consistency
+ type: boolean
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ tls:
+ description: |-
+ The configuration used for client side related TLS communication, when the Vault server
+ requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
+ This parameter is ignored for plain HTTP protocol connection.
+ It's worth noting this configuration is different from the "TLS certificates auth method",
+ which is available under the `auth.cert` section.
+ properties:
+ certSecretRef:
+ description: |-
+ CertSecretRef is a certificate added to the transport layer
+ when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.crt'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ keySecretRef:
+ description: |-
+ KeySecretRef to a key in a Secret resource containing client private key
+ added to the transport layer when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.key'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ version:
+ default: v2
+ description: |-
+ Version is the Vault KV secret engine version. This can be either "v1" or
+ "v2". Version defaults to "v2".
+ enum:
+ - v1
+ - v2
+ type: string
+ required:
+ - server
+ type: object
+ webhook:
+ description: Webhook configures this store to sync secrets using a generic templated webhook
+ properties:
+ auth:
+ description: Auth specifies a authorization protocol. Only one protocol may be set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ ntlm:
+ description: NTLMProtocol configures the store to use NTLM for auth
+ properties:
+ passwordSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ usernameSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecret
+ - usernameSecret
+ type: object
+ type: object
+ body:
+ description: Body
+ type: string
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate webhook server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate webhook server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: The namespace the Provider type is in.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers
+ type: object
+ method:
+ description: Webhook Method
+ type: string
+ result:
+ description: Result formatting
+ properties:
+ jsonPath:
+ description: Json path of return value
+ type: string
+ type: object
+ secrets:
+ description: |-
+ Secrets to fill in templates
+ These secrets will be passed to the templating function as key value pairs under the given name
+ items:
+ properties:
+ name:
+ description: Name of this secret in templates
+ type: string
+ secretRef:
+ description: Secret ref to fill in credentials
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - name
+ - secretRef
+ type: object
+ type: array
+ timeout:
+ description: Timeout
+ type: string
+ url:
+ description: Webhook url to call
+ type: string
+ required:
+ - result
+ - url
+ type: object
+ yandexcertificatemanager:
+ description: YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Certificate Manager
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ yandexlockbox:
+ description: YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Lockbox
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ type: object
+ refreshInterval:
+ description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.
+ type: integer
+ retrySettings:
+ description: Used to configure http retries if failed
+ properties:
+ maxRetries:
+ format: int32
+ type: integer
+ retryInterval:
+ type: string
+ type: object
+ required:
+ - provider
+ type: object
+ status:
+ description: SecretStoreStatus defines the observed state of the SecretStore.
+ properties:
+ capabilities:
+ description: SecretStoreCapabilities defines the possible operations a SecretStore can do.
+ type: string
+ conditions:
+ items:
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ type: object
+ type: object
+ served: true
+ storage: false
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/ecrauthorizationtoken.yaml b/charts/external-secrets/templates/crds/ecrauthorizationtoken.yaml
new file mode 100644
index 0000000..55d90a4
--- /dev/null
+++ b/charts/external-secrets/templates/crds/ecrauthorizationtoken.yaml
@@ -0,0 +1,202 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: ecrauthorizationtokens.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: ECRAuthorizationToken
+ listKind: ECRAuthorizationTokenList
+ plural: ecrauthorizationtokens
+ singular: ecrauthorizationtoken
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ ECRAuthorizationTokenSpec uses the GetAuthorizationToken API to retrieve an
+ authorization token.
+ The authorization token is valid for 12 hours.
+ The authorizationToken returned is a base64 encoded string that can be decoded
+ and used in a docker login command to authenticate to a registry.
+ For more information, see Registry authentication (https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html#registry_auth) in the Amazon Elastic Container Registry User Guide.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ auth:
+ description: Auth defines how to authenticate with AWS
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ region:
+ description: Region specifies the region to operate in.
+ type: string
+ role:
+ description: |-
+ You can assume a role before making calls to the
+ desired AWS service.
+ type: string
+ scope:
+ description: |-
+ Scope specifies the ECR service scope.
+ Valid options are private and public.
+ type: string
+ required:
+ - region
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/externalsecret.yaml b/charts/external-secrets/templates/crds/externalsecret.yaml
new file mode 100644
index 0000000..a6f1e83
--- /dev/null
+++ b/charts/external-secrets/templates/crds/externalsecret.yaml
@@ -0,0 +1,1215 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: externalsecrets.external-secrets.io
+spec:
+ group: external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ kind: ExternalSecret
+ listKind: ExternalSecretList
+ plural: externalsecrets
+ shortNames:
+ - es
+ singular: externalsecret
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .spec.secretStoreRef.kind
+ name: StoreType
+ type: string
+ - jsonPath: .spec.secretStoreRef.name
+ name: Store
+ type: string
+ - jsonPath: .spec.refreshInterval
+ name: Refresh Interval
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: ExternalSecret is the Schema for the external-secrets API.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: ExternalSecretSpec defines the desired state of ExternalSecret.
+ properties:
+ data:
+ description: Data defines the connection between the Kubernetes Secret keys and the Provider data
+ items:
+ description: ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.
+ properties:
+ remoteRef:
+ description: |-
+ RemoteRef points to the remote secret and defines
+ which secret (version/property/..) to fetch.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ secretKey:
+ description: The key in the Kubernetes Secret to store the value.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ sourceRef:
+ description: |-
+ SourceRef allows you to override the source
+ from which the value will be pulled.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: |-
+ GeneratorRef points to a generator custom resource.
+
+ Deprecated: The generatorRef is not implemented in .data[].
+ this will be removed with v1.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ required:
+ - remoteRef
+ - secretKey
+ type: object
+ type: array
+ dataFrom:
+ description: |-
+ DataFrom is used to fetch all properties from a specific Provider data
+ If multiple entries are specified, the Secret keys are merged in the specified order
+ items:
+ properties:
+ extract:
+ description: |-
+ Used to extract multiple key/value pairs from one secret
+ Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ find:
+ description: |-
+ Used to find secrets based on tags or regular expressions
+ Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ name:
+ description: Finds secrets based on the name.
+ properties:
+ regexp:
+ description: Finds secrets base
+ type: string
+ type: object
+ path:
+ description: A root path to start the find operations.
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: Find secrets based on tags.
+ type: object
+ type: object
+ rewrite:
+ description: |-
+ Used to rewrite secret Keys after getting them from the secret Provider
+ Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)
+ items:
+ properties:
+ regexp:
+ description: |-
+ Used to rewrite with regular expressions.
+ The resulting key will be the output of a regexp.ReplaceAll operation.
+ properties:
+ source:
+ description: Used to define the regular expression of a re.Compiler.
+ type: string
+ target:
+ description: Used to define the target pattern of a ReplaceAll operation.
+ type: string
+ required:
+ - source
+ - target
+ type: object
+ transform:
+ description: |-
+ Used to apply string transformation on the secrets.
+ The resulting key will be the output of the template applied by the operation.
+ properties:
+ template:
+ description: |-
+ Used to define the template to apply on the secret name.
+ `.value ` will specify the secret name in the template.
+ type: string
+ required:
+ - template
+ type: object
+ type: object
+ type: array
+ sourceRef:
+ description: |-
+ SourceRef points to a store or generator
+ which contains secret values ready to use.
+ Use this in combination with Extract or Find pull values out of
+ a specific SecretStore.
+ When sourceRef points to a generator Extract or Find is not supported.
+ The generator returns a static map of values
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: GeneratorRef points to a generator custom resource.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ type: object
+ type: array
+ refreshInterval:
+ default: 1h
+ description: |-
+ RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
+ specified as Golang Duration strings.
+ Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
+ Example values: "1h", "2h30m", "10s"
+ May be set to zero to fetch and create it once. Defaults to 1h.
+ type: string
+ refreshPolicy:
+ description: |-
+ RefreshPolicy determines how the ExternalSecret should be refreshed:
+ - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
+ - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
+ No periodic updates occur if refreshInterval is 0.
+ - OnChange: Only synchronizes the Secret when the ExternalSecret's metadata or specification changes
+ enum:
+ - CreatedOnce
+ - Periodic
+ - OnChange
+ type: string
+ secretStoreRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ target:
+ default:
+ creationPolicy: Owner
+ deletionPolicy: Retain
+ description: |-
+ ExternalSecretTarget defines the Kubernetes Secret to be created
+ There can be only one target per ExternalSecret.
+ properties:
+ creationPolicy:
+ default: Owner
+ description: |-
+ CreationPolicy defines rules on how to create the resulting Secret.
+ Defaults to "Owner"
+ enum:
+ - Owner
+ - Orphan
+ - Merge
+ - None
+ type: string
+ deletionPolicy:
+ default: Retain
+ description: |-
+ DeletionPolicy defines rules on how to delete the resulting Secret.
+ Defaults to "Retain"
+ enum:
+ - Delete
+ - Merge
+ - Retain
+ type: string
+ immutable:
+ description: Immutable defines if the final secret will be immutable
+ type: boolean
+ name:
+ description: |-
+ The name of the Secret resource to be managed.
+ Defaults to the .metadata.name of the ExternalSecret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ template:
+ description: Template defines a blueprint for the created Secret resource.
+ properties:
+ data:
+ additionalProperties:
+ type: string
+ type: object
+ engineVersion:
+ default: v2
+ description: |-
+ EngineVersion specifies the template engine version
+ that should be used to compile/execute the
+ template specified in .data and .templateFrom[].
+ enum:
+ - v2
+ type: string
+ mergePolicy:
+ default: Replace
+ enum:
+ - Replace
+ - Merge
+ type: string
+ metadata:
+ description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ templateFrom:
+ items:
+ properties:
+ configMap:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ literal:
+ type: string
+ secret:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ target:
+ default: Data
+ enum:
+ - Data
+ - Annotations
+ - Labels
+ type: string
+ type: object
+ type: array
+ type:
+ type: string
+ type: object
+ type: object
+ type: object
+ status:
+ properties:
+ binding:
+ description: Binding represents a servicebinding.io Provisioned Service reference to the secret
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ conditions:
+ items:
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ refreshTime:
+ description: |-
+ refreshTime is the time and date the external secret was fetched and
+ the target secret updated
+ format: date-time
+ nullable: true
+ type: string
+ syncedResourceVersion:
+ description: SyncedResourceVersion keeps track of the last synced version
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+ - additionalPrinterColumns:
+ - jsonPath: .spec.secretStoreRef.kind
+ name: StoreType
+ type: string
+ - jsonPath: .spec.secretStoreRef.name
+ name: Store
+ type: string
+ - jsonPath: .spec.refreshInterval
+ name: Refresh Interval
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: ExternalSecret is the Schema for the external-secrets API.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: ExternalSecretSpec defines the desired state of ExternalSecret.
+ properties:
+ data:
+ description: Data defines the connection between the Kubernetes Secret keys and the Provider data
+ items:
+ description: ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.
+ properties:
+ remoteRef:
+ description: |-
+ RemoteRef points to the remote secret and defines
+ which secret (version/property/..) to fetch.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ secretKey:
+ description: The key in the Kubernetes Secret to store the value.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ sourceRef:
+ description: |-
+ SourceRef allows you to override the source
+ from which the value will be pulled.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: |-
+ GeneratorRef points to a generator custom resource.
+
+ Deprecated: The generatorRef is not implemented in .data[].
+ this will be removed with v1.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ required:
+ - remoteRef
+ - secretKey
+ type: object
+ type: array
+ dataFrom:
+ description: |-
+ DataFrom is used to fetch all properties from a specific Provider data
+ If multiple entries are specified, the Secret keys are merged in the specified order
+ items:
+ properties:
+ extract:
+ description: |-
+ Used to extract multiple key/value pairs from one secret
+ Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ key:
+ description: Key is the key used in the Provider, mandatory
+ type: string
+ metadataPolicy:
+ default: None
+ description: Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
+ enum:
+ - None
+ - Fetch
+ type: string
+ property:
+ description: Used to select a specific property of the Provider value (if a map), if supported
+ type: string
+ version:
+ description: Used to select a specific version of the Provider value, if supported
+ type: string
+ required:
+ - key
+ type: object
+ find:
+ description: |-
+ Used to find secrets based on tags or regular expressions
+ Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.
+ properties:
+ conversionStrategy:
+ default: Default
+ description: Used to define a conversion Strategy
+ enum:
+ - Default
+ - Unicode
+ type: string
+ decodingStrategy:
+ default: None
+ description: Used to define a decoding Strategy
+ enum:
+ - Auto
+ - Base64
+ - Base64URL
+ - None
+ type: string
+ name:
+ description: Finds secrets based on the name.
+ properties:
+ regexp:
+ description: Finds secrets base
+ type: string
+ type: object
+ path:
+ description: A root path to start the find operations.
+ type: string
+ tags:
+ additionalProperties:
+ type: string
+ description: Find secrets based on tags.
+ type: object
+ type: object
+ rewrite:
+ description: |-
+ Used to rewrite secret Keys after getting them from the secret Provider
+ Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)
+ items:
+ properties:
+ regexp:
+ description: |-
+ Used to rewrite with regular expressions.
+ The resulting key will be the output of a regexp.ReplaceAll operation.
+ properties:
+ source:
+ description: Used to define the regular expression of a re.Compiler.
+ type: string
+ target:
+ description: Used to define the target pattern of a ReplaceAll operation.
+ type: string
+ required:
+ - source
+ - target
+ type: object
+ transform:
+ description: |-
+ Used to apply string transformation on the secrets.
+ The resulting key will be the output of the template applied by the operation.
+ properties:
+ template:
+ description: |-
+ Used to define the template to apply on the secret name.
+ `.value ` will specify the secret name in the template.
+ type: string
+ required:
+ - template
+ type: object
+ type: object
+ type: array
+ sourceRef:
+ description: |-
+ SourceRef points to a store or generator
+ which contains secret values ready to use.
+ Use this in combination with Extract or Find pull values out of
+ a specific SecretStore.
+ When sourceRef points to a generator Extract or Find is not supported.
+ The generator returns a static map of values
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: GeneratorRef points to a generator custom resource.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ storeRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ type: object
+ type: array
+ refreshInterval:
+ default: 1h
+ description: |-
+ RefreshInterval is the amount of time before the values are read again from the SecretStore provider,
+ specified as Golang Duration strings.
+ Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
+ Example values: "1h", "2h30m", "10s"
+ May be set to zero to fetch and create it once. Defaults to 1h.
+ type: string
+ refreshPolicy:
+ description: |-
+ RefreshPolicy determines how the ExternalSecret should be refreshed:
+ - CreatedOnce: Creates the Secret only if it does not exist and does not update it thereafter
+ - Periodic: Synchronizes the Secret from the external source at regular intervals specified by refreshInterval.
+ No periodic updates occur if refreshInterval is 0.
+ - OnChange: Only synchronizes the Secret when the ExternalSecret's metadata or specification changes
+ enum:
+ - CreatedOnce
+ - Periodic
+ - OnChange
+ type: string
+ secretStoreRef:
+ description: SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
+ properties:
+ kind:
+ description: |-
+ Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ Defaults to `SecretStore`
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ name:
+ description: Name of the SecretStore resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ target:
+ default:
+ creationPolicy: Owner
+ deletionPolicy: Retain
+ description: |-
+ ExternalSecretTarget defines the Kubernetes Secret to be created
+ There can be only one target per ExternalSecret.
+ properties:
+ creationPolicy:
+ default: Owner
+ description: |-
+ CreationPolicy defines rules on how to create the resulting Secret.
+ Defaults to "Owner"
+ enum:
+ - Owner
+ - Orphan
+ - Merge
+ - None
+ type: string
+ deletionPolicy:
+ default: Retain
+ description: |-
+ DeletionPolicy defines rules on how to delete the resulting Secret.
+ Defaults to "Retain"
+ enum:
+ - Delete
+ - Merge
+ - Retain
+ type: string
+ immutable:
+ description: Immutable defines if the final secret will be immutable
+ type: boolean
+ name:
+ description: |-
+ The name of the Secret resource to be managed.
+ Defaults to the .metadata.name of the ExternalSecret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ template:
+ description: Template defines a blueprint for the created Secret resource.
+ properties:
+ data:
+ additionalProperties:
+ type: string
+ type: object
+ engineVersion:
+ default: v2
+ description: |-
+ EngineVersion specifies the template engine version
+ that should be used to compile/execute the
+ template specified in .data and .templateFrom[].
+ enum:
+ - v2
+ type: string
+ mergePolicy:
+ default: Replace
+ enum:
+ - Replace
+ - Merge
+ type: string
+ metadata:
+ description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ templateFrom:
+ items:
+ properties:
+ configMap:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ literal:
+ type: string
+ secret:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ target:
+ default: Data
+ enum:
+ - Data
+ - Annotations
+ - Labels
+ type: string
+ type: object
+ type: array
+ type:
+ type: string
+ type: object
+ type: object
+ type: object
+ status:
+ properties:
+ binding:
+ description: Binding represents a servicebinding.io Provisioned Service reference to the secret
+ properties:
+ name:
+ default: ""
+ description: |-
+ Name of the referent.
+ This field is effectively required, but due to backwards compatibility is
+ allowed to be empty. Instances of this type with an empty value here are
+ almost certainly wrong.
+ More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+ type: string
+ type: object
+ x-kubernetes-map-type: atomic
+ conditions:
+ items:
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ refreshTime:
+ description: |-
+ refreshTime is the time and date the external secret was fetched and
+ the target secret updated
+ format: date-time
+ nullable: true
+ type: string
+ syncedResourceVersion:
+ description: SyncedResourceVersion keeps track of the last synced version
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: false
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/fake.yaml b/charts/external-secrets/templates/crds/fake.yaml
new file mode 100644
index 0000000..41cb800
--- /dev/null
+++ b/charts/external-secrets/templates/crds/fake.yaml
@@ -0,0 +1,73 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: fakes.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: Fake
+ listKind: FakeList
+ plural: fakes
+ singular: fake
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Fake generator is used for testing. It lets you define
+ a static set of credentials that is always returned.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: FakeSpec contains the static data.
+ properties:
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters VDS based on this property
+ type: string
+ data:
+ additionalProperties:
+ type: string
+ description: |-
+ Data defines the static data returned
+ by this generator.
+ type: object
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/gcraccesstoken.yaml b/charts/external-secrets/templates/crds/gcraccesstoken.yaml
new file mode 100644
index 0000000..cf7b781
--- /dev/null
+++ b/charts/external-secrets/templates/crds/gcraccesstoken.yaml
@@ -0,0 +1,140 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: gcraccesstokens.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: GCRAccessToken
+ listKind: GCRAccessTokenList
+ plural: gcraccesstokens
+ singular: gcraccesstoken
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ GCRAccessToken generates an GCP access token
+ that can be used to authenticate with GCR.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ auth:
+ description: Auth defines the means for authenticating with GCP
+ properties:
+ secretRef:
+ properties:
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ workloadIdentity:
+ properties:
+ clusterLocation:
+ type: string
+ clusterName:
+ type: string
+ clusterProjectID:
+ type: string
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - clusterLocation
+ - clusterName
+ - serviceAccountRef
+ type: object
+ type: object
+ projectID:
+ description: ProjectID defines which project to use to authenticate with
+ type: string
+ required:
+ - auth
+ - projectID
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/generatorstate.yaml b/charts/external-secrets/templates/crds/generatorstate.yaml
new file mode 100644
index 0000000..58b7df3
--- /dev/null
+++ b/charts/external-secrets/templates/crds/generatorstate.yaml
@@ -0,0 +1,110 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: generatorstates.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: GeneratorState
+ listKind: GeneratorStateList
+ plural: generatorstates
+ shortNames:
+ - gs
+ singular: generatorstate
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .spec.garbageCollectionDeadline
+ name: GC Deadline
+ type: string
+ - jsonPath: .metadata.creationTimestamp
+ name: Age
+ type: date
+ name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ garbageCollectionDeadline:
+ description: |-
+ GarbageCollectionDeadline is the time after which the generator state
+ will be deleted.
+ It is set by the controller which creates the generator state and
+ can be set configured by the user.
+ If the garbage collection deadline is not set the generator state will not be deleted.
+ format: date-time
+ type: string
+ resource:
+ description: |-
+ Resource is the generator manifest that produced the state.
+ It is a snapshot of the generator manifest at the time the state was produced.
+ This manifest will be used to delete the resource. Any configuration that is referenced
+ in the manifest should be available at the time of garbage collection. If that is not the case deletion will
+ be blocked by a finalizer.
+ x-kubernetes-preserve-unknown-fields: true
+ state:
+ description: State is the state that was produced by the generator implementation.
+ x-kubernetes-preserve-unknown-fields: true
+ required:
+ - resource
+ - state
+ type: object
+ status:
+ properties:
+ conditions:
+ items:
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/githubaccesstoken.yaml b/charts/external-secrets/templates/crds/githubaccesstoken.yaml
new file mode 100644
index 0000000..b4010d5
--- /dev/null
+++ b/charts/external-secrets/templates/crds/githubaccesstoken.yaml
@@ -0,0 +1,120 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: githubaccesstokens.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: GithubAccessToken
+ listKind: GithubAccessTokenList
+ plural: githubaccesstokens
+ singular: githubaccesstoken
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: GithubAccessToken generates ghs_ accessToken
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ appID:
+ type: string
+ auth:
+ description: Auth configures how ESO authenticates with a Github instance.
+ properties:
+ privateKey:
+ properties:
+ secretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - secretRef
+ type: object
+ required:
+ - privateKey
+ type: object
+ installID:
+ type: string
+ permissions:
+ additionalProperties:
+ type: string
+ description: Map of permissions the token will have. If omitted, defaults to all permissions the GitHub App has.
+ type: object
+ repositories:
+ description: |-
+ List of repositories the token will have access to. If omitted, defaults to all repositories the GitHub App
+ is installed to.
+ items:
+ type: string
+ type: array
+ url:
+ description: URL configures the Github instance URL. Defaults to https://github.com/.
+ type: string
+ required:
+ - appID
+ - auth
+ - installID
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/grafana.yaml b/charts/external-secrets/templates/crds/grafana.yaml
new file mode 100644
index 0000000..8b0a88a
--- /dev/null
+++ b/charts/external-secrets/templates/crds/grafana.yaml
@@ -0,0 +1,139 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: grafanas.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: Grafana
+ listKind: GrafanaList
+ plural: grafanas
+ singular: grafana
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: GrafanaSpec controls the behavior of the grafana generator.
+ properties:
+ auth:
+ description: |-
+ Auth is the authentication configuration to authenticate
+ against the Grafana instance.
+ properties:
+ basic:
+ description: |-
+ Basic auth credentials used to authenticate against the Grafana instance.
+ Note: you need a token which has elevated permissions to create service accounts.
+ See here for the documentation on basic roles offered by Grafana:
+ https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+ properties:
+ password:
+ description: A basic auth password used to authenticate against the Grafana instance.
+ properties:
+ key:
+ description: The key where the token is found.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ username:
+ description: A basic auth username used to authenticate against the Grafana instance.
+ type: string
+ required:
+ - password
+ - username
+ type: object
+ token:
+ description: |-
+ A service account token used to authenticate against the Grafana instance.
+ Note: you need a token which has elevated permissions to create service accounts.
+ See here for the documentation on basic roles offered by Grafana:
+ https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+ properties:
+ key:
+ description: The key where the token is found.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: object
+ serviceAccount:
+ description: |-
+ ServiceAccount is the configuration for the service account that
+ is supposed to be generated by the generator.
+ properties:
+ name:
+ description: Name is the name of the service account that will be created by ESO.
+ type: string
+ role:
+ description: |-
+ Role is the role of the service account.
+ See here for the documentation on basic roles offered by Grafana:
+ https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
+ type: string
+ required:
+ - name
+ - role
+ type: object
+ url:
+ description: URL is the URL of the Grafana instance.
+ type: string
+ required:
+ - auth
+ - serviceAccount
+ - url
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/password.yaml b/charts/external-secrets/templates/crds/password.yaml
new file mode 100644
index 0000000..5904005
--- /dev/null
+++ b/charts/external-secrets/templates/crds/password.yaml
@@ -0,0 +1,95 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: passwords.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: Password
+ listKind: PasswordList
+ plural: passwords
+ singular: password
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Password generates a random password based on the
+ configuration parameters in spec.
+ You can specify the length, characterset and other attributes.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: PasswordSpec controls the behavior of the password generator.
+ properties:
+ allowRepeat:
+ default: false
+ description: set AllowRepeat to true to allow repeating characters.
+ type: boolean
+ digits:
+ description: |-
+ Digits specifies the number of digits in the generated
+ password. If omitted it defaults to 25% of the length of the password
+ type: integer
+ length:
+ default: 24
+ description: |-
+ Length of the password to be generated.
+ Defaults to 24
+ type: integer
+ noUpper:
+ default: false
+ description: Set NoUpper to disable uppercase characters
+ type: boolean
+ symbolCharacters:
+ description: |-
+ SymbolCharacters specifies the special characters that should be used
+ in the generated password.
+ type: string
+ symbols:
+ description: |-
+ Symbols specifies the number of symbol characters in the generated
+ password. If omitted it defaults to 25% of the length of the password
+ type: integer
+ required:
+ - allowRepeat
+ - length
+ - noUpper
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/pushsecret.yaml b/charts/external-secrets/templates/crds/pushsecret.yaml
new file mode 100644
index 0000000..e0e145b
--- /dev/null
+++ b/charts/external-secrets/templates/crds/pushsecret.yaml
@@ -0,0 +1,481 @@
+{{- if and (.Values.installCRDs) (.Values.crds.createPushSecret) }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: pushsecrets.external-secrets.io
+spec:
+ group: external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ kind: PushSecret
+ listKind: PushSecretList
+ plural: pushsecrets
+ shortNames:
+ - ps
+ singular: pushsecret
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .metadata.creationTimestamp
+ name: AGE
+ type: date
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: PushSecretSpec configures the behavior of the PushSecret.
+ properties:
+ data:
+ description: Secret Data that should be pushed to providers
+ items:
+ properties:
+ conversionStrategy:
+ default: None
+ description: Used to define a conversion Strategy for the secret keys
+ enum:
+ - None
+ - ReverseUnicode
+ type: string
+ match:
+ description: Match a given Secret Key to be pushed to the provider.
+ properties:
+ remoteRef:
+ description: Remote Refs to push to providers.
+ properties:
+ property:
+ description: Name of the property in the resulting secret
+ type: string
+ remoteKey:
+ description: Name of the resulting provider secret.
+ type: string
+ required:
+ - remoteKey
+ type: object
+ secretKey:
+ description: Secret Key to be pushed
+ type: string
+ required:
+ - remoteRef
+ type: object
+ metadata:
+ description: |-
+ Metadata is metadata attached to the secret.
+ The structure of metadata is provider specific, please look it up in the provider documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ required:
+ - match
+ type: object
+ type: array
+ deletionPolicy:
+ default: None
+ description: Deletion Policy to handle Secrets in the provider.
+ enum:
+ - Delete
+ - None
+ type: string
+ refreshInterval:
+ default: 1h
+ description: The Interval to which External Secrets will try to push a secret definition
+ type: string
+ secretStoreRefs:
+ items:
+ properties:
+ kind:
+ default: SecretStore
+ description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
+ enum:
+ - SecretStore
+ - ClusterSecretStore
+ type: string
+ labelSelector:
+ description: Optionally, sync to secret stores with label selector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ name:
+ description: Optionally, sync to the SecretStore of the given name
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ type: array
+ selector:
+ description: The Secret Selector (k8s source) for the Push Secret
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ generatorRef:
+ description: Point to a generator to create a Secret.
+ properties:
+ apiVersion:
+ default: generators.external-secrets.io/v1alpha1
+ description: Specify the apiVersion of the generator resource
+ type: string
+ kind:
+ description: Specify the Kind of the generator resource
+ enum:
+ - ACRAccessToken
+ - ClusterGenerator
+ - ECRAuthorizationToken
+ - Fake
+ - GCRAccessToken
+ - GithubAccessToken
+ - QuayAccessToken
+ - Password
+ - STSSessionToken
+ - UUID
+ - VaultDynamicSecret
+ - Webhook
+ - Grafana
+ type: string
+ name:
+ description: Specify the name of the generator resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - kind
+ - name
+ type: object
+ secret:
+ description: Select a Secret to Push.
+ properties:
+ name:
+ description: |-
+ Name of the Secret.
+ The Secret must exist in the same namespace as the PushSecret manifest.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ selector:
+ description: Selector chooses secrets using a labelSelector.
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ type: object
+ type: object
+ template:
+ description: Template defines a blueprint for the created Secret resource.
+ properties:
+ data:
+ additionalProperties:
+ type: string
+ type: object
+ engineVersion:
+ default: v2
+ description: |-
+ EngineVersion specifies the template engine version
+ that should be used to compile/execute the
+ template specified in .data and .templateFrom[].
+ enum:
+ - v2
+ type: string
+ mergePolicy:
+ default: Replace
+ enum:
+ - Replace
+ - Merge
+ type: string
+ metadata:
+ description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
+ properties:
+ annotations:
+ additionalProperties:
+ type: string
+ type: object
+ labels:
+ additionalProperties:
+ type: string
+ type: object
+ type: object
+ templateFrom:
+ items:
+ properties:
+ configMap:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ literal:
+ type: string
+ secret:
+ properties:
+ items:
+ description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
+ items:
+ properties:
+ key:
+ description: A key in the ConfigMap/Secret
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ templateAs:
+ default: Values
+ enum:
+ - Values
+ - KeysAndValues
+ type: string
+ required:
+ - key
+ type: object
+ type: array
+ name:
+ description: The name of the ConfigMap/Secret resource
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ required:
+ - items
+ - name
+ type: object
+ target:
+ default: Data
+ enum:
+ - Data
+ - Annotations
+ - Labels
+ type: string
+ type: object
+ type: array
+ type:
+ type: string
+ type: object
+ updatePolicy:
+ default: Replace
+ description: UpdatePolicy to handle Secrets in the provider.
+ enum:
+ - Replace
+ - IfNotExists
+ type: string
+ required:
+ - secretStoreRefs
+ - selector
+ type: object
+ status:
+ description: PushSecretStatus indicates the history of the status of PushSecret.
+ properties:
+ conditions:
+ items:
+ description: PushSecretStatusCondition indicates the status of the PushSecret.
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ description: PushSecretConditionType indicates the condition of the PushSecret.
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ refreshTime:
+ description: |-
+ refreshTime is the time and date the external secret was fetched and
+ the target secret updated
+ format: date-time
+ nullable: true
+ type: string
+ syncedPushSecrets:
+ additionalProperties:
+ additionalProperties:
+ properties:
+ conversionStrategy:
+ default: None
+ description: Used to define a conversion Strategy for the secret keys
+ enum:
+ - None
+ - ReverseUnicode
+ type: string
+ match:
+ description: Match a given Secret Key to be pushed to the provider.
+ properties:
+ remoteRef:
+ description: Remote Refs to push to providers.
+ properties:
+ property:
+ description: Name of the property in the resulting secret
+ type: string
+ remoteKey:
+ description: Name of the resulting provider secret.
+ type: string
+ required:
+ - remoteKey
+ type: object
+ secretKey:
+ description: Secret Key to be pushed
+ type: string
+ required:
+ - remoteRef
+ type: object
+ metadata:
+ description: |-
+ Metadata is metadata attached to the secret.
+ The structure of metadata is provider specific, please look it up in the provider documentation.
+ x-kubernetes-preserve-unknown-fields: true
+ required:
+ - match
+ type: object
+ type: object
+ description: |-
+ Synced PushSecrets, including secrets that already exist in provider.
+ Matches secret stores to PushSecretData that was stored to that secret store.
+ type: object
+ syncedResourceVersion:
+ description: SyncedResourceVersion keeps track of the last synced version.
+ type: string
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/quayaccesstoken.yaml b/charts/external-secrets/templates/crds/quayaccesstoken.yaml
new file mode 100644
index 0000000..32619c3
--- /dev/null
+++ b/charts/external-secrets/templates/crds/quayaccesstoken.yaml
@@ -0,0 +1,95 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: quayaccesstokens.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: QuayAccessToken
+ listKind: QuayAccessTokenList
+ plural: quayaccesstokens
+ singular: quayaccesstoken
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: QuayAccessToken generates Quay oauth token for pulling/pushing images
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ robotAccount:
+ description: Name of the robot account you are federating with
+ type: string
+ serviceAccountRef:
+ description: Name of the service account you are federating with
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ url:
+ description: URL configures the Quay instance URL. Defaults to quay.io.
+ type: string
+ required:
+ - robotAccount
+ - serviceAccountRef
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/secretstore.yaml b/charts/external-secrets/templates/crds/secretstore.yaml
new file mode 100644
index 0000000..2c1de2a
--- /dev/null
+++ b/charts/external-secrets/templates/crds/secretstore.yaml
@@ -0,0 +1,8311 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: secretstores.external-secrets.io
+spec:
+ group: external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ kind: SecretStore
+ listKind: SecretStoreList
+ plural: secretstores
+ shortNames:
+ - ss
+ singular: secretstore
+ scope: Namespaced
+ versions:
+ - additionalPrinterColumns:
+ - jsonPath: .metadata.creationTimestamp
+ name: AGE
+ type: date
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ - jsonPath: .status.capabilities
+ name: Capabilities
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1
+ schema:
+ openAPIV3Schema:
+ description: SecretStore represents a secure external location for storing secrets, which can be referenced as part of `storeRef` fields.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: SecretStoreSpec defines the desired state of SecretStore.
+ properties:
+ conditions:
+ description: Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore
+ items:
+ description: |-
+ ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in
+ for a ClusterSecretStore instance.
+ properties:
+ namespaceRegexes:
+ description: Choose namespaces by using regex matching
+ items:
+ type: string
+ type: array
+ namespaceSelector:
+ description: Choose namespace using a labelSelector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: Choose namespaces by name
+ items:
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: array
+ type: object
+ type: array
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters ES based on this property
+ type: string
+ provider:
+ description: Used to configure the provider. Only one provider may be set
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ akeyless:
+ description: Akeyless configures this store to sync secrets using Akeyless Vault provider
+ properties:
+ akeylessGWApiURL:
+ description: Akeyless GW API Url from which the secrets to be fetched from.
+ type: string
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Akeyless.
+ properties:
+ kubernetesAuth:
+ description: |-
+ Kubernetes authenticates with Akeyless by passing the ServiceAccount
+ token stored in the named Secret resource.
+ properties:
+ accessID:
+ description: the Akeyless Kubernetes auth-method access-id
+ type: string
+ k8sConfName:
+ description: Kubernetes-auth configuration name in Akeyless-Gateway
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Akeyless. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Akeyless. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - accessID
+ - k8sConfName
+ type: object
+ secretRef:
+ description: |-
+ Reference to a Secret that contains the details
+ to authenticate with Akeyless.
+ properties:
+ accessID:
+ description: The SecretAccessID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessType:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessTypeParam:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
+ if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Akeyless Gateway certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ required:
+ - akeylessGWApiURL
+ - authSecretRef
+ type: object
+ alibaba:
+ description: Alibaba configures this store to sync secrets using Alibaba Cloud provider
+ properties:
+ auth:
+ description: AlibabaAuth contains a secretRef for credentials.
+ properties:
+ rrsa:
+ description: Authenticate against Alibaba using RRSA.
+ properties:
+ oidcProviderArn:
+ type: string
+ oidcTokenFilePath:
+ type: string
+ roleArn:
+ type: string
+ sessionName:
+ type: string
+ required:
+ - oidcProviderArn
+ - oidcTokenFilePath
+ - roleArn
+ - sessionName
+ type: object
+ secretRef:
+ description: AlibabaAuthSecretRef holds secret references for Alibaba credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ regionID:
+ description: Alibaba Region to be used for the provider
+ type: string
+ required:
+ - auth
+ - regionID
+ type: object
+ aws:
+ description: AWS configures this store to sync secrets using AWS Secret Manager provider
+ properties:
+ additionalRoles:
+ description: AdditionalRoles is a chained list of Role ARNs which the provider will sequentially assume before assuming the Role
+ items:
+ type: string
+ type: array
+ auth:
+ description: |-
+ Auth defines the information necessary to authenticate against AWS
+ if not set aws sdk will infer credentials from your environment
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ prefix:
+ description: Prefix adds a prefix to all retrieved values.
+ type: string
+ region:
+ description: AWS Region to be used for the provider
+ type: string
+ role:
+ description: Role is a Role ARN which the provider will assume
+ type: string
+ secretsManager:
+ description: SecretsManager defines how the provider behaves when interacting with AWS SecretsManager
+ properties:
+ forceDeleteWithoutRecovery:
+ description: |-
+ Specifies whether to delete the secret without any recovery window. You
+ can't use both this parameter and RecoveryWindowInDays in the same call.
+ If you don't use either, then by default Secrets Manager uses a 30 day
+ recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery
+ type: boolean
+ recoveryWindowInDays:
+ description: |-
+ The number of days from 7 to 30 that Secrets Manager waits before
+ permanently deleting the secret. You can't use both this parameter and
+ ForceDeleteWithoutRecovery in the same call. If you don't use either,
+ then by default Secrets Manager uses a 30 day recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays
+ format: int64
+ type: integer
+ type: object
+ service:
+ description: Service defines which service should be used to fetch the secrets
+ enum:
+ - SecretsManager
+ - ParameterStore
+ type: string
+ sessionTags:
+ description: AWS STS assume role session tags
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ transitiveTagKeys:
+ description: AWS STS assume role transitive session tags. Required when multiple rules are used with the provider
+ items:
+ type: string
+ type: array
+ required:
+ - region
+ - service
+ type: object
+ azurekv:
+ description: AzureKV configures this store to sync secrets using Azure Key Vault provider
+ properties:
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ properties:
+ clientCertificate:
+ description: The Azure ClientCertificate of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientId:
+ description: The Azure clientId of the service principle or managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: The Azure ClientSecret of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ tenantId:
+ description: The Azure tenantId of the managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ authType:
+ default: ServicePrincipal
+ description: |-
+ Auth type defines how to authenticate to the keyvault service.
+ Valid values are:
+ - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret)
+ - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity)
+ enum:
+ - ServicePrincipal
+ - ManagedIdentity
+ - WorkloadIdentity
+ type: string
+ environmentType:
+ default: PublicCloud
+ description: |-
+ EnvironmentType specifies the Azure cloud environment endpoints to use for
+ connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
+ The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
+ PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
+ enum:
+ - PublicCloud
+ - USGovernmentCloud
+ - ChinaCloud
+ - GermanCloud
+ type: string
+ identityId:
+ description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ tenantId:
+ description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ type: string
+ vaultUrl:
+ description: Vault Url from which the secrets to be fetched from.
+ type: string
+ required:
+ - vaultUrl
+ type: object
+ beyondtrust:
+ description: Beyondtrust configures this store to sync secrets using Password Safe provider.
+ properties:
+ auth:
+ description: Auth configures how the operator authenticates with Beyondtrust.
+ properties:
+ apiKey:
+ description: APIKey If not provided then ClientID/ClientSecret become required.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificate:
+ description: Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificateKey:
+ description: Certificate private key (key.pem). For use when authenticating with an OAuth client Id
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientId:
+ description: ClientID is the API OAuth Client ID.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the API OAuth Client Secret.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ type: object
+ server:
+ description: Auth configures how API server works.
+ properties:
+ apiUrl:
+ type: string
+ apiVersion:
+ type: string
+ clientTimeOutSeconds:
+ description: Timeout specifies a time limit for requests made by this Client. The timeout includes connection time, any redirects, and reading the response body. Defaults to 45 seconds.
+ type: integer
+ retrievalType:
+ description: The secret retrieval type. SECRET = Secrets Safe (credential, text, file). MANAGED_ACCOUNT = Password Safe account associated with a system.
+ type: string
+ separator:
+ description: A character that separates the folder names.
+ type: string
+ verifyCA:
+ type: boolean
+ required:
+ - apiUrl
+ - verifyCA
+ type: object
+ required:
+ - auth
+ - server
+ type: object
+ bitwardensecretsmanager:
+ description: BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider
+ properties:
+ apiURL:
+ type: string
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with a bitwarden machine account instance.
+ Make sure that the token being used has permissions on the given secret.
+ properties:
+ secretRef:
+ description: BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.
+ properties:
+ credentials:
+ description: AccessToken used for the bitwarden instance.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - credentials
+ type: object
+ required:
+ - secretRef
+ type: object
+ bitwardenServerSDKURL:
+ type: string
+ caBundle:
+ description: |-
+ Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
+ can be performed.
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ identityURL:
+ type: string
+ organizationID:
+ description: OrganizationID determines which organization this secret store manages.
+ type: string
+ projectID:
+ description: ProjectID determines which project this secret store manages.
+ type: string
+ required:
+ - auth
+ - organizationID
+ - projectID
+ type: object
+ chef:
+ description: Chef configures this store to sync secrets with chef server
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against chef Server
+ properties:
+ secretRef:
+ description: ChefAuthSecretRef holds secret references for chef server login credentials.
+ properties:
+ privateKeySecretRef:
+ description: SecretKey is the Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKeySecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ serverUrl:
+ description: ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
+ type: string
+ username:
+ description: UserName should be the user ID on the chef server
+ type: string
+ required:
+ - auth
+ - serverUrl
+ - username
+ type: object
+ cloudrusm:
+ description: CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider
+ properties:
+ auth:
+ description: CSMAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: CSMAuthSecretRef holds secret references for Cloud.ru credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ projectID:
+ description: ProjectID is the project, which the secrets are stored in.
+ type: string
+ required:
+ - auth
+ type: object
+ conjur:
+ description: Conjur configures this store to sync secrets using conjur provider
+ properties:
+ auth:
+ description: Defines authentication settings for connecting to Conjur.
+ properties:
+ apikey:
+ description: Authenticates with Conjur using an API key.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ apiKeyRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur API key
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur username
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - account
+ - apiKeyRef
+ - userRef
+ type: object
+ jwt:
+ description: Jwt enables JWT authentication using Kubernetes service account tokens.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ hostId:
+ description: |-
+ Optional HostID for JWT authentication. This may be used depending
+ on how the Conjur JWT authenticator policy is configured.
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Conjur using the JWT authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional ServiceAccountRef specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ serviceID:
+ description: The conjur authn jwt webservice id
+ type: string
+ required:
+ - account
+ - serviceID
+ type: object
+ type: object
+ caBundle:
+ description: CABundle is a PEM encoded CA bundle that will be used to validate the Conjur server certificate.
+ type: string
+ caProvider:
+ description: |-
+ Used to provide custom certificate authority (CA) certificates
+ for a secret store. The CAProvider points to a Secret or ConfigMap resource
+ that contains a PEM-encoded certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ description: URL is the endpoint of the Conjur instance.
+ type: string
+ required:
+ - auth
+ - url
+ type: object
+ delinea:
+ description: |-
+ Delinea DevOps Secrets Vault
+ https://docs.delinea.com/online-help/products/devops-secrets-vault/current
+ properties:
+ clientId:
+ description: ClientID is the non-secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ tenant:
+ description: Tenant is the chosen hostname / site name.
+ type: string
+ tld:
+ description: |-
+ TLD is based on the server location that was chosen during provisioning.
+ If unset, defaults to "com".
+ type: string
+ urlTemplate:
+ description: |-
+ URLTemplate
+ If unset, defaults to "https://%s.secretsvaultcloud.%s/v1/%s%s".
+ type: string
+ required:
+ - clientId
+ - clientSecret
+ - tenant
+ type: object
+ device42:
+ description: Device42 configures this store to sync secrets using the Device42 provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Device42 instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ host:
+ description: URL configures the Device42 instance URL.
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ doppler:
+ description: Doppler configures this store to sync secrets using the Doppler provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Doppler API
+ properties:
+ secretRef:
+ properties:
+ dopplerToken:
+ description: |-
+ The DopplerToken is used for authentication.
+ See https://docs.doppler.com/reference/api#authentication for auth token types.
+ The Key attribute defaults to dopplerToken if not specified.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - dopplerToken
+ type: object
+ required:
+ - secretRef
+ type: object
+ config:
+ description: Doppler config (required if not using a Service Token)
+ type: string
+ format:
+ description: Format enables the downloading of secrets as a file (string)
+ enum:
+ - json
+ - dotnet-json
+ - env
+ - yaml
+ - docker
+ type: string
+ nameTransformer:
+ description: Environment variable compatible name transforms that change secret names to a different format
+ enum:
+ - upper-camel
+ - camel
+ - lower-snake
+ - tf-var
+ - dotnet-env
+ - lower-kebab
+ type: string
+ project:
+ description: Doppler project (required if not using a Service Token)
+ type: string
+ required:
+ - auth
+ type: object
+ fake:
+ description: Fake configures a store with static key/value pairs
+ properties:
+ data:
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ version:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ required:
+ - data
+ type: object
+ fortanix:
+ description: Fortanix configures this store to sync secrets using the Fortanix provider
+ properties:
+ apiKey:
+ description: APIKey is the API token to access SDKMS Applications.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the SDKMS API Key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ description: APIURL is the URL of SDKMS API. Defaults to `sdkms.fortanix.com`.
+ type: string
+ type: object
+ gcpsm:
+ description: GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against GCP
+ properties:
+ secretRef:
+ properties:
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ workloadIdentity:
+ properties:
+ clusterLocation:
+ description: |-
+ ClusterLocation is the location of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterName:
+ description: |-
+ ClusterName is the name of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterProjectID:
+ description: |-
+ ClusterProjectID is the project ID of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ type: object
+ location:
+ description: Location optionally defines a location for a secret
+ type: string
+ projectID:
+ description: ProjectID project where secret is located
+ type: string
+ type: object
+ github:
+ description: Github configures this store to push Github Action secrets using Github API provider
+ properties:
+ appID:
+ description: appID specifies the Github APP that will be used to authenticate the client
+ format: int64
+ type: integer
+ auth:
+ description: auth configures how secret-manager authenticates with a Github instance.
+ properties:
+ privateKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKey
+ type: object
+ environment:
+ description: environment will be used to fetch secrets from a particular environment within a github repository
+ type: string
+ installationID:
+ description: installationID specifies the Github APP installation that will be used to authenticate the client
+ format: int64
+ type: integer
+ organization:
+ description: organization will be used to fetch secrets from the Github organization
+ type: string
+ repository:
+ description: repository will be used to fetch secrets from the Github repository within an organization
+ type: string
+ uploadURL:
+ description: Upload URL for enterprise instances. Default to URL.
+ type: string
+ url:
+ default: https://github.com/
+ description: URL configures the Github instance URL. Defaults to https://github.com/.
+ type: string
+ required:
+ - appID
+ - auth
+ - installationID
+ - organization
+ type: object
+ gitlab:
+ description: GitLab configures this store to sync secrets using GitLab Variables provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a GitLab instance.
+ properties:
+ SecretRef:
+ properties:
+ accessToken:
+ description: AccessToken is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - SecretRef
+ type: object
+ environment:
+ description: Environment environment_scope of gitlab CI/CD variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment on how to create environments)
+ type: string
+ groupIDs:
+ description: GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables.
+ items:
+ type: string
+ type: array
+ inheritFromGroups:
+ description: InheritFromGroups specifies whether parent groups should be discovered and checked for secrets.
+ type: boolean
+ projectID:
+ description: ProjectID specifies a project where secrets are located.
+ type: string
+ url:
+ description: URL configures the GitLab instance URL. Defaults to https://gitlab.com/.
+ type: string
+ required:
+ - auth
+ type: object
+ ibm:
+ description: IBM configures this store to sync secrets using IBM Cloud provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the IBM secrets manager.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ containerAuth:
+ description: IBM Container-based auth with IAM Trusted Profile.
+ properties:
+ iamEndpoint:
+ type: string
+ profile:
+ description: the IBM Trusted Profile
+ type: string
+ tokenLocation:
+ description: Location the token is mounted on the pod
+ type: string
+ required:
+ - profile
+ type: object
+ secretRef:
+ properties:
+ secretApiKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ serviceUrl:
+ description: ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance
+ type: string
+ required:
+ - auth
+ type: object
+ infisical:
+ description: Infisical configures this store to sync secrets using the Infisical provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Infisical API
+ properties:
+ universalAuthCredentials:
+ properties:
+ clientId:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecret
+ type: object
+ type: object
+ hostAPI:
+ default: https://app.infisical.com/api
+ description: HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
+ type: string
+ secretsScope:
+ description: SecretsScope defines the scope of the secrets within the workspace
+ properties:
+ environmentSlug:
+ description: EnvironmentSlug is the required slug identifier for the environment.
+ type: string
+ expandSecretReferences:
+ default: true
+ description: ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+ type: boolean
+ projectSlug:
+ description: ProjectSlug is the required slug identifier for the project.
+ type: string
+ recursive:
+ default: false
+ description: Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
+ type: boolean
+ secretsPath:
+ default: /
+ description: SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
+ type: string
+ required:
+ - environmentSlug
+ - projectSlug
+ type: object
+ required:
+ - auth
+ - secretsScope
+ type: object
+ keepersecurity:
+ description: KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider
+ properties:
+ authRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ folderID:
+ type: string
+ required:
+ - authRef
+ - folderID
+ type: object
+ kubernetes:
+ description: Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Kubernetes instance.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ cert:
+ description: has both clientCert and clientKey as secretKeySelector
+ properties:
+ clientCert:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ serviceAccount:
+ description: points to a service account that should be used for authentication
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ token:
+ description: use static token to authenticate with
+ properties:
+ bearerToken:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ authRef:
+ description: A reference to a secret that contains the auth information.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ remoteNamespace:
+ default: default
+ description: Remote namespace to fetch the secrets from
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ server:
+ description: configures the Kubernetes server Address.
+ properties:
+ caBundle:
+ description: CABundle is a base64-encoded CA certificate
+ format: byte
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ default: kubernetes.default
+ description: configures the Kubernetes server Address.
+ type: string
+ type: object
+ type: object
+ onboardbase:
+ description: Onboardbase configures this store to sync secrets using the Onboardbase provider
+ properties:
+ apiHost:
+ default: https://public.onboardbase.com/api/v1/
+ description: APIHost use this to configure the host url for the API for selfhosted installation, default is https://public.onboardbase.com/api/v1/
+ type: string
+ auth:
+ description: Auth configures how the Operator authenticates with the Onboardbase API
+ properties:
+ apiKeyRef:
+ description: |-
+ OnboardbaseAPIKey is the APIKey generated by an admin account.
+ It is used to recognize and authorize access to a project and environment within onboardbase
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ passcodeRef:
+ description: OnboardbasePasscode is the passcode attached to the API Key
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - apiKeyRef
+ - passcodeRef
+ type: object
+ environment:
+ default: development
+ description: Environment is the name of an environmnent within a project to pull the secrets from
+ type: string
+ project:
+ default: development
+ description: Project is an onboardbase project that the secrets should be pulled from
+ type: string
+ required:
+ - apiHost
+ - auth
+ - environment
+ - project
+ type: object
+ onepassword:
+ description: OnePassword configures this store to sync secrets using the 1Password Cloud provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against OnePassword Connect Server
+ properties:
+ secretRef:
+ description: OnePasswordAuthSecretRef holds secret references for 1Password credentials.
+ properties:
+ connectTokenSecretRef:
+ description: The ConnectToken is used for authentication to a 1Password Connect Server.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - connectTokenSecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ connectHost:
+ description: ConnectHost defines the OnePassword Connect Server to connect to
+ type: string
+ vaults:
+ additionalProperties:
+ type: integer
+ description: Vaults defines which OnePassword vaults to search in which order
+ type: object
+ required:
+ - auth
+ - connectHost
+ - vaults
+ type: object
+ oracle:
+ description: Oracle configures this store to sync secrets using Oracle Vault provider
+ properties:
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with the Oracle Vault.
+ If empty, use the instance principal, otherwise the user credentials specified in Auth.
+ properties:
+ secretRef:
+ description: SecretRef to pass through sensitive information.
+ properties:
+ fingerprint:
+ description: Fingerprint is the fingerprint of the API private key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privatekey:
+ description: PrivateKey is the user's API Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - fingerprint
+ - privatekey
+ type: object
+ tenancy:
+ description: Tenancy is the tenancy OCID where user is located.
+ type: string
+ user:
+ description: User is an access OCID specific to the account.
+ type: string
+ required:
+ - secretRef
+ - tenancy
+ - user
+ type: object
+ compartment:
+ description: |-
+ Compartment is the vault compartment OCID.
+ Required for PushSecret
+ type: string
+ encryptionKey:
+ description: |-
+ EncryptionKey is the OCID of the encryption key within the vault.
+ Required for PushSecret
+ type: string
+ principalType:
+ description: |-
+ The type of principal to use for authentication. If left blank, the Auth struct will
+ determine the principal type. This optional field must be specified if using
+ workload identity.
+ enum:
+ - ""
+ - UserPrincipal
+ - InstancePrincipal
+ - Workload
+ type: string
+ region:
+ description: Region is the region where vault is located.
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ vault:
+ description: Vault is the vault's OCID of the specific vault where secret is located.
+ type: string
+ required:
+ - region
+ - vault
+ type: object
+ passbolt:
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against Passbolt Server
+ properties:
+ passwordSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privateKeySecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecretRef
+ - privateKeySecretRef
+ type: object
+ host:
+ description: Host defines the Passbolt Server to connect to
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ passworddepot:
+ description: Configures a store to sync secrets with a Password Depot instance.
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Password Depot instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ database:
+ description: Database to use as source
+ type: string
+ host:
+ description: URL configures the Password Depot instance URL.
+ type: string
+ required:
+ - auth
+ - database
+ - host
+ type: object
+ previder:
+ description: Previder configures this store to sync secrets using the Previder provider
+ properties:
+ auth:
+ description: PreviderAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: PreviderAuthSecretRef holds secret references for Previder Vault credentials.
+ properties:
+ accessToken:
+ description: The AccessToken is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessToken
+ type: object
+ type: object
+ baseUri:
+ type: string
+ required:
+ - auth
+ type: object
+ pulumi:
+ description: Pulumi configures this store to sync secrets using the Pulumi provider
+ properties:
+ accessToken:
+ description: AccessToken is the access tokens to sign in to the Pulumi Cloud Console.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the Pulumi API token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ default: https://api.pulumi.com/api/esc
+ description: APIURL is the URL of the Pulumi API.
+ type: string
+ environment:
+ description: |-
+ Environment are YAML documents composed of static key-value pairs, programmatic expressions,
+ dynamically retrieved values from supported providers including all major clouds,
+ and other Pulumi ESC environments.
+ To create a new environment, visit https://www.pulumi.com/docs/esc/environments/ for more information.
+ type: string
+ organization:
+ description: |-
+ Organization are a space to collaborate on shared projects and stacks.
+ To create a new organization, visit https://app.pulumi.com/ and click "New Organization".
+ type: string
+ project:
+ description: Project is the name of the Pulumi ESC project the environment belongs to.
+ type: string
+ required:
+ - accessToken
+ - environment
+ - organization
+ - project
+ type: object
+ scaleway:
+ description: Scaleway
+ properties:
+ accessKey:
+ description: AccessKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ apiUrl:
+ description: APIURL is the url of the api to use. Defaults to https://api.scaleway.com
+ type: string
+ projectId:
+ description: 'ProjectID is the id of your project, which you can find in the console: https://console.scaleway.com/project/settings'
+ type: string
+ region:
+ description: 'Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone'
+ type: string
+ secretKey:
+ description: SecretKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - accessKey
+ - projectId
+ - region
+ - secretKey
+ type: object
+ secretserver:
+ description: |-
+ SecretServer configures this store to sync secrets using SecretServer provider
+ https://docs.delinea.com/online-help/secret-server/start.htm
+ properties:
+ password:
+ description: Password is the secret server account password.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ serverURL:
+ description: |-
+ ServerURL
+ URL to your secret server installation
+ type: string
+ username:
+ description: Username is the secret server account username.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - password
+ - serverURL
+ - username
+ type: object
+ senhasegura:
+ description: Senhasegura configures this store to sync secrets using senhasegura provider
+ properties:
+ auth:
+ description: Auth defines parameters to authenticate in senhasegura
+ properties:
+ clientId:
+ type: string
+ clientSecretSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecretSecretRef
+ type: object
+ ignoreSslCertificate:
+ default: false
+ description: IgnoreSslCertificate defines if SSL certificate must be ignored
+ type: boolean
+ module:
+ description: Module defines which senhasegura module should be used to get secrets
+ type: string
+ url:
+ description: URL of senhasegura
+ type: string
+ required:
+ - auth
+ - module
+ - url
+ type: object
+ vault:
+ description: Vault configures this store to sync secrets using Hashi provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ default: approle
+ description: |-
+ Path where the App Role authentication backend is mounted
+ in Vault, e.g: "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ roleRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role ID used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role id.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ - secretRef
+ type: object
+ cert:
+ description: |-
+ Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
+ Cert authentication method
+ properties:
+ clientCert:
+ description: |-
+ ClientCert is a certificate to authenticate using the Cert Vault
+ authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing client private key to
+ authenticate with Vault using the Cert authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ iam:
+ description: |-
+ Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
+ AWS IAM authentication method
+ properties:
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ jwt:
+ description: Specify a service account with IRSA enabled
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ path:
+ description: 'Path where the AWS auth method is enabled in Vault, e.g: "aws"'
+ type: string
+ region:
+ description: AWS region
+ type: string
+ role:
+ description: This is the AWS role to be assumed before talking to vault
+ type: string
+ secretRef:
+ description: Specify credentials in a Secret object
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ vaultAwsIamServerID:
+ description: 'X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws'
+ type: string
+ vaultRole:
+ description: Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine
+ type: string
+ required:
+ - vaultRole
+ type: object
+ jwt:
+ description: |-
+ Jwt authenticates with Vault by passing role and JWT token using the
+ JWT/OIDC authentication method
+ properties:
+ kubernetesServiceAccountToken:
+ description: |-
+ Optional ServiceAccountToken specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Optional audiences field that will be used to request a temporary Kubernetes service
+ account token for the service account referenced by `serviceAccountRef`.
+ Defaults to a single audience `vault` it not specified.
+ Deprecated: use serviceAccountRef.Audiences instead
+ items:
+ type: string
+ type: array
+ expirationSeconds:
+ description: |-
+ Optional expiration time in seconds that will be used to request a temporary
+ Kubernetes service account token for the service account referenced by
+ `serviceAccountRef`.
+ Deprecated: this will be removed in the future.
+ Defaults to 10 minutes.
+ format: int64
+ type: integer
+ serviceAccountRef:
+ description: Service account field containing the name of a kubernetes ServiceAccount.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ path:
+ default: jwt
+ description: |-
+ Path where the JWT authentication backend is mounted
+ in Vault, e.g: "jwt"
+ type: string
+ role:
+ description: |-
+ Role is a JWT role to authenticate using the JWT/OIDC Vault
+ authentication method
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Vault using the JWT/OIDC authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ default: kubernetes
+ description: |-
+ Path where the Kubernetes authentication backend is mounted in Vault, e.g:
+ "kubernetes"
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Vault. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - mountPath
+ - role
+ type: object
+ ldap:
+ description: |-
+ Ldap authenticates with Vault by passing username/password pair using
+ the LDAP authentication method
+ properties:
+ path:
+ default: ldap
+ description: |-
+ Path where the LDAP authentication backend is mounted
+ in Vault, e.g: "ldap"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the LDAP
+ user used to authenticate with Vault using the LDAP authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is an LDAP username used to authenticate using the LDAP Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
+ Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ This will default to Vault.Namespace field if set, or empty otherwise
+ type: string
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userPass:
+ description: UserPass authenticates with Vault by passing username/password pair
+ properties:
+ path:
+ default: userpass
+ description: |-
+ Path where the UserPassword authentication backend is mounted
+ in Vault, e.g: "userpass"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the
+ user used to authenticate with Vault using the UserPass authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is a username used to authenticate using the UserPass Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Vault server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Vault server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ forwardInconsistent:
+ description: |-
+ ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
+ leader instead of simply retrying within a loop. This can increase performance if
+ the option is enabled serverside.
+ https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
+ type: boolean
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers to be added in Vault request
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault KV backend endpoint, e.g:
+ "secret". The v2 KV secret engine version specific "/data" path suffix
+ for fetching secrets from Vault is optional and will be appended
+ if not present in specified path.
+ type: string
+ readYourWrites:
+ description: |-
+ ReadYourWrites ensures isolated read-after-write semantics by
+ providing discovered cluster replication states in each request.
+ More information about eventual consistency in Vault can be found here
+ https://www.vaultproject.io/docs/enterprise/consistency
+ type: boolean
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ tls:
+ description: |-
+ The configuration used for client side related TLS communication, when the Vault server
+ requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
+ This parameter is ignored for plain HTTP protocol connection.
+ It's worth noting this configuration is different from the "TLS certificates auth method",
+ which is available under the `auth.cert` section.
+ properties:
+ certSecretRef:
+ description: |-
+ CertSecretRef is a certificate added to the transport layer
+ when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.crt'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ keySecretRef:
+ description: |-
+ KeySecretRef to a key in a Secret resource containing client private key
+ added to the transport layer when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.key'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ version:
+ default: v2
+ description: |-
+ Version is the Vault KV secret engine version. This can be either "v1" or
+ "v2". Version defaults to "v2".
+ enum:
+ - v1
+ - v2
+ type: string
+ required:
+ - server
+ type: object
+ webhook:
+ description: Webhook configures this store to sync secrets using a generic templated webhook
+ properties:
+ auth:
+ description: Auth specifies a authorization protocol. Only one protocol may be set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ ntlm:
+ description: NTLMProtocol configures the store to use NTLM for auth
+ properties:
+ passwordSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ usernameSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecret
+ - usernameSecret
+ type: object
+ type: object
+ body:
+ description: Body
+ type: string
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate webhook server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate webhook server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: The namespace the Provider type is in.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers
+ type: object
+ method:
+ description: Webhook Method
+ type: string
+ result:
+ description: Result formatting
+ properties:
+ jsonPath:
+ description: Json path of return value
+ type: string
+ type: object
+ secrets:
+ description: |-
+ Secrets to fill in templates
+ These secrets will be passed to the templating function as key value pairs under the given name
+ items:
+ properties:
+ name:
+ description: Name of this secret in templates
+ type: string
+ secretRef:
+ description: Secret ref to fill in credentials
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - name
+ - secretRef
+ type: object
+ type: array
+ timeout:
+ description: Timeout
+ type: string
+ url:
+ description: Webhook url to call
+ type: string
+ required:
+ - result
+ - url
+ type: object
+ yandexcertificatemanager:
+ description: YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Certificate Manager
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ yandexlockbox:
+ description: YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Lockbox
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ type: object
+ refreshInterval:
+ description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.
+ type: integer
+ retrySettings:
+ description: Used to configure http retries if failed
+ properties:
+ maxRetries:
+ format: int32
+ type: integer
+ retryInterval:
+ type: string
+ type: object
+ required:
+ - provider
+ type: object
+ status:
+ description: SecretStoreStatus defines the observed state of the SecretStore.
+ properties:
+ capabilities:
+ description: SecretStoreCapabilities defines the possible operations a SecretStore can do.
+ type: string
+ conditions:
+ items:
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+ - additionalPrinterColumns:
+ - jsonPath: .metadata.creationTimestamp
+ name: AGE
+ type: date
+ - jsonPath: .status.conditions[?(@.type=="Ready")].reason
+ name: Status
+ type: string
+ - jsonPath: .status.capabilities
+ name: Capabilities
+ type: string
+ - jsonPath: .status.conditions[?(@.type=="Ready")].status
+ name: Ready
+ type: string
+ name: v1beta1
+ schema:
+ openAPIV3Schema:
+ description: SecretStore represents a secure external location for storing secrets, which can be referenced as part of `storeRef` fields.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: SecretStoreSpec defines the desired state of SecretStore.
+ properties:
+ conditions:
+ description: Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore
+ items:
+ description: |-
+ ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in
+ for a ClusterSecretStore instance.
+ properties:
+ namespaceRegexes:
+ description: Choose namespaces by using regex matching
+ items:
+ type: string
+ type: array
+ namespaceSelector:
+ description: Choose namespace using a labelSelector
+ properties:
+ matchExpressions:
+ description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
+ items:
+ description: |-
+ A label selector requirement is a selector that contains values, a key, and an operator that
+ relates the key and values.
+ properties:
+ key:
+ description: key is the label key that the selector applies to.
+ type: string
+ operator:
+ description: |-
+ operator represents a key's relationship to a set of values.
+ Valid operators are In, NotIn, Exists and DoesNotExist.
+ type: string
+ values:
+ description: |-
+ values is an array of string values. If the operator is In or NotIn,
+ the values array must be non-empty. If the operator is Exists or DoesNotExist,
+ the values array must be empty. This array is replaced during a strategic
+ merge patch.
+ items:
+ type: string
+ type: array
+ x-kubernetes-list-type: atomic
+ required:
+ - key
+ - operator
+ type: object
+ type: array
+ x-kubernetes-list-type: atomic
+ matchLabels:
+ additionalProperties:
+ type: string
+ description: |-
+ matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
+ map is equivalent to an element of matchExpressions, whose key field is "key", the
+ operator is "In", and the values array contains only "value". The requirements are ANDed.
+ type: object
+ type: object
+ x-kubernetes-map-type: atomic
+ namespaces:
+ description: Choose namespaces by name
+ items:
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: array
+ type: object
+ type: array
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters ES based on this property
+ type: string
+ provider:
+ description: Used to configure the provider. Only one provider may be set
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ akeyless:
+ description: Akeyless configures this store to sync secrets using Akeyless Vault provider
+ properties:
+ akeylessGWApiURL:
+ description: Akeyless GW API Url from which the secrets to be fetched from.
+ type: string
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Akeyless.
+ properties:
+ kubernetesAuth:
+ description: |-
+ Kubernetes authenticates with Akeyless by passing the ServiceAccount
+ token stored in the named Secret resource.
+ properties:
+ accessID:
+ description: the Akeyless Kubernetes auth-method access-id
+ type: string
+ k8sConfName:
+ description: Kubernetes-auth configuration name in Akeyless-Gateway
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Akeyless. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Akeyless. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - accessID
+ - k8sConfName
+ type: object
+ secretRef:
+ description: |-
+ Reference to a Secret that contains the details
+ to authenticate with Akeyless.
+ properties:
+ accessID:
+ description: The SecretAccessID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessType:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessTypeParam:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
+ if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Akeyless Gateway certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ required:
+ - akeylessGWApiURL
+ - authSecretRef
+ type: object
+ alibaba:
+ description: Alibaba configures this store to sync secrets using Alibaba Cloud provider
+ properties:
+ auth:
+ description: AlibabaAuth contains a secretRef for credentials.
+ properties:
+ rrsa:
+ description: Authenticate against Alibaba using RRSA.
+ properties:
+ oidcProviderArn:
+ type: string
+ oidcTokenFilePath:
+ type: string
+ roleArn:
+ type: string
+ sessionName:
+ type: string
+ required:
+ - oidcProviderArn
+ - oidcTokenFilePath
+ - roleArn
+ - sessionName
+ type: object
+ secretRef:
+ description: AlibabaAuthSecretRef holds secret references for Alibaba credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ regionID:
+ description: Alibaba Region to be used for the provider
+ type: string
+ required:
+ - auth
+ - regionID
+ type: object
+ aws:
+ description: AWS configures this store to sync secrets using AWS Secret Manager provider
+ properties:
+ additionalRoles:
+ description: AdditionalRoles is a chained list of Role ARNs which the provider will sequentially assume before assuming the Role
+ items:
+ type: string
+ type: array
+ auth:
+ description: |-
+ Auth defines the information necessary to authenticate against AWS
+ if not set aws sdk will infer credentials from your environment
+ see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ prefix:
+ description: Prefix adds a prefix to all retrieved values.
+ type: string
+ region:
+ description: AWS Region to be used for the provider
+ type: string
+ role:
+ description: Role is a Role ARN which the provider will assume
+ type: string
+ secretsManager:
+ description: SecretsManager defines how the provider behaves when interacting with AWS SecretsManager
+ properties:
+ forceDeleteWithoutRecovery:
+ description: |-
+ Specifies whether to delete the secret without any recovery window. You
+ can't use both this parameter and RecoveryWindowInDays in the same call.
+ If you don't use either, then by default Secrets Manager uses a 30 day
+ recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery
+ type: boolean
+ recoveryWindowInDays:
+ description: |-
+ The number of days from 7 to 30 that Secrets Manager waits before
+ permanently deleting the secret. You can't use both this parameter and
+ ForceDeleteWithoutRecovery in the same call. If you don't use either,
+ then by default Secrets Manager uses a 30 day recovery window.
+ see: https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays
+ format: int64
+ type: integer
+ type: object
+ service:
+ description: Service defines which service should be used to fetch the secrets
+ enum:
+ - SecretsManager
+ - ParameterStore
+ type: string
+ sessionTags:
+ description: AWS STS assume role session tags
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ transitiveTagKeys:
+ description: AWS STS assume role transitive session tags. Required when multiple rules are used with the provider
+ items:
+ type: string
+ type: array
+ required:
+ - region
+ - service
+ type: object
+ azurekv:
+ description: AzureKV configures this store to sync secrets using Azure Key Vault provider
+ properties:
+ authSecretRef:
+ description: Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ properties:
+ clientCertificate:
+ description: The Azure ClientCertificate of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientId:
+ description: The Azure clientId of the service principle or managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: The Azure ClientSecret of the service principle used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ tenantId:
+ description: The Azure tenantId of the managed identity used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ authType:
+ default: ServicePrincipal
+ description: |-
+ Auth type defines how to authenticate to the keyvault service.
+ Valid values are:
+ - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret)
+ - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity)
+ enum:
+ - ServicePrincipal
+ - ManagedIdentity
+ - WorkloadIdentity
+ type: string
+ environmentType:
+ default: PublicCloud
+ description: |-
+ EnvironmentType specifies the Azure cloud environment endpoints to use for
+ connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
+ The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
+ PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
+ enum:
+ - PublicCloud
+ - USGovernmentCloud
+ - ChinaCloud
+ - GermanCloud
+ type: string
+ identityId:
+ description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ tenantId:
+ description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
+ type: string
+ vaultUrl:
+ description: Vault Url from which the secrets to be fetched from.
+ type: string
+ required:
+ - vaultUrl
+ type: object
+ beyondtrust:
+ description: Beyondtrust configures this store to sync secrets using Password Safe provider.
+ properties:
+ auth:
+ description: Auth configures how the operator authenticates with Beyondtrust.
+ properties:
+ apiKey:
+ description: APIKey If not provided then ClientID/ClientSecret become required.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificate:
+ description: Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ certificateKey:
+ description: Certificate private key (key.pem). For use when authenticating with an OAuth client Id
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientId:
+ description: ClientID is the API OAuth Client ID.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the API OAuth Client Secret.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ type: object
+ server:
+ description: Auth configures how API server works.
+ properties:
+ apiUrl:
+ type: string
+ apiVersion:
+ type: string
+ clientTimeOutSeconds:
+ description: Timeout specifies a time limit for requests made by this Client. The timeout includes connection time, any redirects, and reading the response body. Defaults to 45 seconds.
+ type: integer
+ retrievalType:
+ description: The secret retrieval type. SECRET = Secrets Safe (credential, text, file). MANAGED_ACCOUNT = Password Safe account associated with a system.
+ type: string
+ separator:
+ description: A character that separates the folder names.
+ type: string
+ verifyCA:
+ type: boolean
+ required:
+ - apiUrl
+ - verifyCA
+ type: object
+ required:
+ - auth
+ - server
+ type: object
+ bitwardensecretsmanager:
+ description: BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider
+ properties:
+ apiURL:
+ type: string
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with a bitwarden machine account instance.
+ Make sure that the token being used has permissions on the given secret.
+ properties:
+ secretRef:
+ description: BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.
+ properties:
+ credentials:
+ description: AccessToken used for the bitwarden instance.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - credentials
+ type: object
+ required:
+ - secretRef
+ type: object
+ bitwardenServerSDKURL:
+ type: string
+ caBundle:
+ description: |-
+ Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
+ can be performed.
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ identityURL:
+ type: string
+ organizationID:
+ description: OrganizationID determines which organization this secret store manages.
+ type: string
+ projectID:
+ description: ProjectID determines which project this secret store manages.
+ type: string
+ required:
+ - auth
+ - organizationID
+ - projectID
+ type: object
+ chef:
+ description: Chef configures this store to sync secrets with chef server
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against chef Server
+ properties:
+ secretRef:
+ description: ChefAuthSecretRef holds secret references for chef server login credentials.
+ properties:
+ privateKeySecretRef:
+ description: SecretKey is the Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKeySecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ serverUrl:
+ description: ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
+ type: string
+ username:
+ description: UserName should be the user ID on the chef server
+ type: string
+ required:
+ - auth
+ - serverUrl
+ - username
+ type: object
+ cloudrusm:
+ description: CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider
+ properties:
+ auth:
+ description: CSMAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: CSMAuthSecretRef holds secret references for Cloud.ru credentials.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ accessKeySecretSecretRef:
+ description: The AccessKeySecret is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessKeyIDSecretRef
+ - accessKeySecretSecretRef
+ type: object
+ type: object
+ projectID:
+ description: ProjectID is the project, which the secrets are stored in.
+ type: string
+ required:
+ - auth
+ type: object
+ conjur:
+ description: Conjur configures this store to sync secrets using conjur provider
+ properties:
+ auth:
+ description: Defines authentication settings for connecting to Conjur.
+ properties:
+ apikey:
+ description: Authenticates with Conjur using an API key.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ apiKeyRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur API key
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userRef:
+ description: |-
+ A reference to a specific 'key' containing the Conjur username
+ within a Secret resource. In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - account
+ - apiKeyRef
+ - userRef
+ type: object
+ jwt:
+ description: Jwt enables JWT authentication using Kubernetes service account tokens.
+ properties:
+ account:
+ description: Account is the Conjur organization account name.
+ type: string
+ hostId:
+ description: |-
+ Optional HostID for JWT authentication. This may be used depending
+ on how the Conjur JWT authenticator policy is configured.
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Conjur using the JWT authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional ServiceAccountRef specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ serviceID:
+ description: The conjur authn jwt webservice id
+ type: string
+ required:
+ - account
+ - serviceID
+ type: object
+ type: object
+ caBundle:
+ description: CABundle is a PEM encoded CA bundle that will be used to validate the Conjur server certificate.
+ type: string
+ caProvider:
+ description: |-
+ Used to provide custom certificate authority (CA) certificates
+ for a secret store. The CAProvider points to a Secret or ConfigMap resource
+ that contains a PEM-encoded certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ description: URL is the endpoint of the Conjur instance.
+ type: string
+ required:
+ - auth
+ - url
+ type: object
+ delinea:
+ description: |-
+ Delinea DevOps Secrets Vault
+ https://docs.delinea.com/online-help/products/devops-secrets-vault/current
+ properties:
+ clientId:
+ description: ClientID is the non-secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ clientSecret:
+ description: ClientSecret is the secret part of the credential.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ tenant:
+ description: Tenant is the chosen hostname / site name.
+ type: string
+ tld:
+ description: |-
+ TLD is based on the server location that was chosen during provisioning.
+ If unset, defaults to "com".
+ type: string
+ urlTemplate:
+ description: |-
+ URLTemplate
+ If unset, defaults to "https://%s.secretsvaultcloud.%s/v1/%s%s".
+ type: string
+ required:
+ - clientId
+ - clientSecret
+ - tenant
+ type: object
+ device42:
+ description: Device42 configures this store to sync secrets using the Device42 provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Device42 instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ host:
+ description: URL configures the Device42 instance URL.
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ doppler:
+ description: Doppler configures this store to sync secrets using the Doppler provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Doppler API
+ properties:
+ secretRef:
+ properties:
+ dopplerToken:
+ description: |-
+ The DopplerToken is used for authentication.
+ See https://docs.doppler.com/reference/api#authentication for auth token types.
+ The Key attribute defaults to dopplerToken if not specified.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - dopplerToken
+ type: object
+ required:
+ - secretRef
+ type: object
+ config:
+ description: Doppler config (required if not using a Service Token)
+ type: string
+ format:
+ description: Format enables the downloading of secrets as a file (string)
+ enum:
+ - json
+ - dotnet-json
+ - env
+ - yaml
+ - docker
+ type: string
+ nameTransformer:
+ description: Environment variable compatible name transforms that change secret names to a different format
+ enum:
+ - upper-camel
+ - camel
+ - lower-snake
+ - tf-var
+ - dotnet-env
+ - lower-kebab
+ type: string
+ project:
+ description: Doppler project (required if not using a Service Token)
+ type: string
+ required:
+ - auth
+ type: object
+ fake:
+ description: Fake configures a store with static key/value pairs
+ properties:
+ data:
+ items:
+ properties:
+ key:
+ type: string
+ value:
+ type: string
+ version:
+ type: string
+ required:
+ - key
+ - value
+ type: object
+ type: array
+ required:
+ - data
+ type: object
+ fortanix:
+ description: Fortanix configures this store to sync secrets using the Fortanix provider
+ properties:
+ apiKey:
+ description: APIKey is the API token to access SDKMS Applications.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the SDKMS API Key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ description: APIURL is the URL of SDKMS API. Defaults to `sdkms.fortanix.com`.
+ type: string
+ type: object
+ gcpsm:
+ description: GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against GCP
+ properties:
+ secretRef:
+ properties:
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ workloadIdentity:
+ properties:
+ clusterLocation:
+ description: |-
+ ClusterLocation is the location of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterName:
+ description: |-
+ ClusterName is the name of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ clusterProjectID:
+ description: |-
+ ClusterProjectID is the project ID of the cluster
+ If not specified, it fetches information from the metadata server
+ type: string
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ type: object
+ location:
+ description: Location optionally defines a location for a secret
+ type: string
+ projectID:
+ description: ProjectID project where secret is located
+ type: string
+ type: object
+ github:
+ description: Github configures this store to push Github Action secrets using Github API provider
+ properties:
+ appID:
+ description: appID specifies the Github APP that will be used to authenticate the client
+ format: int64
+ type: integer
+ auth:
+ description: auth configures how secret-manager authenticates with a Github instance.
+ properties:
+ privateKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - privateKey
+ type: object
+ environment:
+ description: environment will be used to fetch secrets from a particular environment within a github repository
+ type: string
+ installationID:
+ description: installationID specifies the Github APP installation that will be used to authenticate the client
+ format: int64
+ type: integer
+ organization:
+ description: organization will be used to fetch secrets from the Github organization
+ type: string
+ repository:
+ description: repository will be used to fetch secrets from the Github repository within an organization
+ type: string
+ uploadURL:
+ description: Upload URL for enterprise instances. Default to URL.
+ type: string
+ url:
+ default: https://github.com/
+ description: URL configures the Github instance URL. Defaults to https://github.com/.
+ type: string
+ required:
+ - appID
+ - auth
+ - installationID
+ - organization
+ type: object
+ gitlab:
+ description: GitLab configures this store to sync secrets using GitLab Variables provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a GitLab instance.
+ properties:
+ SecretRef:
+ properties:
+ accessToken:
+ description: AccessToken is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - SecretRef
+ type: object
+ environment:
+ description: Environment environment_scope of gitlab CI/CD variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment on how to create environments)
+ type: string
+ groupIDs:
+ description: GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables.
+ items:
+ type: string
+ type: array
+ inheritFromGroups:
+ description: InheritFromGroups specifies whether parent groups should be discovered and checked for secrets.
+ type: boolean
+ projectID:
+ description: ProjectID specifies a project where secrets are located.
+ type: string
+ url:
+ description: URL configures the GitLab instance URL. Defaults to https://gitlab.com/.
+ type: string
+ required:
+ - auth
+ type: object
+ ibm:
+ description: IBM configures this store to sync secrets using IBM Cloud provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the IBM secrets manager.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ containerAuth:
+ description: IBM Container-based auth with IAM Trusted Profile.
+ properties:
+ iamEndpoint:
+ type: string
+ profile:
+ description: the IBM Trusted Profile
+ type: string
+ tokenLocation:
+ description: Location the token is mounted on the pod
+ type: string
+ required:
+ - profile
+ type: object
+ secretRef:
+ properties:
+ secretApiKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ serviceUrl:
+ description: ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance
+ type: string
+ required:
+ - auth
+ type: object
+ infisical:
+ description: Infisical configures this store to sync secrets using the Infisical provider
+ properties:
+ auth:
+ description: Auth configures how the Operator authenticates with the Infisical API
+ properties:
+ universalAuthCredentials:
+ properties:
+ clientId:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecret
+ type: object
+ type: object
+ hostAPI:
+ default: https://app.infisical.com/api
+ description: HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "https://app.infisical.com/api".
+ type: string
+ secretsScope:
+ description: SecretsScope defines the scope of the secrets within the workspace
+ properties:
+ environmentSlug:
+ description: EnvironmentSlug is the required slug identifier for the environment.
+ type: string
+ expandSecretReferences:
+ default: true
+ description: ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
+ type: boolean
+ projectSlug:
+ description: ProjectSlug is the required slug identifier for the project.
+ type: string
+ recursive:
+ default: false
+ description: Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
+ type: boolean
+ secretsPath:
+ default: /
+ description: SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
+ type: string
+ required:
+ - environmentSlug
+ - projectSlug
+ type: object
+ required:
+ - auth
+ - secretsScope
+ type: object
+ keepersecurity:
+ description: KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider
+ properties:
+ authRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ folderID:
+ type: string
+ required:
+ - authRef
+ - folderID
+ type: object
+ kubernetes:
+ description: Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Kubernetes instance.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ cert:
+ description: has both clientCert and clientKey as secretKeySelector
+ properties:
+ clientCert:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ clientKey:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ serviceAccount:
+ description: points to a service account that should be used for authentication
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ token:
+ description: use static token to authenticate with
+ properties:
+ bearerToken:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ authRef:
+ description: A reference to a secret that contains the auth information.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ remoteNamespace:
+ default: default
+ description: Remote namespace to fetch the secrets from
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ server:
+ description: configures the Kubernetes server Address.
+ properties:
+ caBundle:
+ description: CABundle is a base64-encoded CA certificate
+ format: byte
+ type: string
+ caProvider:
+ description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider'
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ url:
+ default: kubernetes.default
+ description: configures the Kubernetes server Address.
+ type: string
+ type: object
+ type: object
+ onboardbase:
+ description: Onboardbase configures this store to sync secrets using the Onboardbase provider
+ properties:
+ apiHost:
+ default: https://public.onboardbase.com/api/v1/
+ description: APIHost use this to configure the host url for the API for selfhosted installation, default is https://public.onboardbase.com/api/v1/
+ type: string
+ auth:
+ description: Auth configures how the Operator authenticates with the Onboardbase API
+ properties:
+ apiKeyRef:
+ description: |-
+ OnboardbaseAPIKey is the APIKey generated by an admin account.
+ It is used to recognize and authorize access to a project and environment within onboardbase
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ passcodeRef:
+ description: OnboardbasePasscode is the passcode attached to the API Key
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - apiKeyRef
+ - passcodeRef
+ type: object
+ environment:
+ default: development
+ description: Environment is the name of an environmnent within a project to pull the secrets from
+ type: string
+ project:
+ default: development
+ description: Project is an onboardbase project that the secrets should be pulled from
+ type: string
+ required:
+ - apiHost
+ - auth
+ - environment
+ - project
+ type: object
+ onepassword:
+ description: OnePassword configures this store to sync secrets using the 1Password Cloud provider
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against OnePassword Connect Server
+ properties:
+ secretRef:
+ description: OnePasswordAuthSecretRef holds secret references for 1Password credentials.
+ properties:
+ connectTokenSecretRef:
+ description: The ConnectToken is used for authentication to a 1Password Connect Server.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - connectTokenSecretRef
+ type: object
+ required:
+ - secretRef
+ type: object
+ connectHost:
+ description: ConnectHost defines the OnePassword Connect Server to connect to
+ type: string
+ vaults:
+ additionalProperties:
+ type: integer
+ description: Vaults defines which OnePassword vaults to search in which order
+ type: object
+ required:
+ - auth
+ - connectHost
+ - vaults
+ type: object
+ oracle:
+ description: Oracle configures this store to sync secrets using Oracle Vault provider
+ properties:
+ auth:
+ description: |-
+ Auth configures how secret-manager authenticates with the Oracle Vault.
+ If empty, use the instance principal, otherwise the user credentials specified in Auth.
+ properties:
+ secretRef:
+ description: SecretRef to pass through sensitive information.
+ properties:
+ fingerprint:
+ description: Fingerprint is the fingerprint of the API private key.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privatekey:
+ description: PrivateKey is the user's API Signing Key in PEM format, used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - fingerprint
+ - privatekey
+ type: object
+ tenancy:
+ description: Tenancy is the tenancy OCID where user is located.
+ type: string
+ user:
+ description: User is an access OCID specific to the account.
+ type: string
+ required:
+ - secretRef
+ - tenancy
+ - user
+ type: object
+ compartment:
+ description: |-
+ Compartment is the vault compartment OCID.
+ Required for PushSecret
+ type: string
+ encryptionKey:
+ description: |-
+ EncryptionKey is the OCID of the encryption key within the vault.
+ Required for PushSecret
+ type: string
+ principalType:
+ description: |-
+ The type of principal to use for authentication. If left blank, the Auth struct will
+ determine the principal type. This optional field must be specified if using
+ workload identity.
+ enum:
+ - ""
+ - UserPrincipal
+ - InstancePrincipal
+ - Workload
+ type: string
+ region:
+ description: Region is the region where vault is located.
+ type: string
+ serviceAccountRef:
+ description: |-
+ ServiceAccountRef specified the service account
+ that should be used when authenticating with WorkloadIdentity.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ vault:
+ description: Vault is the vault's OCID of the specific vault where secret is located.
+ type: string
+ required:
+ - region
+ - vault
+ type: object
+ passbolt:
+ properties:
+ auth:
+ description: Auth defines the information necessary to authenticate against Passbolt Server
+ properties:
+ passwordSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ privateKeySecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecretRef
+ - privateKeySecretRef
+ type: object
+ host:
+ description: Host defines the Passbolt Server to connect to
+ type: string
+ required:
+ - auth
+ - host
+ type: object
+ passworddepot:
+ description: Configures a store to sync secrets with a Password Depot instance.
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with a Password Depot instance.
+ properties:
+ secretRef:
+ properties:
+ credentials:
+ description: Username / Password is used for authentication.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - secretRef
+ type: object
+ database:
+ description: Database to use as source
+ type: string
+ host:
+ description: URL configures the Password Depot instance URL.
+ type: string
+ required:
+ - auth
+ - database
+ - host
+ type: object
+ previder:
+ description: Previder configures this store to sync secrets using the Previder provider
+ properties:
+ auth:
+ description: PreviderAuth contains a secretRef for credentials.
+ properties:
+ secretRef:
+ description: PreviderAuthSecretRef holds secret references for Previder Vault credentials.
+ properties:
+ accessToken:
+ description: The AccessToken is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - accessToken
+ type: object
+ type: object
+ baseUri:
+ type: string
+ required:
+ - auth
+ type: object
+ pulumi:
+ description: Pulumi configures this store to sync secrets using the Pulumi provider
+ properties:
+ accessToken:
+ description: AccessToken is the access tokens to sign in to the Pulumi Cloud Console.
+ properties:
+ secretRef:
+ description: SecretRef is a reference to a secret containing the Pulumi API token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ apiUrl:
+ default: https://api.pulumi.com/api/esc
+ description: APIURL is the URL of the Pulumi API.
+ type: string
+ environment:
+ description: |-
+ Environment are YAML documents composed of static key-value pairs, programmatic expressions,
+ dynamically retrieved values from supported providers including all major clouds,
+ and other Pulumi ESC environments.
+ To create a new environment, visit https://www.pulumi.com/docs/esc/environments/ for more information.
+ type: string
+ organization:
+ description: |-
+ Organization are a space to collaborate on shared projects and stacks.
+ To create a new organization, visit https://app.pulumi.com/ and click "New Organization".
+ type: string
+ project:
+ description: Project is the name of the Pulumi ESC project the environment belongs to.
+ type: string
+ required:
+ - accessToken
+ - environment
+ - organization
+ - project
+ type: object
+ scaleway:
+ description: Scaleway
+ properties:
+ accessKey:
+ description: AccessKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ apiUrl:
+ description: APIURL is the url of the api to use. Defaults to https://api.scaleway.com
+ type: string
+ projectId:
+ description: 'ProjectID is the id of your project, which you can find in the console: https://console.scaleway.com/project/settings'
+ type: string
+ region:
+ description: 'Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone'
+ type: string
+ secretKey:
+ description: SecretKey is the non-secret part of the api key.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - accessKey
+ - projectId
+ - region
+ - secretKey
+ type: object
+ secretserver:
+ description: |-
+ SecretServer configures this store to sync secrets using SecretServer provider
+ https://docs.delinea.com/online-help/secret-server/start.htm
+ properties:
+ password:
+ description: Password is the secret server account password.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ serverURL:
+ description: |-
+ ServerURL
+ URL to your secret server installation
+ type: string
+ username:
+ description: Username is the secret server account username.
+ properties:
+ secretRef:
+ description: SecretRef references a key in a secret that will be used as value.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ value:
+ description: Value can be specified directly to set a value without using a secret.
+ type: string
+ type: object
+ required:
+ - password
+ - serverURL
+ - username
+ type: object
+ senhasegura:
+ description: Senhasegura configures this store to sync secrets using senhasegura provider
+ properties:
+ auth:
+ description: Auth defines parameters to authenticate in senhasegura
+ properties:
+ clientId:
+ type: string
+ clientSecretSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - clientId
+ - clientSecretSecretRef
+ type: object
+ ignoreSslCertificate:
+ default: false
+ description: IgnoreSslCertificate defines if SSL certificate must be ignored
+ type: boolean
+ module:
+ description: Module defines which senhasegura module should be used to get secrets
+ type: string
+ url:
+ description: URL of senhasegura
+ type: string
+ required:
+ - auth
+ - module
+ - url
+ type: object
+ vault:
+ description: Vault configures this store to sync secrets using Hashi provider
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ default: approle
+ description: |-
+ Path where the App Role authentication backend is mounted
+ in Vault, e.g: "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ roleRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role ID used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role id.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ - secretRef
+ type: object
+ cert:
+ description: |-
+ Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
+ Cert authentication method
+ properties:
+ clientCert:
+ description: |-
+ ClientCert is a certificate to authenticate using the Cert Vault
+ authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing client private key to
+ authenticate with Vault using the Cert authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ iam:
+ description: |-
+ Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
+ AWS IAM authentication method
+ properties:
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ jwt:
+ description: Specify a service account with IRSA enabled
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ path:
+ description: 'Path where the AWS auth method is enabled in Vault, e.g: "aws"'
+ type: string
+ region:
+ description: AWS region
+ type: string
+ role:
+ description: This is the AWS role to be assumed before talking to vault
+ type: string
+ secretRef:
+ description: Specify credentials in a Secret object
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ vaultAwsIamServerID:
+ description: 'X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws'
+ type: string
+ vaultRole:
+ description: Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine
+ type: string
+ required:
+ - vaultRole
+ type: object
+ jwt:
+ description: |-
+ Jwt authenticates with Vault by passing role and JWT token using the
+ JWT/OIDC authentication method
+ properties:
+ kubernetesServiceAccountToken:
+ description: |-
+ Optional ServiceAccountToken specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Optional audiences field that will be used to request a temporary Kubernetes service
+ account token for the service account referenced by `serviceAccountRef`.
+ Defaults to a single audience `vault` it not specified.
+ Deprecated: use serviceAccountRef.Audiences instead
+ items:
+ type: string
+ type: array
+ expirationSeconds:
+ description: |-
+ Optional expiration time in seconds that will be used to request a temporary
+ Kubernetes service account token for the service account referenced by
+ `serviceAccountRef`.
+ Deprecated: this will be removed in the future.
+ Defaults to 10 minutes.
+ format: int64
+ type: integer
+ serviceAccountRef:
+ description: Service account field containing the name of a kubernetes ServiceAccount.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ path:
+ default: jwt
+ description: |-
+ Path where the JWT authentication backend is mounted
+ in Vault, e.g: "jwt"
+ type: string
+ role:
+ description: |-
+ Role is a JWT role to authenticate using the JWT/OIDC Vault
+ authentication method
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Vault using the JWT/OIDC authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ default: kubernetes
+ description: |-
+ Path where the Kubernetes authentication backend is mounted in Vault, e.g:
+ "kubernetes"
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Vault. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - mountPath
+ - role
+ type: object
+ ldap:
+ description: |-
+ Ldap authenticates with Vault by passing username/password pair using
+ the LDAP authentication method
+ properties:
+ path:
+ default: ldap
+ description: |-
+ Path where the LDAP authentication backend is mounted
+ in Vault, e.g: "ldap"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the LDAP
+ user used to authenticate with Vault using the LDAP authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is an LDAP username used to authenticate using the LDAP Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
+ Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ This will default to Vault.Namespace field if set, or empty otherwise
+ type: string
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userPass:
+ description: UserPass authenticates with Vault by passing username/password pair
+ properties:
+ path:
+ default: userpass
+ description: |-
+ Path where the UserPassword authentication backend is mounted
+ in Vault, e.g: "userpass"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the
+ user used to authenticate with Vault using the UserPass authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is a username used to authenticate using the UserPass Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Vault server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Vault server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ forwardInconsistent:
+ description: |-
+ ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
+ leader instead of simply retrying within a loop. This can increase performance if
+ the option is enabled serverside.
+ https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
+ type: boolean
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers to be added in Vault request
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault KV backend endpoint, e.g:
+ "secret". The v2 KV secret engine version specific "/data" path suffix
+ for fetching secrets from Vault is optional and will be appended
+ if not present in specified path.
+ type: string
+ readYourWrites:
+ description: |-
+ ReadYourWrites ensures isolated read-after-write semantics by
+ providing discovered cluster replication states in each request.
+ More information about eventual consistency in Vault can be found here
+ https://www.vaultproject.io/docs/enterprise/consistency
+ type: boolean
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ tls:
+ description: |-
+ The configuration used for client side related TLS communication, when the Vault server
+ requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
+ This parameter is ignored for plain HTTP protocol connection.
+ It's worth noting this configuration is different from the "TLS certificates auth method",
+ which is available under the `auth.cert` section.
+ properties:
+ certSecretRef:
+ description: |-
+ CertSecretRef is a certificate added to the transport layer
+ when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.crt'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ keySecretRef:
+ description: |-
+ KeySecretRef to a key in a Secret resource containing client private key
+ added to the transport layer when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.key'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ version:
+ default: v2
+ description: |-
+ Version is the Vault KV secret engine version. This can be either "v1" or
+ "v2". Version defaults to "v2".
+ enum:
+ - v1
+ - v2
+ type: string
+ required:
+ - server
+ type: object
+ webhook:
+ description: Webhook configures this store to sync secrets using a generic templated webhook
+ properties:
+ auth:
+ description: Auth specifies a authorization protocol. Only one protocol may be set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ ntlm:
+ description: NTLMProtocol configures the store to use NTLM for auth
+ properties:
+ passwordSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ usernameSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecret
+ - usernameSecret
+ type: object
+ type: object
+ body:
+ description: Body
+ type: string
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate webhook server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate webhook server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: The namespace the Provider type is in.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers
+ type: object
+ method:
+ description: Webhook Method
+ type: string
+ result:
+ description: Result formatting
+ properties:
+ jsonPath:
+ description: Json path of return value
+ type: string
+ type: object
+ secrets:
+ description: |-
+ Secrets to fill in templates
+ These secrets will be passed to the templating function as key value pairs under the given name
+ items:
+ properties:
+ name:
+ description: Name of this secret in templates
+ type: string
+ secretRef:
+ description: Secret ref to fill in credentials
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - name
+ - secretRef
+ type: object
+ type: array
+ timeout:
+ description: Timeout
+ type: string
+ url:
+ description: Webhook url to call
+ type: string
+ required:
+ - result
+ - url
+ type: object
+ yandexcertificatemanager:
+ description: YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Certificate Manager
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ yandexlockbox:
+ description: YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
+ properties:
+ apiEndpoint:
+ description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
+ type: string
+ auth:
+ description: Auth defines the information necessary to authenticate against Yandex Lockbox
+ properties:
+ authorizedKeySecretRef:
+ description: The authorized key used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ caProvider:
+ description: The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
+ properties:
+ certSecretRef:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ required:
+ - auth
+ type: object
+ type: object
+ refreshInterval:
+ description: Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.
+ type: integer
+ retrySettings:
+ description: Used to configure http retries if failed
+ properties:
+ maxRetries:
+ format: int32
+ type: integer
+ retryInterval:
+ type: string
+ type: object
+ required:
+ - provider
+ type: object
+ status:
+ description: SecretStoreStatus defines the observed state of the SecretStore.
+ properties:
+ capabilities:
+ description: SecretStoreCapabilities defines the possible operations a SecretStore can do.
+ type: string
+ conditions:
+ items:
+ properties:
+ lastTransitionTime:
+ format: date-time
+ type: string
+ message:
+ type: string
+ reason:
+ type: string
+ status:
+ type: string
+ type:
+ type: string
+ required:
+ - status
+ - type
+ type: object
+ type: array
+ type: object
+ type: object
+ served: true
+ storage: false
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/stssessiontoken.yaml b/charts/external-secrets/templates/crds/stssessiontoken.yaml
new file mode 100644
index 0000000..b9a971f
--- /dev/null
+++ b/charts/external-secrets/templates/crds/stssessiontoken.yaml
@@ -0,0 +1,216 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: stssessiontokens.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: STSSessionToken
+ listKind: STSSessionTokenList
+ plural: stssessiontokens
+ singular: stssessiontoken
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ STSSessionToken uses the GetSessionToken API to retrieve an authorization token.
+ The authorization token is valid for 12 hours.
+ The authorizationToken returned is a base64 encoded string that can be decoded.
+ For more information, see GetSessionToken (https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ auth:
+ description: Auth defines how to authenticate with AWS
+ properties:
+ jwt:
+ description: Authenticate against AWS using service account tokens.
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ secretRef:
+ description: |-
+ AWSAuthSecretRef holds secret references for AWS credentials
+ both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ type: object
+ region:
+ description: Region specifies the region to operate in.
+ type: string
+ requestParameters:
+ description: RequestParameters contains parameters that can be passed to the STS service.
+ properties:
+ serialNumber:
+ description: |-
+ SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making
+ the GetSessionToken call.
+ Possible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device
+ (such as arn:aws:iam::123456789012:mfa/user)
+ type: string
+ sessionDuration:
+ description: |-
+ SessionDuration The duration, in seconds, that the credentials should remain valid. Acceptable durations for
+ IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with 43,200 seconds
+ (12 hours) as the default.
+ format: int64
+ type: integer
+ tokenCode:
+ description: TokenCode is the value provided by the MFA device, if MFA is required.
+ type: string
+ type: object
+ role:
+ description: |-
+ You can assume a role before making calls to the
+ desired AWS service.
+ type: string
+ required:
+ - region
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/uuid.yaml b/charts/external-secrets/templates/crds/uuid.yaml
new file mode 100644
index 0000000..ff92338
--- /dev/null
+++ b/charts/external-secrets/templates/crds/uuid.yaml
@@ -0,0 +1,58 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: uuids.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: UUID
+ listKind: UUIDList
+ plural: uuids
+ singular: uuid
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: UUID generates a version 1 UUID (e56657e3-764f-11ef-a397-65231a88c216).
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: UUIDSpec controls the behavior of the uuid generator.
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/vaultdynamicsecret.yaml b/charts/external-secrets/templates/crds/vaultdynamicsecret.yaml
new file mode 100644
index 0000000..0fb81e2
--- /dev/null
+++ b/charts/external-secrets/templates/crds/vaultdynamicsecret.yaml
@@ -0,0 +1,861 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: vaultdynamicsecrets.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: VaultDynamicSecret
+ listKind: VaultDynamicSecretList
+ plural: vaultdynamicsecrets
+ singular: vaultdynamicsecret
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ properties:
+ allowEmptyResponse:
+ default: false
+ description: Do not fail if no secrets are found. Useful for requests where no data is expected.
+ type: boolean
+ controller:
+ description: |-
+ Used to select the correct ESO controller (think: ingress.ingressClassName)
+ The ESO controller is instantiated with a specific controller name and filters VDS based on this property
+ type: string
+ method:
+ description: Vault API method to use (GET/POST/other)
+ type: string
+ parameters:
+ description: Parameters to pass to Vault write (for non-GET methods)
+ x-kubernetes-preserve-unknown-fields: true
+ path:
+ description: Vault path to obtain the dynamic secret from
+ type: string
+ provider:
+ description: Vault provider common spec
+ properties:
+ auth:
+ description: Auth configures how secret-manager authenticates with the Vault server.
+ properties:
+ appRole:
+ description: |-
+ AppRole authenticates with Vault using the App Role auth mechanism,
+ with the role and secret stored in a Kubernetes Secret resource.
+ properties:
+ path:
+ default: approle
+ description: |-
+ Path where the App Role authentication backend is mounted
+ in Vault, e.g: "approle"
+ type: string
+ roleId:
+ description: |-
+ RoleID configured in the App Role authentication backend when setting
+ up the authentication backend in Vault.
+ type: string
+ roleRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role ID used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role id.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ Reference to a key in a Secret that contains the App Role secret used
+ to authenticate with Vault.
+ The `key` field must be specified and denotes which entry within the Secret
+ resource is used as the app role secret.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ - secretRef
+ type: object
+ cert:
+ description: |-
+ Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
+ Cert authentication method
+ properties:
+ clientCert:
+ description: |-
+ ClientCert is a certificate to authenticate using the Cert Vault
+ authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing client private key to
+ authenticate with Vault using the Cert authentication method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ iam:
+ description: |-
+ Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
+ AWS IAM authentication method
+ properties:
+ externalID:
+ description: AWS External ID set on assumed IAM roles
+ type: string
+ jwt:
+ description: Specify a service account with IRSA enabled
+ properties:
+ serviceAccountRef:
+ description: A reference to a ServiceAccount resource.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ type: object
+ path:
+ description: 'Path where the AWS auth method is enabled in Vault, e.g: "aws"'
+ type: string
+ region:
+ description: AWS region
+ type: string
+ role:
+ description: This is the AWS role to be assumed before talking to vault
+ type: string
+ secretRef:
+ description: Specify credentials in a Secret object
+ properties:
+ accessKeyIDSecretRef:
+ description: The AccessKeyID is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ secretAccessKeySecretRef:
+ description: The SecretAccessKey is used for authentication
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ sessionTokenSecretRef:
+ description: |-
+ The SessionToken used for authentication
+ This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
+ see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ vaultAwsIamServerID:
+ description: 'X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws'
+ type: string
+ vaultRole:
+ description: Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine
+ type: string
+ required:
+ - vaultRole
+ type: object
+ jwt:
+ description: |-
+ Jwt authenticates with Vault by passing role and JWT token using the
+ JWT/OIDC authentication method
+ properties:
+ kubernetesServiceAccountToken:
+ description: |-
+ Optional ServiceAccountToken specifies the Kubernetes service account for which to request
+ a token for with the `TokenRequest` API.
+ properties:
+ audiences:
+ description: |-
+ Optional audiences field that will be used to request a temporary Kubernetes service
+ account token for the service account referenced by `serviceAccountRef`.
+ Defaults to a single audience `vault` it not specified.
+ Deprecated: use serviceAccountRef.Audiences instead
+ items:
+ type: string
+ type: array
+ expirationSeconds:
+ description: |-
+ Optional expiration time in seconds that will be used to request a temporary
+ Kubernetes service account token for the service account referenced by
+ `serviceAccountRef`.
+ Deprecated: this will be removed in the future.
+ Defaults to 10 minutes.
+ format: int64
+ type: integer
+ serviceAccountRef:
+ description: Service account field containing the name of a kubernetes ServiceAccount.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - serviceAccountRef
+ type: object
+ path:
+ default: jwt
+ description: |-
+ Path where the JWT authentication backend is mounted
+ in Vault, e.g: "jwt"
+ type: string
+ role:
+ description: |-
+ Role is a JWT role to authenticate using the JWT/OIDC Vault
+ authentication method
+ type: string
+ secretRef:
+ description: |-
+ Optional SecretRef that refers to a key in a Secret resource containing JWT token to
+ authenticate with Vault using the JWT/OIDC authentication method.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - path
+ type: object
+ kubernetes:
+ description: |-
+ Kubernetes authenticates with Vault by passing the ServiceAccount
+ token stored in the named Secret resource to the Vault server.
+ properties:
+ mountPath:
+ default: kubernetes
+ description: |-
+ Path where the Kubernetes authentication backend is mounted in Vault, e.g:
+ "kubernetes"
+ type: string
+ role:
+ description: |-
+ A required field containing the Vault Role to assume. A Role binds a
+ Kubernetes ServiceAccount with a set of Vault policies.
+ type: string
+ secretRef:
+ description: |-
+ Optional secret field containing a Kubernetes ServiceAccount JWT used
+ for authenticating with Vault. If a name is specified without a key,
+ `token` is the default. If one is not specified, the one bound to
+ the controller will be used.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ serviceAccountRef:
+ description: |-
+ Optional service account field containing the name of a kubernetes ServiceAccount.
+ If the service account is specified, the service account secret token JWT will be used
+ for authenticating with Vault. If the service account selector is not supplied,
+ the secretRef will be used instead.
+ properties:
+ audiences:
+ description: |-
+ Audience specifies the `aud` claim for the service account token
+ If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
+ then this audiences will be appended to the list
+ items:
+ type: string
+ type: array
+ name:
+ description: The name of the ServiceAccount resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ Namespace of the resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ required:
+ - name
+ type: object
+ required:
+ - mountPath
+ - role
+ type: object
+ ldap:
+ description: |-
+ Ldap authenticates with Vault by passing username/password pair using
+ the LDAP authentication method
+ properties:
+ path:
+ default: ldap
+ description: |-
+ Path where the LDAP authentication backend is mounted
+ in Vault, e.g: "ldap"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the LDAP
+ user used to authenticate with Vault using the LDAP authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is an LDAP username used to authenticate using the LDAP Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
+ Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ This will default to Vault.Namespace field if set, or empty otherwise
+ type: string
+ tokenSecretRef:
+ description: TokenSecretRef authenticates with Vault by presenting a token.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ userPass:
+ description: UserPass authenticates with Vault by passing username/password pair
+ properties:
+ path:
+ default: userpass
+ description: |-
+ Path where the UserPassword authentication backend is mounted
+ in Vault, e.g: "userpass"
+ type: string
+ secretRef:
+ description: |-
+ SecretRef to a key in a Secret resource containing password for the
+ user used to authenticate with Vault using the UserPass authentication
+ method
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ username:
+ description: |-
+ Username is a username used to authenticate using the UserPass Vault
+ authentication method
+ type: string
+ required:
+ - path
+ - username
+ type: object
+ type: object
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate Vault server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate Vault server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace the Provider type is in.
+ Can only be defined when used in a ClusterSecretStore.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ forwardInconsistent:
+ description: |-
+ ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
+ leader instead of simply retrying within a loop. This can increase performance if
+ the option is enabled serverside.
+ https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header
+ type: boolean
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers to be added in Vault request
+ type: object
+ namespace:
+ description: |-
+ Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
+ Vault environments to support Secure Multi-tenancy. e.g: "ns1".
+ More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
+ type: string
+ path:
+ description: |-
+ Path is the mount path of the Vault KV backend endpoint, e.g:
+ "secret". The v2 KV secret engine version specific "/data" path suffix
+ for fetching secrets from Vault is optional and will be appended
+ if not present in specified path.
+ type: string
+ readYourWrites:
+ description: |-
+ ReadYourWrites ensures isolated read-after-write semantics by
+ providing discovered cluster replication states in each request.
+ More information about eventual consistency in Vault can be found here
+ https://www.vaultproject.io/docs/enterprise/consistency
+ type: boolean
+ server:
+ description: 'Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200".'
+ type: string
+ tls:
+ description: |-
+ The configuration used for client side related TLS communication, when the Vault server
+ requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
+ This parameter is ignored for plain HTTP protocol connection.
+ It's worth noting this configuration is different from the "TLS certificates auth method",
+ which is available under the `auth.cert` section.
+ properties:
+ certSecretRef:
+ description: |-
+ CertSecretRef is a certificate added to the transport layer
+ when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.crt'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ keySecretRef:
+ description: |-
+ KeySecretRef to a key in a Secret resource containing client private key
+ added to the transport layer when communicating with the Vault server.
+ If no key for the Secret is specified, external-secret will default to 'tls.key'.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ type: object
+ version:
+ default: v2
+ description: |-
+ Version is the Vault KV secret engine version. This can be either "v1" or
+ "v2". Version defaults to "v2".
+ enum:
+ - v1
+ - v2
+ type: string
+ required:
+ - server
+ type: object
+ resultType:
+ default: Data
+ description: |-
+ Result type defines which data is returned from the generator.
+ By default it is the "data" section of the Vault API response.
+ When using e.g. /auth/token/create the "data" section is empty but
+ the "auth" section contains the generated token.
+ Please refer to the vault docs regarding the result data structure.
+ Additionally, accessing the raw response is possibly by using "Raw" result type.
+ enum:
+ - Data
+ - Auth
+ - Raw
+ type: string
+ retrySettings:
+ description: Used to configure http retries if failed
+ properties:
+ maxRetries:
+ format: int32
+ type: integer
+ retryInterval:
+ type: string
+ type: object
+ required:
+ - path
+ - provider
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/crds/webhook.yaml b/charts/external-secrets/templates/crds/webhook.yaml
new file mode 100644
index 0000000..68928d7
--- /dev/null
+++ b/charts/external-secrets/templates/crds/webhook.yaml
@@ -0,0 +1,228 @@
+{{- if .Values.installCRDs }}
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+ annotations:
+ {{- with .Values.crds.annotations }}
+ {{- toYaml . | nindent 4}}
+ {{- end }}
+ {{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ controller-gen.kubebuilder.io/version: v0.17.3
+ labels:
+ external-secrets.io/component: controller
+ name: webhooks.generators.external-secrets.io
+spec:
+ group: generators.external-secrets.io
+ names:
+ categories:
+ - external-secrets
+ - external-secrets-generators
+ kind: Webhook
+ listKind: WebhookList
+ plural: webhooks
+ singular: webhook
+ scope: Namespaced
+ versions:
+ - name: v1alpha1
+ schema:
+ openAPIV3Schema:
+ description: |-
+ Webhook connects to a third party API server to handle the secrets generation
+ configuration parameters in spec.
+ You can specify the server, the token, and additional body parameters.
+ See documentation for the full API specification for requests and responses.
+ properties:
+ apiVersion:
+ description: |-
+ APIVersion defines the versioned schema of this representation of an object.
+ Servers should convert recognized schemas to the latest internal value, and
+ may reject unrecognized values.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+ type: string
+ kind:
+ description: |-
+ Kind is a string value representing the REST resource this object represents.
+ Servers may infer this from the endpoint the client submits requests to.
+ Cannot be updated.
+ In CamelCase.
+ More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+ type: string
+ metadata:
+ type: object
+ spec:
+ description: WebhookSpec controls the behavior of the external generator. Any body parameters should be passed to the server through the parameters field.
+ properties:
+ auth:
+ description: Auth specifies a authorization protocol. Only one protocol may be set.
+ maxProperties: 1
+ minProperties: 1
+ properties:
+ ntlm:
+ description: NTLMProtocol configures the store to use NTLM for auth
+ properties:
+ passwordSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ usernameSecret:
+ description: |-
+ A reference to a specific 'key' within a Secret resource.
+ In some instances, `key` is a required field.
+ properties:
+ key:
+ description: |-
+ A key in the referenced Secret.
+ Some instances of this field may be defaulted, in others it may be required.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: |-
+ The namespace of the Secret resource being referred to.
+ Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type: object
+ required:
+ - passwordSecret
+ - usernameSecret
+ type: object
+ type: object
+ body:
+ description: Body
+ type: string
+ caBundle:
+ description: |-
+ PEM encoded CA bundle used to validate webhook server certificate. Only used
+ if the Server URL is using HTTPS protocol. This parameter is ignored for
+ plain HTTP protocol connection. If not set the system root certificates
+ are used to validate the TLS connection.
+ format: byte
+ type: string
+ caProvider:
+ description: The provider for the CA bundle to use to validate webhook server certificate.
+ properties:
+ key:
+ description: The key where the CA certificate can be found in the Secret or ConfigMap.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the object located at the provider type.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ namespace:
+ description: The namespace the Provider type is in.
+ maxLength: 63
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
+ type: string
+ type:
+ description: The type of provider to use such as "Secret", or "ConfigMap".
+ enum:
+ - Secret
+ - ConfigMap
+ type: string
+ required:
+ - name
+ - type
+ type: object
+ headers:
+ additionalProperties:
+ type: string
+ description: Headers
+ type: object
+ method:
+ description: Webhook Method
+ type: string
+ result:
+ description: Result formatting
+ properties:
+ jsonPath:
+ description: Json path of return value
+ type: string
+ type: object
+ secrets:
+ description: |-
+ Secrets to fill in templates
+ These secrets will be passed to the templating function as key value pairs under the given name
+ items:
+ properties:
+ name:
+ description: Name of this secret in templates
+ type: string
+ secretRef:
+ description: Secret ref to fill in credentials
+ properties:
+ key:
+ description: The key where the token is found.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[-._a-zA-Z0-9]+$
+ type: string
+ name:
+ description: The name of the Secret resource being referred to.
+ maxLength: 253
+ minLength: 1
+ pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
+ type: string
+ type: object
+ required:
+ - name
+ - secretRef
+ type: object
+ type: array
+ timeout:
+ description: Timeout
+ type: string
+ url:
+ description: Webhook url to call
+ type: string
+ required:
+ - result
+ - url
+ type: object
+ type: object
+ served: true
+ storage: true
+ subresources:
+ status: {}
+{{- end }}
diff --git a/charts/external-secrets/templates/deployment.yaml b/charts/external-secrets/templates/deployment.yaml
new file mode 100644
index 0000000..9685587
--- /dev/null
+++ b/charts/external-secrets/templates/deployment.yaml
@@ -0,0 +1,150 @@
+{{- if .Values.createOperator }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "external-secrets.fullname" . }}
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+ {{- with .Values.deploymentAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ replicas: {{ .Values.replicaCount }}
+ revisionHistoryLimit: {{ .Values.revisionHistoryLimit }}
+ selector:
+ matchLabels:
+ {{- include "external-secrets.selectorLabels" . | nindent 6 }}
+ template:
+ metadata:
+ {{- with .Values.podAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 8 }}
+ {{- with .Values.podLabels }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ spec:
+ {{- with .Values.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ serviceAccountName: {{ include "external-secrets.serviceAccountName" . }}
+ automountServiceAccountToken: {{ .Values.serviceAccount.automount }}
+ {{- with .Values.podSecurityContext }}
+ {{- if and (.enabled) (gt (keys . | len) 1) }}
+ securityContext:
+ {{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 8 }}
+ {{- end }}
+ {{- end }}
+ hostNetwork: {{ .Values.hostNetwork }}
+ containers:
+ - name: {{ .Chart.Name }}
+ {{- with .Values.securityContext }}
+ {{- if and (.enabled) (gt (keys . | len) 1) }}
+ securityContext:
+ {{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ image: {{ include "external-secrets.image" (dict "chartAppVersion" .Chart.AppVersion "image" .Values.image) | trim }}
+ imagePullPolicy: {{ .Values.image.pullPolicy }}
+ {{- if or (.Values.leaderElect) (.Values.scopedNamespace) (.Values.processClusterStore) (.Values.processClusterExternalSecret) (.Values.processClusterPushSecret) (.Values.concurrent) (.Values.extraArgs) }}
+ args:
+ {{- if .Values.leaderElect }}
+ - --enable-leader-election=true
+ {{- end }}
+ {{- if .Values.scopedNamespace }}
+ - --namespace={{ .Values.scopedNamespace }}
+ {{- end }}
+ {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+ - --enable-cluster-store-reconciler=false
+ - --enable-cluster-external-secret-reconciler=false
+ - --enable-cluster-push-secret-reconciler=false
+ {{- else }}
+ {{- if not .Values.processClusterStore }}
+ - --enable-cluster-store-reconciler=false
+ {{- end }}
+ {{- if not .Values.processClusterExternalSecret }}
+ - --enable-cluster-external-secret-reconciler=false
+ {{- end }}
+ {{- if not .Values.processClusterPushSecret }}
+ - --enable-cluster-push-secret-reconciler=false
+ {{- end }}
+ {{- end }}
+ {{- if not .Values.processPushSecret }}
+ - --enable-push-secret-reconciler=false
+ {{- end }}
+ {{- if .Values.controllerClass }}
+ - --controller-class={{ .Values.controllerClass }}
+ {{- end }}
+ {{- if .Values.extendedMetricLabels }}
+ - --enable-extended-metric-labels={{ .Values.extendedMetricLabels }}
+ {{- end }}
+ {{- if .Values.concurrent }}
+ - --concurrent={{ .Values.concurrent }}
+ {{- end }}
+ {{- range $key, $value := .Values.extraArgs }}
+ {{- if $value }}
+ - --{{ $key }}={{ $value }}
+ {{- else }}
+ - --{{ $key }}
+ {{- end }}
+ {{- end }}
+ {{- end }}
+ - --metrics-addr=:{{ .Values.metrics.listen.port }}
+ - --loglevel={{ .Values.log.level }}
+ - --zap-time-encoding={{ .Values.log.timeEncoding }}
+ ports:
+ - containerPort: {{ .Values.metrics.listen.port }}
+ protocol: TCP
+ name: metrics
+ {{- with .Values.extraEnv }}
+ env:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.resources }}
+ resources:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- if .Values.extraVolumeMounts }}
+ volumeMounts:
+ {{- toYaml .Values.extraVolumeMounts | nindent 12 }}
+ {{- end }}
+ {{- if .Values.extraContainers }}
+ {{ toYaml .Values.extraContainers | nindent 8 }}
+ {{- end }}
+ dnsPolicy: {{ .Values.dnsPolicy }}
+ {{- if .Values.dnsConfig }}
+ dnsConfig:
+ {{- toYaml .Values.dnsConfig | nindent 8 }}
+ {{- end }}
+ {{- if .Values.extraVolumes }}
+ volumes:
+ {{- toYaml .Values.extraVolumes | nindent 8 }}
+ {{- end }}
+ {{- with .Values.nodeSelector | default .Values.global.nodeSelector }}
+ nodeSelector:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.affinity | default .Values.global.affinity }}
+ affinity:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.tolerations | default .Values.global.tolerations }}
+ tolerations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.topologySpreadConstraints | default .Values.global.topologySpreadConstraints }}
+ topologySpreadConstraints:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if .Values.priorityClassName }}
+ priorityClassName: {{ .Values.priorityClassName }}
+ {{- end }}
+ {{- if .Values.podSpecExtra }}
+ {{- toYaml .Values.podSpecExtra | nindent 6 }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/extra-manifests.yaml b/charts/external-secrets/templates/extra-manifests.yaml
new file mode 100644
index 0000000..1dfe8f4
--- /dev/null
+++ b/charts/external-secrets/templates/extra-manifests.yaml
@@ -0,0 +1,4 @@
+{{- range .Values.extraObjects }}
+---
+{{ include "external-secrets.render" (dict "value" . "context" $) }}
+{{- end }}
diff --git a/charts/external-secrets/templates/grafana-dashboard.yaml b/charts/external-secrets/templates/grafana-dashboard.yaml
new file mode 100644
index 0000000..4b96dce
--- /dev/null
+++ b/charts/external-secrets/templates/grafana-dashboard.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.grafanaDashboard.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-dashboard
+ namespace: {{ include "external-secrets.namespace" . }}
+ labels:
+ {{ .Values.grafanaDashboard.sidecarLabel }}: {{ .Values.grafanaDashboard.sidecarLabelValue | quote }}
+ {{- include "external-secrets.labels" . | nindent 4 }}
+ {{- with .Values.grafanaDashboard.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+data:
+ external-secrets.json: {{ .Files.Get "files/monitoring/grafana-dashboard.json" | toJson }}
+{{- end }}
diff --git a/charts/external-secrets/templates/poddisruptionbudget.yaml b/charts/external-secrets/templates/poddisruptionbudget.yaml
new file mode 100644
index 0000000..7b75ca3
--- /dev/null
+++ b/charts/external-secrets/templates/poddisruptionbudget.yaml
@@ -0,0 +1,19 @@
+{{- if .Values.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-pdb
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+spec:
+ {{- if .Values.podDisruptionBudget.minAvailable }}
+ minAvailable: {{ .Values.podDisruptionBudget.minAvailable }}
+ {{- end }}
+ {{- if .Values.podDisruptionBudget.maxUnavailable }}
+ maxUnavailable: {{ .Values.podDisruptionBudget.maxUnavailable }}
+ {{- end }}
+ selector:
+ matchLabels:
+ {{- include "external-secrets.selectorLabels" . | nindent 6 }}
+{{- end }}
diff --git a/charts/external-secrets/templates/rbac.yaml b/charts/external-secrets/templates/rbac.yaml
new file mode 100644
index 0000000..a1b40f5
--- /dev/null
+++ b/charts/external-secrets/templates/rbac.yaml
@@ -0,0 +1,392 @@
+{{- if .Values.rbac.create -}}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-controller
+ {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+ namespace: {{ .Values.scopedNamespace | quote }}
+ {{- end }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+rules:
+ - apiGroups:
+ - "external-secrets.io"
+ resources:
+ - "secretstores"
+ {{- if .Values.processClusterStore }}
+ - "clustersecretstores"
+ {{- end }}
+ - "externalsecrets"
+ {{- if .Values.processClusterExternalSecret }}
+ - "clusterexternalsecrets"
+ {{- end }}
+ {{- if .Values.processPushSecret }}
+ - "pushsecrets"
+ {{- end }}
+ {{- if .Values.processClusterPushSecret }}
+ - "clusterpushsecrets"
+ {{- end }}
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - apiGroups:
+ - "external-secrets.io"
+ resources:
+ - "externalsecrets"
+ - "externalsecrets/status"
+ {{- if .Values.openshiftFinalizers }}
+ - "externalsecrets/finalizers"
+ {{- end }}
+ - "secretstores"
+ - "secretstores/status"
+ {{- if .Values.openshiftFinalizers }}
+ - "secretstores/finalizers"
+ {{- end }}
+ {{- if .Values.processClusterStore }}
+ - "clustersecretstores"
+ - "clustersecretstores/status"
+ {{- if .Values.openshiftFinalizers }}
+ - "clustersecretstores/finalizers"
+ {{- end }}
+ {{- end }}
+ {{- if .Values.processClusterExternalSecret }}
+ - "clusterexternalsecrets"
+ - "clusterexternalsecrets/status"
+ {{- if .Values.openshiftFinalizers }}
+ - "clusterexternalsecrets/finalizers"
+ {{- end }}
+ {{- end }}
+ {{- if .Values.processPushSecret }}
+ - "pushsecrets"
+ - "pushsecrets/status"
+ {{- if .Values.openshiftFinalizers }}
+ - "pushsecrets/finalizers"
+ {{- end }}
+ {{- end }}
+ {{- if .Values.processClusterPushSecret }}
+ - "clusterpushsecrets"
+ - "clusterpushsecrets/status"
+ {{- if .Values.openshiftFinalizers }}
+ - "clusterpushsecrets/finalizers"
+ {{- end }}
+ {{- end }}
+ verbs:
+ - "get"
+ - "update"
+ - "patch"
+ - apiGroups:
+ - "generators.external-secrets.io"
+ resources:
+ - "generatorstates"
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - "create"
+ - "update"
+ - "patch"
+ - "delete"
+ - "deletecollection"
+ - apiGroups:
+ - "generators.external-secrets.io"
+ resources:
+ - "acraccesstokens"
+ - "clustergenerators"
+ - "ecrauthorizationtokens"
+ - "fakes"
+ - "gcraccesstokens"
+ - "githubaccesstokens"
+ - "quayaccesstokens"
+ - "passwords"
+ - "stssessiontokens"
+ - "uuids"
+ - "vaultdynamicsecrets"
+ - "webhooks"
+ - "grafanas"
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - apiGroups:
+ - ""
+ resources:
+ - "serviceaccounts"
+ - "namespaces"
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - apiGroups:
+ - ""
+ resources:
+ - "configmaps"
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - apiGroups:
+ - ""
+ resources:
+ - "secrets"
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - "create"
+ - "update"
+ - "delete"
+ - "patch"
+ - apiGroups:
+ - ""
+ resources:
+ - "serviceaccounts/token"
+ verbs:
+ - "create"
+ - apiGroups:
+ - ""
+ resources:
+ - "events"
+ verbs:
+ - "create"
+ - "patch"
+ - apiGroups:
+ - "external-secrets.io"
+ resources:
+ - "externalsecrets"
+ verbs:
+ - "create"
+ - "update"
+ - "delete"
+ {{- if .Values.processPushSecret }}
+ - apiGroups:
+ - "external-secrets.io"
+ resources:
+ - "pushsecrets"
+ verbs:
+ - "create"
+ - "update"
+ - "delete"
+ {{- end }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-view
+ {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+ namespace: {{ .Values.scopedNamespace | quote }}
+ {{- end }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+ {{- if .Values.rbac.aggregateToView }}
+ rbac.authorization.k8s.io/aggregate-to-view: "true"
+ {{- end }}
+ {{- if .Values.rbac.aggregateToEdit }}
+ rbac.authorization.k8s.io/aggregate-to-edit: "true"
+ {{- end }}
+ rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules:
+ - apiGroups:
+ - "external-secrets.io"
+ resources:
+ - "externalsecrets"
+ - "secretstores"
+ {{- if .Values.processClusterStore }}
+ - "clustersecretstores"
+ {{- end }}
+ {{- if .Values.processPushSecret }}
+ - "pushsecrets"
+ {{- end }}
+ {{- if .Values.processClusterPushSecret }}
+ - "clusterpushsecrets"
+ {{- end }}
+ verbs:
+ - "get"
+ - "watch"
+ - "list"
+ - apiGroups:
+ - "generators.external-secrets.io"
+ resources:
+ - "acraccesstokens"
+ - "clustergenerators"
+ - "ecrauthorizationtokens"
+ - "fakes"
+ - "gcraccesstokens"
+ - "githubaccesstokens"
+ - "quayaccesstokens"
+ - "passwords"
+ - "vaultdynamicsecrets"
+ - "webhooks"
+ - "grafanas"
+ - "generatorstates"
+ verbs:
+ - "get"
+ - "watch"
+ - "list"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: Role
+{{- else }}
+kind: ClusterRole
+{{- end }}
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-edit
+ {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+ namespace: {{ .Values.scopedNamespace | quote }}
+ {{- end }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+ {{- if .Values.rbac.aggregateToEdit }}
+ rbac.authorization.k8s.io/aggregate-to-edit: "true"
+ {{- end }}
+ rbac.authorization.k8s.io/aggregate-to-admin: "true"
+rules:
+ - apiGroups:
+ - "external-secrets.io"
+ resources:
+ - "externalsecrets"
+ - "secretstores"
+ {{- if .Values.processClusterStore }}
+ - "clustersecretstores"
+ {{- end }}
+ {{- if .Values.processPushSecret }}
+ - "pushsecrets"
+ {{- end }}
+ {{- if .Values.processClusterPushSecret }}
+ - "clusterpushsecrets"
+ {{- end }}
+ verbs:
+ - "create"
+ - "delete"
+ - "deletecollection"
+ - "patch"
+ - "update"
+ - apiGroups:
+ - "generators.external-secrets.io"
+ resources:
+ - "acraccesstokens"
+ - "clustergenerators"
+ - "ecrauthorizationtokens"
+ - "fakes"
+ - "gcraccesstokens"
+ - "githubaccesstokens"
+ - "quayaccesstokens"
+ - "passwords"
+ - "vaultdynamicsecrets"
+ - "webhooks"
+ - "grafanas"
+ - "generatorstates"
+ verbs:
+ - "create"
+ - "delete"
+ - "deletecollection"
+ - "patch"
+ - "update"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+{{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+kind: RoleBinding
+{{- else }}
+kind: ClusterRoleBinding
+{{- end }}
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-controller
+ {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+ namespace: {{ .Values.scopedNamespace | quote }}
+ {{- end }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ {{- if and .Values.scopedNamespace .Values.scopedRBAC }}
+ kind: Role
+ {{- else }}
+ kind: ClusterRole
+ {{- end }}
+ name: {{ include "external-secrets.fullname" . }}-controller
+subjects:
+ - name: {{ include "external-secrets.serviceAccountName" . }}
+ namespace: {{ template "external-secrets.namespace" . }}
+ kind: ServiceAccount
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-leaderelection
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+rules:
+ - apiGroups:
+ - ""
+ resources:
+ - "configmaps"
+ resourceNames:
+ - "external-secrets-controller"
+ verbs:
+ - "get"
+ - "update"
+ - "patch"
+ - apiGroups:
+ - ""
+ resources:
+ - "configmaps"
+ verbs:
+ - "create"
+ - apiGroups:
+ - "coordination.k8s.io"
+ resources:
+ - "leases"
+ verbs:
+ - "get"
+ - "create"
+ - "update"
+ - "patch"
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-leaderelection
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: {{ include "external-secrets.fullname" . }}-leaderelection
+subjects:
+ - kind: ServiceAccount
+ name: {{ include "external-secrets.serviceAccountName" . }}
+ namespace: {{ template "external-secrets.namespace" . }}
+{{- if .Values.rbac.servicebindings.create }}
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-servicebindings
+ labels:
+ servicebinding.io/controller: "true"
+ {{- include "external-secrets.labels" . | nindent 4 }}
+rules:
+ - apiGroups:
+ - "external-secrets.io"
+ resources:
+ - "externalsecrets"
+ {{- if .Values.processPushSecret }}
+ - "pushsecrets"
+ {{- end }}
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+{{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/service.yaml b/charts/external-secrets/templates/service.yaml
new file mode 100644
index 0000000..d292258
--- /dev/null
+++ b/charts/external-secrets/templates/service.yaml
@@ -0,0 +1,28 @@
+{{- if or (and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled) .Values.metrics.service.enabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-metrics
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+ {{- with .Values.metrics.service.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ type: ClusterIP
+ {{- if .Values.service.ipFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.service.ipFamilies }}
+ ipFamilies: {{ .Values.service.ipFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ ports:
+ - port: {{ .Values.metrics.service.port }}
+ protocol: TCP
+ targetPort: metrics
+ name: metrics
+ selector:
+ {{- include "external-secrets.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/charts/external-secrets/templates/serviceaccount.yaml b/charts/external-secrets/templates/serviceaccount.yaml
new file mode 100644
index 0000000..ceaa98e
--- /dev/null
+++ b/charts/external-secrets/templates/serviceaccount.yaml
@@ -0,0 +1,16 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ include "external-secrets.serviceAccountName" . }}
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+ {{- with .Values.serviceAccount.extraLabels }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ {{- with .Values.serviceAccount.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/servicemonitor.yaml b/charts/external-secrets/templates/servicemonitor.yaml
new file mode 100644
index 0000000..c2f2cce
--- /dev/null
+++ b/charts/external-secrets/templates/servicemonitor.yaml
@@ -0,0 +1,98 @@
+{{- if and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled -}}
+apiVersion: "monitoring.coreos.com/v1"
+kind: ServiceMonitor
+metadata:
+ labels:
+ {{- include "external-secrets.labels" . | nindent 4 }}
+{{- if .Values.serviceMonitor.additionalLabels }}
+{{ toYaml .Values.serviceMonitor.additionalLabels | indent 4 }}
+{{- end }}
+ name: {{ include "external-secrets.fullname" . }}-metrics
+ namespace: {{ .Values.serviceMonitor.namespace | default (include "external-secrets.namespace" .) | quote }}
+spec:
+ selector:
+ matchLabels:
+ {{- include "external-secrets.selectorLabels" . | nindent 6 }}
+ namespaceSelector:
+ matchNames:
+ - {{ template "external-secrets.namespace" . }}
+ endpoints:
+ - port: metrics
+ interval: {{ .Values.serviceMonitor.interval }}
+ scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }}
+ honorLabels: {{ .Values.serviceMonitor.honorLabels }}
+ {{- with .Values.serviceMonitor.metricRelabelings }}
+ metricRelabelings:
+ {{- toYaml . | nindent 6 }}
+ {{- end }}
+ {{- with .Values.serviceMonitor.relabelings }}
+ relabelings:
+ {{- toYaml . | nindent 6 }}
+ {{- end }}
+---
+{{- if .Values.webhook.create }}
+apiVersion: "monitoring.coreos.com/v1"
+kind: ServiceMonitor
+metadata:
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+{{- if .Values.serviceMonitor.additionalLabels }}
+{{ toYaml .Values.serviceMonitor.additionalLabels | indent 4 }}
+{{- end }}
+ name: {{ include "external-secrets.fullname" . }}-webhook-metrics
+ namespace: {{ .Values.serviceMonitor.namespace | default (include "external-secrets.namespace" .) | quote }}
+spec:
+ selector:
+ matchLabels:
+ {{- include "external-secrets-webhook-metrics.labels" . | nindent 6 }}
+ namespaceSelector:
+ matchNames:
+ - {{ template "external-secrets.namespace" . }}
+ endpoints:
+ - port: metrics
+ interval: {{ .Values.serviceMonitor.interval }}
+ scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }}
+ honorLabels: {{ .Values.serviceMonitor.honorLabels }}
+ {{- with .Values.serviceMonitor.metricRelabelings }}
+ metricRelabelings:
+ {{- toYaml . | nindent 6 }}
+ {{- end }}
+ {{- with .Values.serviceMonitor.relabelings }}
+ relabelings:
+ {{- toYaml . | nindent 6 }}
+ {{- end }}
+{{- end }}
+---
+{{- if .Values.certController.create }}
+apiVersion: "monitoring.coreos.com/v1"
+kind: ServiceMonitor
+metadata:
+ labels:
+ {{- include "external-secrets-cert-controller.labels" . | nindent 4 }}
+{{- if .Values.serviceMonitor.additionalLabels }}
+{{ toYaml .Values.serviceMonitor.additionalLabels | indent 4 }}
+{{- end }}
+ name: {{ include "external-secrets.fullname" . }}-cert-controller-metrics
+ namespace: {{ .Values.serviceMonitor.namespace | default (include "external-secrets.namespace" .) | quote }}
+spec:
+ selector:
+ matchLabels:
+ {{- include "external-secrets-cert-controller-metrics.labels" . | nindent 6 }}
+ namespaceSelector:
+ matchNames:
+ - {{ template "external-secrets.namespace" . }}
+ endpoints:
+ - port: metrics
+ interval: {{ .Values.serviceMonitor.interval }}
+ scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout }}
+ honorLabels: {{ .Values.serviceMonitor.honorLabels }}
+ {{- with .Values.serviceMonitor.metricRelabelings }}
+ metricRelabelings:
+ {{- toYaml . | nindent 6 }}
+ {{- end }}
+ {{- with .Values.serviceMonitor.relabelings }}
+ relabelings:
+ {{- toYaml . | nindent 6 }}
+ {{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/validatingwebhook.yaml b/charts/external-secrets/templates/validatingwebhook.yaml
new file mode 100644
index 0000000..d1fede5
--- /dev/null
+++ b/charts/external-secrets/templates/validatingwebhook.yaml
@@ -0,0 +1,84 @@
+{{- if .Values.webhook.create }}
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+ name: secretstore-validate
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ external-secrets.io/component: webhook
+ {{- if or .Values.webhook.annotations (and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations) }}
+ annotations:
+ {{- if and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ template "external-secrets.namespace" . }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ {{- if .Values.webhook.annotations }}
+ {{- toYaml .Values.webhook.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+webhooks:
+- name: "validate.secretstore.external-secrets.io"
+ rules:
+ - apiGroups: ["external-secrets.io"]
+ apiVersions: ["v1"]
+ operations: ["CREATE", "UPDATE", "DELETE"]
+ resources: ["secretstores"]
+ scope: "Namespaced"
+ clientConfig:
+ service:
+ namespace: {{ template "external-secrets.namespace" . }}
+ name: {{ include "external-secrets.fullname" . }}-webhook
+ path: /validate-external-secrets-io-v1-secretstore
+ admissionReviewVersions: ["v1", "v1beta1"]
+ sideEffects: None
+ timeoutSeconds: 5
+
+- name: "validate.clustersecretstore.external-secrets.io"
+ rules:
+ - apiGroups: ["external-secrets.io"]
+ apiVersions: ["v1"]
+ operations: ["CREATE", "UPDATE", "DELETE"]
+ resources: ["clustersecretstores"]
+ scope: "Cluster"
+ clientConfig:
+ service:
+ namespace: {{ template "external-secrets.namespace" . }}
+ name: {{ include "external-secrets.fullname" . }}-webhook
+ path: /validate-external-secrets-io-v1-clustersecretstore
+ admissionReviewVersions: ["v1", "v1beta1"]
+ sideEffects: None
+ timeoutSeconds: 5
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+ name: externalsecret-validate
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ external-secrets.io/component: webhook
+ {{- if or .Values.webhook.annotations (and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations) }}
+ annotations:
+ {{- if and .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
+ cert-manager.io/inject-ca-from: {{ template "external-secrets.namespace" . }}/{{ include "external-secrets.fullname" . }}-webhook
+ {{- end }}
+ {{- if .Values.webhook.annotations }}
+ {{- toYaml .Values.webhook.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+webhooks:
+- name: "validate.externalsecret.external-secrets.io"
+ rules:
+ - apiGroups: ["external-secrets.io"]
+ apiVersions: ["v1"]
+ operations: ["CREATE", "UPDATE", "DELETE"]
+ resources: ["externalsecrets"]
+ scope: "Namespaced"
+ clientConfig:
+ service:
+ namespace: {{ template "external-secrets.namespace" . }}
+ name: {{ include "external-secrets.fullname" . }}-webhook
+ path: /validate-external-secrets-io-v1-externalsecret
+ admissionReviewVersions: ["v1", "v1beta1"]
+ sideEffects: None
+ timeoutSeconds: 5
+ failurePolicy: {{ .Values.webhook.failurePolicy}}
+{{- end }}
diff --git a/charts/external-secrets/templates/webhook-certificate.yaml b/charts/external-secrets/templates/webhook-certificate.yaml
new file mode 100644
index 0000000..96b4bfe
--- /dev/null
+++ b/charts/external-secrets/templates/webhook-certificate.yaml
@@ -0,0 +1,33 @@
+{{- if and .Values.webhook.create .Values.webhook.certManager.enabled .Values.webhook.certManager.cert.create }}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-webhook
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ external-secrets.io/component: webhook
+ {{- with .Values.webhook.certManager.cert.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ commonName: {{ include "external-secrets.fullname" . }}-webhook
+ dnsNames:
+ - {{ include "external-secrets.fullname" . }}-webhook
+ - {{ include "external-secrets.fullname" . }}-webhook.{{ template "external-secrets.namespace" . }}
+ - {{ include "external-secrets.fullname" . }}-webhook.{{ template "external-secrets.namespace" . }}.svc
+ issuerRef:
+ {{- toYaml .Values.webhook.certManager.cert.issuerRef | nindent 4 }}
+ {{- with .Values.webhook.certManager.cert.duration }}
+ duration: {{ . | quote }}
+ {{- end }}
+ {{- with .Values.webhook.certManager.cert.renewBefore }}
+ renewBefore: {{ . | quote }}
+ {{- end }}
+ {{- if gt (.Values.webhook.certManager.cert.revisionHistoryLimit | int) 0 }}
+ revisionHistoryLimit: {{ .Values.webhook.certManager.cert.revisionHistoryLimit }}
+ {{- end }}
+ secretName: {{ include "external-secrets.fullname" . }}-webhook
+{{- end }}
diff --git a/charts/external-secrets/templates/webhook-deployment.yaml b/charts/external-secrets/templates/webhook-deployment.yaml
new file mode 100644
index 0000000..7419a42
--- /dev/null
+++ b/charts/external-secrets/templates/webhook-deployment.yaml
@@ -0,0 +1,128 @@
+{{- if .Values.webhook.create }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-webhook
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ {{- with .Values.webhook.deploymentAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ replicas: {{ .Values.webhook.replicaCount }}
+ revisionHistoryLimit: {{ .Values.webhook.revisionHistoryLimit }}
+ selector:
+ matchLabels:
+ {{- include "external-secrets-webhook.selectorLabels" . | nindent 6 }}
+ template:
+ metadata:
+ {{- with .Values.webhook.podAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 8 }}
+ {{- with .Values.webhook.podLabels }}
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ spec:
+ {{- with .Values.webhook.imagePullSecrets }}
+ imagePullSecrets:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ hostNetwork: {{ .Values.webhook.hostNetwork}}
+ serviceAccountName: {{ include "external-secrets-webhook.serviceAccountName" . }}
+ automountServiceAccountToken: {{ .Values.webhook.serviceAccount.automount }}
+ {{- with .Values.webhook.podSecurityContext }}
+ {{- if and (.enabled) (gt (keys . | len) 1) }}
+ securityContext:
+ {{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 8 }}
+ {{- end }}
+ {{- end }}
+ containers:
+ - name: webhook
+ {{- with .Values.webhook.securityContext }}
+ {{- if and (.enabled) (gt (keys . | len) 1) }}
+ securityContext:
+ {{- include "external-secrets.renderSecurityContext" (dict "securityContext" . "context" $) | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ image: {{ include "external-secrets.image" (dict "chartAppVersion" .Chart.AppVersion "image" .Values.webhook.image) | trim }}
+ imagePullPolicy: {{ .Values.webhook.image.pullPolicy }}
+ args:
+ - webhook
+ - --port={{ .Values.webhook.port }}
+ - --dns-name={{ include "external-secrets.fullname" . }}-webhook.{{ template "external-secrets.namespace" . }}.svc
+ - --cert-dir={{ .Values.webhook.certDir }}
+ - --check-interval={{ .Values.webhook.certCheckInterval }}
+ - --metrics-addr=:{{ .Values.webhook.metrics.listen.port }}
+ - --healthz-addr={{ .Values.webhook.readinessProbe.address }}:{{ .Values.webhook.readinessProbe.port }}
+ - --loglevel={{ .Values.webhook.log.level }}
+ - --zap-time-encoding={{ .Values.webhook.log.timeEncoding }}
+ {{- if .Values.webhook.lookaheadInterval }}
+ - --lookahead-interval={{ .Values.webhook.lookaheadInterval }}
+ {{- end }}
+ {{- range $key, $value := .Values.webhook.extraArgs }}
+ {{- if $value }}
+ - --{{ $key }}={{ $value }}
+ {{- else }}
+ - --{{ $key }}
+ {{- end }}
+ {{- end }}
+ ports:
+ - containerPort: {{ .Values.webhook.metrics.listen.port }}
+ protocol: TCP
+ name: metrics
+ - containerPort: {{ .Values.webhook.port }}
+ protocol: TCP
+ name: webhook
+ readinessProbe:
+ httpGet:
+ port: {{ .Values.webhook.readinessProbe.port }}
+ path: /readyz
+ initialDelaySeconds: 20
+ periodSeconds: 5
+ {{- with .Values.webhook.extraEnv }}
+ env:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ {{- with .Values.webhook.resources }}
+ resources:
+ {{- toYaml . | nindent 12 }}
+ {{- end }}
+ volumeMounts:
+ - name: certs
+ mountPath: {{ .Values.webhook.certDir }}
+ readOnly: true
+ {{- if .Values.webhook.extraVolumeMounts }}
+ {{- toYaml .Values.webhook.extraVolumeMounts | nindent 12 }}
+ {{- end }}
+ volumes:
+ - name: certs
+ secret:
+ secretName: {{ include "external-secrets.fullname" . }}-webhook
+ {{- if .Values.webhook.extraVolumes }}
+ {{- toYaml .Values.webhook.extraVolumes | nindent 8 }}
+ {{- end }}
+ {{- with .Values.webhook.nodeSelector | default .Values.global.nodeSelector }}
+ nodeSelector:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.webhook.affinity | default .Values.global.affinity }}
+ affinity:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.webhook.tolerations | default .Values.global.tolerations }}
+ tolerations:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- with .Values.webhook.topologySpreadConstraints | default .Values.global.topologySpreadConstraints }}
+ topologySpreadConstraints:
+ {{- toYaml . | nindent 8 }}
+ {{- end }}
+ {{- if .Values.webhook.priorityClassName }}
+ priorityClassName: {{ .Values.webhook.priorityClassName }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/webhook-poddisruptionbudget.yaml b/charts/external-secrets/templates/webhook-poddisruptionbudget.yaml
new file mode 100644
index 0000000..58345ba
--- /dev/null
+++ b/charts/external-secrets/templates/webhook-poddisruptionbudget.yaml
@@ -0,0 +1,20 @@
+{{- if and .Values.webhook.create .Values.webhook.podDisruptionBudget.enabled }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-webhook-pdb
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ external-secrets.io/component: webhook
+spec:
+ {{- if .Values.webhook.podDisruptionBudget.minAvailable }}
+ minAvailable: {{ .Values.webhook.podDisruptionBudget.minAvailable }}
+ {{- end }}
+ {{- if .Values.webhook.podDisruptionBudget.maxUnavailable }}
+ maxUnavailable: {{ .Values.webhook.podDisruptionBudget.maxUnavailable }}
+ {{- end }}
+ selector:
+ matchLabels:
+ {{- include "external-secrets-webhook.selectorLabels" . | nindent 6 }}
+{{- end }}
diff --git a/charts/external-secrets/templates/webhook-secret.yaml b/charts/external-secrets/templates/webhook-secret.yaml
new file mode 100644
index 0000000..fa7760e
--- /dev/null
+++ b/charts/external-secrets/templates/webhook-secret.yaml
@@ -0,0 +1,14 @@
+{{- if and .Values.webhook.create (not .Values.webhook.certManager.enabled) }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-webhook
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ external-secrets.io/component: webhook
+ {{- with .Values.webhook.secretAnnotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/templates/webhook-service.yaml b/charts/external-secrets/templates/webhook-service.yaml
new file mode 100644
index 0000000..14b99a3
--- /dev/null
+++ b/charts/external-secrets/templates/webhook-service.yaml
@@ -0,0 +1,35 @@
+{{- if and .Values.webhook.create .Values.webhook.service.enabled }}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ include "external-secrets.fullname" . }}-webhook
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ external-secrets.io/component: webhook
+ {{- include "external-secrets-webhook.annotations" . | nindent 2 }}
+spec:
+ type: {{ .Values.webhook.service.type }}
+ {{- if .Values.service.ipFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.service.ipFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.service.ipFamilies }}
+ ipFamilies: {{ .Values.service.ipFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ {{- with .Values.webhook.service.loadBalancerIP }}
+ loadBalancerIP: {{ . }}
+ {{- end }}
+ ports:
+ - port: 443
+ targetPort: {{ .Values.webhook.port }}
+ protocol: TCP
+ name: webhook
+ {{- if or .Values.webhook.metrics.service.enabled ( and ( .Capabilities.APIVersions.Has "monitoring.coreos.com/v1" ) .Values.serviceMonitor.enabled ) }}
+ - port: {{ .Values.webhook.metrics.service.port }}
+ protocol: TCP
+ targetPort: metrics
+ name: metrics
+ {{- end }}
+ selector:
+ {{- include "external-secrets-webhook.selectorLabels" . | nindent 4 }}
+{{- end }}
diff --git a/charts/external-secrets/templates/webhook-serviceaccount.yaml b/charts/external-secrets/templates/webhook-serviceaccount.yaml
new file mode 100644
index 0000000..1936218
--- /dev/null
+++ b/charts/external-secrets/templates/webhook-serviceaccount.yaml
@@ -0,0 +1,16 @@
+{{- if and .Values.webhook.create .Values.webhook.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ include "external-secrets-webhook.serviceAccountName" . }}
+ namespace: {{ template "external-secrets.namespace" . }}
+ labels:
+ {{- include "external-secrets-webhook.labels" . | nindent 4 }}
+ {{- with .Values.webhook.serviceAccount.extraLabels }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ {{- with .Values.webhook.serviceAccount.annotations }}
+ annotations:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+{{- end }}
diff --git a/charts/external-secrets/values.schema.json b/charts/external-secrets/values.schema.json
new file mode 100644
index 0000000..9368909
--- /dev/null
+++ b/charts/external-secrets/values.schema.json
@@ -0,0 +1,970 @@
+{
+ "$schema": "https://json-schema.org/draft/2020-12/schema",
+ "properties": {
+ "affinity": {
+ "properties": {},
+ "type": "object"
+ },
+ "bitwarden-sdk-server": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "certController": {
+ "properties": {
+ "affinity": {
+ "properties": {},
+ "type": "object"
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "deploymentAnnotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "extraArgs": {
+ "properties": {},
+ "type": "object"
+ },
+ "extraEnv": {
+ "type": "array"
+ },
+ "extraVolumeMounts": {
+ "type": "array"
+ },
+ "extraVolumes": {
+ "type": "array"
+ },
+ "fullnameOverride": {
+ "type": "string"
+ },
+ "hostNetwork": {
+ "type": "boolean"
+ },
+ "image": {
+ "properties": {
+ "flavour": {
+ "type": "string"
+ },
+ "pullPolicy": {
+ "type": "string"
+ },
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "imagePullSecrets": {
+ "type": "array"
+ },
+ "log": {
+ "properties": {
+ "level": {
+ "type": "string"
+ },
+ "timeEncoding": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metrics": {
+ "properties": {
+ "listen": {
+ "properties": {
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "service": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nameOverride": {
+ "type": "string"
+ },
+ "nodeSelector": {
+ "properties": {},
+ "type": "object"
+ },
+ "podAnnotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "podDisruptionBudget": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "minAvailable": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "podLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "podSecurityContext": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "priorityClassName": {
+ "type": "string"
+ },
+ "rbac": {
+ "properties": {
+ "create": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "readinessProbe": {
+ "properties": {
+ "address": {
+ "type": "string"
+ },
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "replicaCount": {
+ "type": "integer"
+ },
+ "requeueInterval": {
+ "type": "string"
+ },
+ "resources": {
+ "properties": {},
+ "type": "object"
+ },
+ "revisionHistoryLimit": {
+ "type": "integer"
+ },
+ "securityContext": {
+ "properties": {
+ "allowPrivilegeEscalation": {
+ "type": "boolean"
+ },
+ "capabilities": {
+ "properties": {
+ "drop": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "readOnlyRootFilesystem": {
+ "type": "boolean"
+ },
+ "runAsNonRoot": {
+ "type": "boolean"
+ },
+ "runAsUser": {
+ "type": "integer"
+ },
+ "seccompProfile": {
+ "properties": {
+ "type": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "serviceAccount": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "automount": {
+ "type": "boolean"
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "extraLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "name": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "tolerations": {
+ "type": "array"
+ },
+ "topologySpreadConstraints": {
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "commonLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "concurrent": {
+ "type": "integer"
+ },
+ "controllerClass": {
+ "type": "string"
+ },
+ "crds": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "conversion": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "createClusterExternalSecret": {
+ "type": "boolean"
+ },
+ "createClusterGenerator": {
+ "type": "boolean"
+ },
+ "createClusterPushSecret": {
+ "type": "boolean"
+ },
+ "createClusterSecretStore": {
+ "type": "boolean"
+ },
+ "createPushSecret": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "createOperator": {
+ "type": "boolean"
+ },
+ "deploymentAnnotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "dnsConfig": {
+ "properties": {},
+ "type": "object"
+ },
+ "dnsPolicy": {
+ "type": "string"
+ },
+ "extendedMetricLabels": {
+ "type": "boolean"
+ },
+ "extraArgs": {
+ "properties": {},
+ "type": "object"
+ },
+ "extraContainers": {
+ "type": "array"
+ },
+ "extraEnv": {
+ "type": "array"
+ },
+ "extraObjects": {
+ "type": "array"
+ },
+ "extraVolumeMounts": {
+ "type": "array"
+ },
+ "extraVolumes": {
+ "type": "array"
+ },
+ "fullnameOverride": {
+ "type": "string"
+ },
+ "global": {
+ "properties": {
+ "affinity": {
+ "properties": {},
+ "type": "object"
+ },
+ "compatibility": {
+ "properties": {
+ "openshift": {
+ "properties": {
+ "adaptSecurityContext": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nodeSelector": {
+ "properties": {},
+ "type": "object"
+ },
+ "tolerations": {
+ "type": "array"
+ },
+ "topologySpreadConstraints": {
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "grafanaDashboard": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "sidecarLabel": {
+ "type": "string"
+ },
+ "sidecarLabelValue": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "hostNetwork": {
+ "type": "boolean"
+ },
+ "image": {
+ "properties": {
+ "flavour": {
+ "type": "string"
+ },
+ "pullPolicy": {
+ "type": "string"
+ },
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "imagePullSecrets": {
+ "type": "array"
+ },
+ "installCRDs": {
+ "type": "boolean"
+ },
+ "leaderElect": {
+ "type": "boolean"
+ },
+ "log": {
+ "properties": {
+ "level": {
+ "type": "string"
+ },
+ "timeEncoding": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "metrics": {
+ "properties": {
+ "listen": {
+ "properties": {
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "service": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nameOverride": {
+ "type": "string"
+ },
+ "namespaceOverride": {
+ "type": "string"
+ },
+ "nodeSelector": {
+ "properties": {},
+ "type": "object"
+ },
+ "openshiftFinalizers": {
+ "type": "boolean"
+ },
+ "podAnnotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "podDisruptionBudget": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "minAvailable": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "podLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "podSecurityContext": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "podSpecExtra": {
+ "properties": {},
+ "type": "object"
+ },
+ "priorityClassName": {
+ "type": "string"
+ },
+ "processClusterExternalSecret": {
+ "type": "boolean"
+ },
+ "processClusterPushSecret": {
+ "type": "boolean"
+ },
+ "processClusterStore": {
+ "type": "boolean"
+ },
+ "processPushSecret": {
+ "type": "boolean"
+ },
+ "rbac": {
+ "properties": {
+ "aggregateToEdit": {
+ "type": "boolean"
+ },
+ "aggregateToView": {
+ "type": "boolean"
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "servicebindings": {
+ "properties": {
+ "create": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "replicaCount": {
+ "type": "integer"
+ },
+ "resources": {
+ "properties": {},
+ "type": "object"
+ },
+ "revisionHistoryLimit": {
+ "type": "integer"
+ },
+ "scopedNamespace": {
+ "type": "string"
+ },
+ "scopedRBAC": {
+ "type": "boolean"
+ },
+ "securityContext": {
+ "properties": {
+ "allowPrivilegeEscalation": {
+ "type": "boolean"
+ },
+ "capabilities": {
+ "properties": {
+ "drop": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "readOnlyRootFilesystem": {
+ "type": "boolean"
+ },
+ "runAsNonRoot": {
+ "type": "boolean"
+ },
+ "runAsUser": {
+ "type": "integer"
+ },
+ "seccompProfile": {
+ "properties": {
+ "type": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "service": {
+ "properties": {
+ "ipFamilies": {
+ "type": "array"
+ },
+ "ipFamilyPolicy": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "serviceAccount": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "automount": {
+ "type": "boolean"
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "extraLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "name": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "serviceMonitor": {
+ "properties": {
+ "additionalLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "honorLabels": {
+ "type": "boolean"
+ },
+ "interval": {
+ "type": "string"
+ },
+ "metricRelabelings": {
+ "type": "array"
+ },
+ "namespace": {
+ "type": "string"
+ },
+ "relabelings": {
+ "type": "array"
+ },
+ "scrapeTimeout": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "tolerations": {
+ "type": "array"
+ },
+ "topologySpreadConstraints": {
+ "type": "array"
+ },
+ "webhook": {
+ "properties": {
+ "affinity": {
+ "properties": {},
+ "type": "object"
+ },
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "certCheckInterval": {
+ "type": "string"
+ },
+ "certDir": {
+ "type": "string"
+ },
+ "certManager": {
+ "properties": {
+ "addInjectorAnnotations": {
+ "type": "boolean"
+ },
+ "cert": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "duration": {
+ "type": "string"
+ },
+ "issuerRef": {
+ "properties": {
+ "group": {
+ "type": "string"
+ },
+ "kind": {
+ "type": "string"
+ },
+ "name": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "renewBefore": {
+ "type": "string"
+ },
+ "revisionHistoryLimit": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "deploymentAnnotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "extraArgs": {
+ "properties": {},
+ "type": "object"
+ },
+ "extraEnv": {
+ "type": "array"
+ },
+ "extraVolumeMounts": {
+ "type": "array"
+ },
+ "extraVolumes": {
+ "type": "array"
+ },
+ "failurePolicy": {
+ "type": "string"
+ },
+ "fullnameOverride": {
+ "type": "string"
+ },
+ "hostNetwork": {
+ "type": "boolean"
+ },
+ "image": {
+ "properties": {
+ "flavour": {
+ "type": "string"
+ },
+ "pullPolicy": {
+ "type": "string"
+ },
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "imagePullSecrets": {
+ "type": "array"
+ },
+ "log": {
+ "properties": {
+ "level": {
+ "type": "string"
+ },
+ "timeEncoding": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "lookaheadInterval": {
+ "type": "string"
+ },
+ "metrics": {
+ "properties": {
+ "listen": {
+ "properties": {
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "service": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "nameOverride": {
+ "type": "string"
+ },
+ "nodeSelector": {
+ "properties": {},
+ "type": "object"
+ },
+ "podAnnotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "podDisruptionBudget": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "minAvailable": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "podLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "podSecurityContext": {
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "port": {
+ "type": "integer"
+ },
+ "priorityClassName": {
+ "type": "string"
+ },
+ "rbac": {
+ "properties": {
+ "create": {
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+ },
+ "readinessProbe": {
+ "properties": {
+ "address": {
+ "type": "string"
+ },
+ "port": {
+ "type": "integer"
+ }
+ },
+ "type": "object"
+ },
+ "replicaCount": {
+ "type": "integer"
+ },
+ "resources": {
+ "properties": {},
+ "type": "object"
+ },
+ "revisionHistoryLimit": {
+ "type": "integer"
+ },
+ "secretAnnotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "securityContext": {
+ "properties": {
+ "allowPrivilegeEscalation": {
+ "type": "boolean"
+ },
+ "capabilities": {
+ "properties": {
+ "drop": {
+ "items": {
+ "type": "string"
+ },
+ "type": "array"
+ }
+ },
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "readOnlyRootFilesystem": {
+ "type": "boolean"
+ },
+ "runAsNonRoot": {
+ "type": "boolean"
+ },
+ "runAsUser": {
+ "type": "integer"
+ },
+ "seccompProfile": {
+ "properties": {
+ "type": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+ },
+ "service": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "labels": {
+ "properties": {},
+ "type": "object"
+ },
+ "loadBalancerIP": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "serviceAccount": {
+ "properties": {
+ "annotations": {
+ "properties": {},
+ "type": "object"
+ },
+ "automount": {
+ "type": "boolean"
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "extraLabels": {
+ "properties": {},
+ "type": "object"
+ },
+ "name": {
+ "type": "string"
+ }
+ },
+ "type": "object"
+ },
+ "tolerations": {
+ "type": "array"
+ },
+ "topologySpreadConstraints": {
+ "type": "array"
+ }
+ },
+ "type": "object"
+ }
+ },
+ "type": "object"
+}
diff --git a/charts/external-secrets/values.yaml b/charts/external-secrets/values.yaml
new file mode 100644
index 0000000..c8f003e
--- /dev/null
+++ b/charts/external-secrets/values.yaml
@@ -0,0 +1,584 @@
+global:
+ nodeSelector: {}
+ tolerations: []
+ topologySpreadConstraints: []
+ affinity: {}
+ compatibility:
+ openshift:
+ # -- Manages the securityContext properties to make them compatible with OpenShift.
+ # Possible values:
+ # auto - Apply configurations if it is detected that OpenShift is the target platform.
+ # force - Always apply configurations.
+ # disabled - No modification applied.
+ adaptSecurityContext: auto
+
+replicaCount: 1
+
+bitwarden-sdk-server:
+ enabled: false
+
+# -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
+revisionHistoryLimit: 10
+
+image:
+ repository: oci.external-secrets.io/external-secrets/external-secrets
+ pullPolicy: IfNotPresent
+ # -- The image tag to use. The default is the chart appVersion.
+ tag: ""
+ # -- The flavour of tag you want to use
+ # There are different image flavours available, like distroless and ubi.
+ # Please see GitHub release notes for image tags for these flavors.
+ # By default, the distroless image is used.
+ flavour: ""
+
+# -- If set, install and upgrade CRDs through helm chart.
+installCRDs: true
+
+crds:
+ # -- If true, create CRDs for Cluster External Secret.
+ createClusterExternalSecret: true
+ # -- If true, create CRDs for Cluster Secret Store.
+ createClusterSecretStore: true
+ # -- If true, create CRDs for Cluster Generator.
+ createClusterGenerator: true
+ # -- If true, create CRDs for Cluster Push Secret.
+ createClusterPushSecret: true
+ # -- If true, create CRDs for Push Secret.
+ createPushSecret: true
+ annotations: {}
+ conversion:
+ # -- Conversion is disabled by default as we stopped supporting v1alpha1.
+ enabled: false
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+namespaceOverride: ""
+
+# -- Additional labels added to all helm chart resources.
+commonLabels: {}
+
+# -- If true, external-secrets will perform leader election between instances to ensure no more
+# than one instance of external-secrets operates at a time.
+leaderElect: false
+
+# -- If set external secrets will filter matching
+# Secret Stores with the appropriate controller values.
+controllerClass: ""
+
+# -- If true external secrets will use recommended kubernetes
+# annotations as prometheus metric labels.
+extendedMetricLabels: false
+
+# -- If set external secrets are only reconciled in the
+# provided namespace
+scopedNamespace: ""
+
+# -- Must be used with scopedNamespace. If true, create scoped RBAC roles under the scoped namespace
+# and implicitly disable cluster stores and cluster external secrets
+scopedRBAC: false
+
+# -- If true the OpenShift finalizer permissions will be added to RBAC
+openshiftFinalizers: true
+
+# -- if true, the operator will process cluster external secret. Else, it will ignore them.
+processClusterExternalSecret: true
+
+# -- if true, the operator will process cluster push secret. Else, it will ignore them.
+processClusterPushSecret: true
+
+# -- if true, the operator will process cluster store. Else, it will ignore them.
+processClusterStore: true
+
+# -- if true, the operator will process push secret. Else, it will ignore them.
+processPushSecret: true
+
+# -- Specifies whether an external secret operator deployment be created.
+createOperator: true
+
+# -- Specifies the number of concurrent ExternalSecret Reconciles external-secret executes at
+# a time.
+concurrent: 1
+# -- Specifices Log Params to the External Secrets Operator
+log:
+ level: info
+ timeEncoding: epoch
+service:
+ # -- Set the ip family policy to configure dual-stack see [Configure dual-stack](https://kubernetes.io/docs/concepts/services-networking/dual-stack/#services)
+ ipFamilyPolicy: ""
+ # -- Sets the families that should be supported and the order in which they should be applied to ClusterIP as well. Can be IPv4 and/or IPv6.
+ ipFamilies: []
+
+serviceAccount:
+ # -- Specifies whether a service account should be created.
+ create: true
+ # -- Automounts the service account token in all containers of the pod
+ automount: true
+ # -- Annotations to add to the service account.
+ annotations: {}
+ # -- Extra Labels to add to the service account.
+ extraLabels: {}
+ # -- The name of the service account to use.
+ # If not set and create is true, a name is generated using the fullname template.
+ name: ""
+
+rbac:
+ # -- Specifies whether role and rolebinding resources should be created.
+ create: true
+
+ servicebindings:
+ # -- Specifies whether a clusterrole to give servicebindings read access should be created.
+ create: true
+
+ # -- Specifies whether permissions are aggregated to the view ClusterRole
+ aggregateToView: true
+
+ # -- Specifies whether permissions are aggregated to the edit ClusterRole
+ aggregateToEdit: true
+
+## -- Extra environment variables to add to container.
+extraEnv: []
+
+## -- Map of extra arguments to pass to container.
+extraArgs: {}
+
+## -- Extra volumes to pass to pod.
+extraVolumes: []
+
+## -- Extra Kubernetes objects to deploy with the helm chart
+extraObjects: []
+
+## -- Extra volumes to mount to the container.
+extraVolumeMounts: []
+
+## -- Extra containers to add to the pod.
+extraContainers: []
+
+# -- Annotations to add to Deployment
+deploymentAnnotations: {}
+
+# -- Annotations to add to Pod
+podAnnotations: {}
+
+podLabels: {}
+
+podSecurityContext:
+ enabled: true
+ # fsGroup: 2000
+
+securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ enabled: true
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+
+resources: {}
+ # requests:
+ # cpu: 10m
+ # memory: 32Mi
+
+serviceMonitor:
+ # -- Specifies whether to create a ServiceMonitor resource for collecting Prometheus metrics
+ enabled: false
+
+ # -- namespace where you want to install ServiceMonitors
+ namespace: ""
+
+ # -- Additional labels
+ additionalLabels: {}
+
+ # -- Interval to scrape metrics
+ interval: 30s
+
+ # -- Timeout if metrics can't be retrieved in given time interval
+ scrapeTimeout: 25s
+
+ # -- Let prometheus add an exported_ prefix to conflicting labels
+ honorLabels: false
+
+ # -- Metric relabel configs to apply to samples before ingestion. [Metric Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#metric_relabel_configs)
+ metricRelabelings: []
+ # - action: replace
+ # regex: (.*)
+ # replacement: $1
+ # sourceLabels:
+ # - exported_namespace
+ # targetLabel: namespace
+
+ # -- Relabel configs to apply to samples before ingestion. [Relabeling](https://prometheus.io/docs/prometheus/latest/configuration/configuration/#relabel_config)
+ relabelings: []
+ # - sourceLabels: [__meta_kubernetes_pod_node_name]
+ # separator: ;
+ # regex: ^(.*)$
+ # targetLabel: nodename
+ # replacement: $1
+ # action: replace
+
+metrics:
+
+ listen:
+ port: 8080
+
+ service:
+ # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
+ enabled: false
+
+ # -- Metrics service port to scrape
+ port: 8080
+
+ # -- Additional service annotations
+ annotations: {}
+
+grafanaDashboard:
+ # -- If true creates a Grafana dashboard.
+ enabled: false
+
+ # -- Label that ConfigMaps should have to be loaded as dashboards.
+ sidecarLabel: "grafana_dashboard"
+
+ # -- Label value that ConfigMaps should have to be loaded as dashboards.
+ sidecarLabelValue: "1"
+
+ # -- Annotations that ConfigMaps can have to get configured in Grafana,
+ # See: sidecar.dashboards.folderAnnotation for specifying the dashboard folder.
+ # https://github.com/grafana/helm-charts/tree/main/charts/grafana
+ annotations: {}
+
+nodeSelector: {}
+
+tolerations: []
+
+topologySpreadConstraints: []
+
+affinity: {}
+
+# -- Pod priority class name.
+priorityClassName: ""
+
+# -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+podDisruptionBudget:
+ enabled: false
+ minAvailable: 1
+ # maxUnavailable: 1
+
+# -- Run the controller on the host network
+hostNetwork: false
+
+webhook:
+ # -- Annotations to place on validating webhook configuration.
+ annotations: {}
+ # -- Specifies whether a webhook deployment be created. If set to false, crds.conversion.enabled should also be set to false otherwise the kubeapi will be hammered because the conversion is looking for a webhook endpoint.
+ create: true
+ # -- Specifices the time to check if the cert is valid
+ certCheckInterval: "5m"
+ # -- Specifices the lookaheadInterval for certificate validity
+ lookaheadInterval: ""
+ replicaCount: 1
+ # -- Specifices Log Params to the Webhook
+ log:
+ level: info
+ timeEncoding: epoch
+ # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
+ revisionHistoryLimit: 10
+
+ certDir: /tmp/certs
+ # -- Specifies whether validating webhooks should be created with failurePolicy: Fail or Ignore
+ failurePolicy: Fail
+ # -- Specifies if webhook pod should use hostNetwork or not.
+ hostNetwork: false
+ image:
+ repository: oci.external-secrets.io/external-secrets/external-secrets
+ pullPolicy: IfNotPresent
+ # -- The image tag to use. The default is the chart appVersion.
+ tag: ""
+ # -- The flavour of tag you want to use
+ flavour: ""
+ imagePullSecrets: []
+ nameOverride: ""
+ fullnameOverride: ""
+ # -- The port the webhook will listen to
+ port: 10250
+ rbac:
+ # -- Specifies whether role and rolebinding resources should be created.
+ create: true
+ serviceAccount:
+ # -- Specifies whether a service account should be created.
+ create: true
+ # -- Automounts the service account token in all containers of the pod
+ automount: true
+ # -- Annotations to add to the service account.
+ annotations: {}
+ # -- Extra Labels to add to the service account.
+ extraLabels: {}
+ # -- The name of the service account to use.
+ # If not set and create is true, a name is generated using the fullname template.
+ name: ""
+ nodeSelector: {}
+
+ certManager:
+ # -- Enabling cert-manager support will disable the built in secret and
+ # switch to using cert-manager (installed separately) to automatically issue
+ # and renew the webhook certificate. This chart does not install
+ # cert-manager for you, See https://cert-manager.io/docs/
+ enabled: false
+ # -- Automatically add the cert-manager.io/inject-ca-from annotation to the
+ # webhooks and CRDs. As long as you have the cert-manager CA Injector
+ # enabled, this will automatically setup your webhook's CA to the one used
+ # by cert-manager. See https://cert-manager.io/docs/concepts/ca-injector
+ addInjectorAnnotations: true
+ cert:
+ # -- Create a certificate resource within this chart. See
+ # https://cert-manager.io/docs/usage/certificate/
+ create: true
+ # -- For the Certificate created by this chart, setup the issuer. See
+ # https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.IssuerSpec
+ issuerRef:
+ group: cert-manager.io
+ kind: "Issuer"
+ name: "my-issuer"
+ # -- Set the requested duration (i.e. lifetime) of the Certificate. See
+ # https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
+ # One year by default.
+ duration: "8760h"
+ # -- Set the revisionHistoryLimit on the Certificate. See
+ # https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
+ # Defaults to 0 (ignored).
+ revisionHistoryLimit: 0
+ # -- How long before the currently issued certificate’s expiry
+ # cert-manager should renew the certificate. See
+ # https://cert-manager.io/docs/reference/api-docs/#cert-manager.io/v1.CertificateSpec
+ # Note that renewBefore should be greater than .webhook.lookaheadInterval
+ # since the webhook will check this far in advance that the certificate is
+ # valid.
+ renewBefore: ""
+ # -- Add extra annotations to the Certificate resource.
+ annotations: {}
+
+ tolerations: []
+
+ topologySpreadConstraints: []
+
+ affinity: {}
+
+ # -- Pod priority class name.
+ priorityClassName: ""
+
+ # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+ podDisruptionBudget:
+ enabled: false
+ minAvailable: 1
+ # maxUnavailable: 1
+
+ metrics:
+
+ listen:
+ port: 8080
+
+ service:
+ # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
+ enabled: false
+
+ # -- Metrics service port to scrape
+ port: 8080
+
+ # -- Additional service annotations
+ annotations: {}
+
+
+ readinessProbe:
+ # -- Address for readiness probe
+ address: ""
+ # -- ReadinessProbe port for kubelet
+ port: 8081
+
+
+ ## -- Extra environment variables to add to container.
+ extraEnv: []
+
+ ## -- Map of extra arguments to pass to container.
+ extraArgs: {}
+
+ ## -- Extra volumes to pass to pod.
+ extraVolumes: []
+
+ ## -- Extra volumes to mount to the container.
+ extraVolumeMounts: []
+
+ # -- Annotations to add to Secret
+ secretAnnotations: {}
+
+ # -- Annotations to add to Deployment
+ deploymentAnnotations: {}
+
+ # -- Annotations to add to Pod
+ podAnnotations: {}
+
+ podLabels: {}
+
+ podSecurityContext:
+ enabled: true
+ # fsGroup: 2000
+
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ enabled: true
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+
+ resources: {}
+ # requests:
+ # cpu: 10m
+ # memory: 32Mi
+
+ # -- Manage the service through which the webhook is reached.
+ service:
+ # -- Whether the service object should be enabled or not (it is expected to exist).
+ enabled: true
+ # -- Custom annotations for the webhook service.
+ annotations: {}
+ # -- Custom labels for the webhook service.
+ labels: {}
+ # -- The service type of the webhook service.
+ type: ClusterIP
+ # -- If the webhook service type is LoadBalancer, you can assign a specific load balancer IP here.
+ # Check the documentation of your load balancer provider to see if/how this should be used.
+ loadBalancerIP: ""
+
+certController:
+ # -- Specifies whether a certificate controller deployment be created.
+ create: true
+ requeueInterval: "5m"
+ replicaCount: 1
+ # -- Specifices Log Params to the Certificate Controller
+ log:
+ level: info
+ timeEncoding: epoch
+ # -- Specifies the amount of historic ReplicaSets k8s should keep (see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#clean-up-policy)
+ revisionHistoryLimit: 10
+
+ image:
+ repository: oci.external-secrets.io/external-secrets/external-secrets
+ pullPolicy: IfNotPresent
+ tag: ""
+ flavour: ""
+ imagePullSecrets: []
+ nameOverride: ""
+ fullnameOverride: ""
+ rbac:
+ # -- Specifies whether role and rolebinding resources should be created.
+ create: true
+ serviceAccount:
+ # -- Specifies whether a service account should be created.
+ create: true
+ # -- Automounts the service account token in all containers of the pod
+ automount: true
+ # -- Annotations to add to the service account.
+ annotations: {}
+ # -- Extra Labels to add to the service account.
+ extraLabels: {}
+ # -- The name of the service account to use.
+ # If not set and create is true, a name is generated using the fullname template.
+ name: ""
+ nodeSelector: {}
+
+ tolerations: []
+
+ topologySpreadConstraints: []
+
+ affinity: {}
+
+ # -- Run the certController on the host network
+ hostNetwork: false
+
+ # -- Pod priority class name.
+ priorityClassName: ""
+
+ # -- Pod disruption budget - for more details see https://kubernetes.io/docs/concepts/workloads/pods/disruptions/
+ podDisruptionBudget:
+ enabled: false
+ minAvailable: 1
+ # maxUnavailable: 1
+
+ metrics:
+
+ listen:
+ port: 8080
+
+ service:
+ # -- Enable if you use another monitoring tool than Prometheus to scrape the metrics
+ enabled: false
+
+ # -- Metrics service port to scrape
+ port: 8080
+
+ # -- Additional service annotations
+ annotations: {}
+
+ readinessProbe:
+ # -- Address for readiness probe
+ address: ""
+ # -- ReadinessProbe port for kubelet
+ port: 8081
+
+ ## -- Extra environment variables to add to container.
+ extraEnv: []
+
+ ## -- Map of extra arguments to pass to container.
+ extraArgs: {}
+
+
+ ## -- Extra volumes to pass to pod.
+ extraVolumes: []
+
+ ## -- Extra volumes to mount to the container.
+ extraVolumeMounts: []
+
+ # -- Annotations to add to Deployment
+ deploymentAnnotations: {}
+
+ # -- Annotations to add to Pod
+ podAnnotations: {}
+
+ podLabels: {}
+
+ podSecurityContext:
+ enabled: true
+ # fsGroup: 2000
+
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ enabled: true
+ readOnlyRootFilesystem: true
+ runAsNonRoot: true
+ runAsUser: 1000
+ seccompProfile:
+ type: RuntimeDefault
+
+ resources: {}
+ # requests:
+ # cpu: 10m
+ # memory: 32Mi
+
+# -- Specifies `dnsPolicy` to deployment
+dnsPolicy: ClusterFirst
+
+# -- Specifies `dnsOptions` to deployment
+dnsConfig: {}
+
+# -- Any extra pod spec on the deployment
+podSpecExtra: {}
diff --git a/charts/vault/.helmignore b/charts/vault/.helmignore
new file mode 100644
index 0000000..18dbc2b
--- /dev/null
+++ b/charts/vault/.helmignore
@@ -0,0 +1,29 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.terraform/
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj
+
+# CI and test
+.circleci/
+.github/
+.gitlab-ci.yml
+test/
+scratch/
diff --git a/charts/vault/CHANGELOG.md b/charts/vault/CHANGELOG.md
new file mode 100644
index 0000000..cb9fae8
--- /dev/null
+++ b/charts/vault/CHANGELOG.md
@@ -0,0 +1,606 @@
+## Unreleased
+
+## 0.30.0 (March 27, 2025)
+
+Changes:
+
+* Default `vault` version updated to 1.19.0
+* Default `vault-k8s` version updated to 1.6.2
+* Tested with Kubernetes versions 1.28-1.32
+
+Features:
+
+* server: Support setting custom preStop commands [GH-1099](https://github.com/hashicorp/vault-helm/pull/1099)
+
+Improvements:
+
+* server: Add pod labels to server-test.yaml [GH-1094](https://github.com/hashicorp/vault-helm/pull/1094)
+
+Bugs:
+
+* server: Fix invalid yaml in server test when volumeMounts or volumes are empty [GH-855](https://github.com/hashicorp/vault-helm/pull/855)
+* injector: Add RBAC for deleting configmaps [GH-1100](https://github.com/hashicorp/vault-helm/pull/1100)
+
+## 0.29.1 (November 20, 2024)
+
+Bugs:
+* server: restore support for templated config [GH-1073](https://github.com/hashicorp/vault-helm/pull/1073)
+
+## 0.29.0 (November 7, 2024)
+
+KNOWN ISSUES:
+* Template support in server config stopped working [GH-1072](https://github.com/hashicorp/vault-helm/issues/1072)
+
+Changes:
+
+* Default `vault` version updated to 1.18.1
+* Default `vault-k8s` version updated to 1.5.0
+* Default `vault-csi-provider` version updated to 1.5.0
+* Tested with Kubernetes versions 1.27-1.31
+
+Features:
+
+* csi: Allow modification of the hostNetwork parameter on the DaemonSet [GH-1046](https://github.com/hashicorp/vault-helm/pull/1046)
+
+Bugs:
+
+* Properly handle JSON formatted server config [GH-1049](https://github.com/hashicorp/vault-helm/pull/1049)
+
+## 0.28.1 (July 11, 2024)
+
+Changes:
+
+* Default `vault` version updated to 1.17.2
+* Default `vault-k8s` version updated to 1.4.2
+* Default `vault-csi-provider` version updated to 1.4.3
+* Tested with Kubernetes versions 1.26-1.30
+
+Improvements:
+
+* Configurable `tlsConfig` and `authorization` for Prometheus ServiceMonitor [GH-1025](https://github.com/hashicorp/vault-helm/pull/1025)
+* Remove UPDATE from injector-mutating-webhook [GH-783](https://github.com/hashicorp/vault-helm/pull/783)
+* Add scope to mutating webhook [GH-1037](https://github.com/hashicorp/vault-helm/pull/1037)
+
+## 0.28.0 (April 8, 2024)
+
+Changes:
+
+* Default `vault` version updated to 1.16.1
+* Default `vault-k8s` version updated to 1.4.1
+* Default `vault-csi-provider` version updated to 1.4.2
+* Tested with Kubernetes versions 1.25-1.29
+
+Features:
+
+* server: Add annotation on config change [GH-1001](https://github.com/hashicorp/vault-helm/pull/1001)
+
+Bugs:
+
+* injector: add missing `get` `nodes` permission to ClusterRole [GH-1005](https://github.com/hashicorp/vault-helm/pull/1005)
+
+## 0.27.0 (November 16, 2023)
+
+Changes:
+
+* Default `vault` version updated to 1.15.2
+
+Features:
+
+* server: Support setting `persistentVolumeClaimRetentionPolicy` on the StatefulSet [GH-965](https://github.com/hashicorp/vault-helm/pull/965)
+* server: Support setting labels on PVCs [GH-969](https://github.com/hashicorp/vault-helm/pull/969)
+* server: Support setting ingress rules for networkPolicy [GH-877](https://github.com/hashicorp/vault-helm/pull/877)
+
+Improvements:
+
+* Support exec in the server liveness probe [GH-971](https://github.com/hashicorp/vault-helm/pull/971)
+
+## 0.26.1 (October 30, 2023)
+
+Bugs:
+* Fix templating of `server.ha.replicas` when set via override file. The `0.26.0` chart would ignore `server.ha.replicas` and always deploy 3 server replicas when `server.ha.enabled=true` unless overridden by command line when issuing the helm command: `--set server.ha.replicas=`. Fixed in [GH-961](https://github.com/hashicorp/vault-helm/pull/961)
+
+## 0.26.0 (October 27, 2023)
+
+Changes:
+* Default `vault` version updated to 1.15.1
+* Default `vault-k8s` version updated to 1.3.1
+* Default `vault-csi-provider` version updated to 1.4.1
+* Tested with Kubernetes versions 1.24-1.28
+* server: OpenShift default readiness probe returns 204 when uninitialized [GH-966](https://github.com/hashicorp/vault-helm/pull/966)
+
+Features:
+* server: Add support for dual stack clusters [GH-833](https://github.com/hashicorp/vault-helm/pull/833)
+* server: Support `hostAliases` for the StatefulSet pods [GH-955](https://github.com/hashicorp/vault-helm/pull/955)
+* server: Add `server.service.active.annotations` and `server.service.standby.annotations` [GH-896](https://github.com/hashicorp/vault-helm/pull/896)
+* server: Add long-lived service account token option [GH-923](https://github.com/hashicorp/vault-helm/pull/923)
+
+Bugs:
+* csi: Add namespace field to `csi-role` and `csi-rolebindings`. [GH-909](https://github.com/hashicorp/vault-helm/pull/909)
+
+Improvements:
+* global: Add `global.namespace` to override the helm installation namespace. [GH-909](https://github.com/hashicorp/vault-helm/pull/909)
+* server: use vault.fullname in Helm test [GH-912](https://github.com/hashicorp/vault-helm/pull/912)
+* server: Allow scaling HA replicas to zero [GH-943](https://github.com/hashicorp/vault-helm/pull/943)
+
+## 0.25.0 (June 26, 2023)
+
+Changes:
+* Latest Kubernetes version tested is now 1.27
+* server: Headless service ignores `server.service.publishNotReadyAddresses` setting and always sets it as `true` [GH-902](https://github.com/hashicorp/vault-helm/pull/902)
+* `vault` updated to 1.14.0 [GH-916](https://github.com/hashicorp/vault-helm/pull/916)
+* `vault-csi-provider` updated to 1.4.0 [GH-916](https://github.com/hashicorp/vault-helm/pull/916)
+
+Improvements:
+* CSI: Make `nodeSelector` and `affinity` configurable for CSI daemonset's pods [GH-862](https://github.com/hashicorp/vault-helm/pull/862)
+* injector: Add `ephemeralLimit` and `ephemeralRequest` as options for configuring Agent's ephemeral storage resources [GH-798](https://github.com/hashicorp/vault-helm/pull/798)
+* Minimum kubernetes version for chart reverted to 1.20.0 to allow installation on clusters older than the oldest tested version [GH-916](https://github.com/hashicorp/vault-helm/pull/916)
+
+Bugs:
+* server: Set the default for `prometheusRules.rules` to an empty list [GH-886](https://github.com/hashicorp/vault-helm/pull/886)
+
+## 0.24.1 (April 17, 2023)
+
+Bugs:
+* csi: Add RBAC required by v1.3.0 to create secret for HMAC key used to generate secret versions [GH-872](https://github.com/hashicorp/vault-helm/pull/872)
+
+## 0.24.0 (April 6, 2023)
+
+Changes:
+* Earliest Kubernetes version tested is now 1.22
+* `vault` updated to 1.13.1 [GH-863](https://github.com/hashicorp/vault-helm/pull/863)
+* `vault-k8s` updated to 1.2.1 [GH-868](https://github.com/hashicorp/vault-helm/pull/868)
+* `vault-csi-provider` updated to 1.3.0 [GH-749](https://github.com/hashicorp/vault-helm/pull/749)
+
+Features:
+* server: New `extraPorts` option for adding ports to the Vault server statefulset [GH-841](https://github.com/hashicorp/vault-helm/pull/841)
+* server: Add configurable Port Number in readinessProbe and livenessProbe for the server-statefulset [GH-831](https://github.com/hashicorp/vault-helm/pull/831)
+* injector: Make livenessProbe and readinessProbe configurable and add configurable startupProbe [GH-852](https://github.com/hashicorp/vault-helm/pull/852)
+* csi: Add an Agent sidecar to Vault CSI Provider pods to provide lease caching and renewals [GH-749](https://github.com/hashicorp/vault-helm/pull/749)
+
+## 0.23.0 (November 28th, 2022)
+
+Changes:
+* `vault` updated to 1.12.1 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+* `vault-k8s` updated to 1.1.0 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+* `vault-csi-provider` updated to 1.2.1 [GH-814](https://github.com/hashicorp/vault-helm/pull/814)
+
+Features:
+* server: Add `extraLabels` for Vault server serviceAccount [GH-806](https://github.com/hashicorp/vault-helm/pull/806)
+* server: Add `server.service.active.enabled` and `server.service.standby.enabled` options to selectively disable additional services [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
+* server: Add `server.serviceAccount.serviceDiscovery.enabled` option to selectively disable a Vault service discovery role and role binding [GH-811](https://github.com/hashicorp/vault-helm/pull/811)
+* server: Add `server.service.instanceSelector.enabled` option to allow selecting pods outside the helm chart deployment [GH-813](https://github.com/hashicorp/vault-helm/pull/813)
+
+Bugs:
+* server: Quote `.server.ha.clusterAddr` value [GH-810](https://github.com/hashicorp/vault-helm/pull/810)
+
+## 0.22.1 (October 26th, 2022)
+
+Changes:
+* `vault` updated to 1.12.0 [GH-803](https://github.com/hashicorp/vault-helm/pull/803)
+* `vault-k8s` updated to 1.0.1 [GH-803](https://github.com/hashicorp/vault-helm/pull/803)
+
+## 0.22.0 (September 8th, 2022)
+
+Features:
+* Add PrometheusOperator support for collecting Vault server metrics. [GH-772](https://github.com/hashicorp/vault-helm/pull/772)
+
+Changes:
+* `vault-k8s` to 1.0.0 [GH-784](https://github.com/hashicorp/vault-helm/pull/784)
+* Test against Kubernetes 1.25 [GH-784](https://github.com/hashicorp/vault-helm/pull/784)
+* `vault` updated to 1.11.3 [GH-785](https://github.com/hashicorp/vault-helm/pull/785)
+
+## 0.21.0 (August 10th, 2022)
+
+CHANGES:
+* `vault-k8s` updated to 0.17.0. [GH-771](https://github.com/hashicorp/vault-helm/pull/771)
+* `vault-csi-provider` updated to 1.2.0 [GH-771](https://github.com/hashicorp/vault-helm/pull/771)
+* `vault` updated to 1.11.2 [GH-771](https://github.com/hashicorp/vault-helm/pull/771)
+* Start testing against Kubernetes 1.24. [GH-744](https://github.com/hashicorp/vault-helm/pull/744)
+* Deprecated `injector.externalVaultAddr`. Added `global.externalVaultAddr`, which applies to both the Injector and the CSI Provider. [GH-745](https://github.com/hashicorp/vault-helm/pull/745)
+* CSI Provider pods now set the `VAULT_ADDR` environment variable to either the internal Vault service or the configured external address. [GH-745](https://github.com/hashicorp/vault-helm/pull/745)
+
+Features:
+* server: Add `server.statefulSet.securityContext` to override pod and container `securityContext`. [GH-767](https://github.com/hashicorp/vault-helm/pull/767)
+* csi: Add `csi.daemonSet.securityContext` to override pod and container `securityContext`. [GH-767](https://github.com/hashicorp/vault-helm/pull/767)
+* injector: Add `injector.securityContext` to override pod and container `securityContext`. [GH-750](https://github.com/hashicorp/vault-helm/pull/750) and [GH-767](https://github.com/hashicorp/vault-helm/pull/767)
+* Add `server.service.activeNodePort` and `server.service.standbyNodePort` to specify the `nodePort` for active and standby services. [GH-610](https://github.com/hashicorp/vault-helm/pull/610)
+* Support for setting annotations on the injector's serviceAccount [GH-753](https://github.com/hashicorp/vault-helm/pull/753)
+
+## 0.20.1 (May 25th, 2022)
+CHANGES:
+* `vault-k8s` updated to 0.16.1 [GH-739](https://github.com/hashicorp/vault-helm/pull/739)
+
+Improvements:
+* Mutating webhook will no longer target the agent injector pod [GH-736](https://github.com/hashicorp/vault-helm/pull/736)
+
+Bugs:
+* `vault` service account is now created even if the server is set to disabled, as per before 0.20.0 [GH-737](https://github.com/hashicorp/vault-helm/pull/737)
+
+## 0.20.0 (May 16th, 2022)
+
+CHANGES:
+* `global.enabled` now works as documented, that is, setting `global.enabled` to false will disable everything, with individual components able to be turned on individually [GH-703](https://github.com/hashicorp/vault-helm/pull/703)
+* Default value of `-` used for injector and server to indicate that they follow `global.enabled`. [GH-703](https://github.com/hashicorp/vault-helm/pull/703)
+* Vault default image to 1.10.3
+* CSI provider default image to 1.1.0
+* Vault K8s default image to 0.16.0
+* Earliest Kubernetes version tested is now 1.16
+* Helm 3.6+ now required
+
+Features:
+* Support topologySpreadConstraints in server and injector. [GH-652](https://github.com/hashicorp/vault-helm/pull/652)
+
+Improvements:
+* CSI: Set `extraLabels` for daemonset, pods, and service account [GH-690](https://github.com/hashicorp/vault-helm/pull/690)
+* Add namespace to injector-leader-elector role, rolebinding and secret [GH-683](https://github.com/hashicorp/vault-helm/pull/683)
+* Support policy/v1 PodDisruptionBudget in Kubernetes 1.21+ for server and injector [GH-710](https://github.com/hashicorp/vault-helm/pull/710)
+* Make the Cluster Address (CLUSTER_ADDR) configurable [GH-629](https://github.com/hashicorp/vault-helm/pull/709)
+* server: Make `publishNotReadyAddresses` configurable for services [GH-694](https://github.com/hashicorp/vault-helm/pull/694)
+* server: Allow config to be defined as a YAML object in the values file [GH-684](https://github.com/hashicorp/vault-helm/pull/684)
+* Maintain default MutatingWebhookConfiguration values from `v1beta1` [GH-692](https://github.com/hashicorp/vault-helm/pull/692)
+
+## 0.19.0 (January 20th, 2022)
+
+CHANGES:
+* Vault image default 1.9.2
+* Vault K8s image default 0.14.2
+
+Features:
+* Added configurable podDisruptionBudget for injector [GH-653](https://github.com/hashicorp/vault-helm/pull/653)
+* Make terminationGracePeriodSeconds configurable for server [GH-659](https://github.com/hashicorp/vault-helm/pull/659)
+* Added configurable update strategy for injector [GH-661](https://github.com/hashicorp/vault-helm/pull/661)
+* csi: ability to set priorityClassName for CSI daemonset pods [GH-670](https://github.com/hashicorp/vault-helm/pull/670)
+
+Improvements:
+* Set the namespace on the OpenShift Route [GH-679](https://github.com/hashicorp/vault-helm/pull/679)
+* Add volumes and env vars to helm hook test pod [GH-673](https://github.com/hashicorp/vault-helm/pull/673)
+* Make TLS configurable for OpenShift routes [GH-686](https://github.com/hashicorp/vault-helm/pull/686)
+
+## 0.18.0 (November 17th, 2021)
+
+CHANGES:
+* Removed support for deploying a leader-elector container with the [vault-k8s injector](https://github.com/hashicorp/vault-k8s) injector since vault-k8s now uses an internal mechanism to determine leadership [GH-649](https://github.com/hashicorp/vault-helm/pull/649)
+* Vault image default 1.9.0
+* Vault K8s image default 0.14.1
+
+Improvements:
+* Added templateConfig.staticSecretRenderInterval chart option for the injector [GH-621](https://github.com/hashicorp/vault-helm/pull/621)
+
+## 0.17.1 (October 25th, 2021)
+
+Improvements:
+ * Add option for Ingress PathType [GH-634](https://github.com/hashicorp/vault-helm/pull/634)
+
+## 0.17.0 (October 21st, 2021)
+
+KNOWN ISSUES:
+* The chart will fail to deploy on Kubernetes 1.19+ with `server.ingress.enabled=true` because no `pathType` is set
+
+CHANGES:
+* Vault image default 1.8.4
+* Vault K8s image default 0.14.0
+
+Improvements:
+* Support Ingress stable networking API [GH-590](https://github.com/hashicorp/vault-helm/pull/590)
+* Support setting the `externalTrafficPolicy` for `LoadBalancer` and `NodePort` service types [GH-626](https://github.com/hashicorp/vault-helm/pull/626)
+* Support setting ingressClassName on server Ingress [GH-630](https://github.com/hashicorp/vault-helm/pull/630)
+
+Bugs:
+* Ensure `kubeletRootDir` volume path and mounts are the same when `csi.daemonSet.kubeletRootDir` is overridden [GH-628](https://github.com/hashicorp/vault-helm/pull/628)
+
+## 0.16.1 (September 29th, 2021)
+
+CHANGES:
+* Vault image default 1.8.3
+* Vault K8s image default 0.13.1
+
+## 0.16.0 (September 16th, 2021)
+
+CHANGES:
+* Support for deploying a leader-elector container with the [vault-k8s injector](https://github.com/hashicorp/vault-k8s) injector will be removed in version 0.18.0 of this chart since vault-k8s now uses an internal mechanism to determine leadership. To enable the deployment of the leader-elector container for use with vault-k8s 0.12.0 and earlier, set `useContainer=true`.
+
+Improvements:
+ * Make CSI provider `hostPaths` configurable via `csi.daemonSet.providersDir` and `csi.daemonSet.kubeletRootDir` [GH-603](https://github.com/hashicorp/vault-helm/pull/603)
+ * Support vault-k8s internal leader election [GH-568](https://github.com/hashicorp/vault-helm/pull/568) [GH-607](https://github.com/hashicorp/vault-helm/pull/607)
+
+## 0.15.0 (August 23rd, 2021)
+
+Improvements:
+* Add imagePullSecrets on server test [GH-572](https://github.com/hashicorp/vault-helm/pull/572)
+* Add injector.webhookAnnotations chart option [GH-584](https://github.com/hashicorp/vault-helm/pull/584)
+
+## 0.14.0 (July 28th, 2021)
+
+Features:
+* Added templateConfig.exitOnRetryFailure chart option for the injector [GH-560](https://github.com/hashicorp/vault-helm/pull/560)
+
+Improvements:
+* Support configuring pod tolerations, pod affinity, and node selectors as YAML [GH-565](https://github.com/hashicorp/vault-helm/pull/565)
+* Set the default vault image to come from the hashicorp organization [GH-567](https://github.com/hashicorp/vault-helm/pull/567)
+* Add support for running the acceptance tests against a local `kind` cluster [GH-567](https://github.com/hashicorp/vault-helm/pull/567)
+* Add `server.ingress.activeService` to configure if the ingress should use the active service [GH-570](https://github.com/hashicorp/vault-helm/pull/570)
+* Add `server.route.activeService` to configure if the route should use the active service [GH-570](https://github.com/hashicorp/vault-helm/pull/570)
+* Support configuring `global.imagePullSecrets` from a string array [GH-576](https://github.com/hashicorp/vault-helm/pull/576)
+
+
+## 0.13.0 (June 17th, 2021)
+
+Improvements:
+* Added a helm test for vault server [GH-531](https://github.com/hashicorp/vault-helm/pull/531)
+* Added server.enterpriseLicense option [GH-547](https://github.com/hashicorp/vault-helm/pull/547)
+* Added OpenShift overrides [GH-549](https://github.com/hashicorp/vault-helm/pull/549)
+
+Bugs:
+* Fix ui.serviceNodePort schema [GH-537](https://github.com/hashicorp/vault-helm/pull/537)
+* Fix server.ha.disruptionBudget.maxUnavailable schema [GH-535](https://github.com/hashicorp/vault-helm/pull/535)
+* Added webhook-certs volume mount to sidecar injector [GH-545](https://github.com/hashicorp/vault-helm/pull/545)
+
+## 0.12.0 (May 25th, 2021)
+
+Features:
+* Pass additional arguments to `vault-csi-provider` using `csi.extraArgs` [GH-526](https://github.com/hashicorp/vault-helm/pull/526)
+
+Improvements:
+* Set chart kubeVersion and added chart-verifier tests [GH-510](https://github.com/hashicorp/vault-helm/pull/510)
+* Added values json schema [GH-513](https://github.com/hashicorp/vault-helm/pull/513)
+* Ability to set tolerations for CSI daemonset pods [GH-521](https://github.com/hashicorp/vault-helm/pull/521)
+* UI target port is now configurable [GH-437](https://github.com/hashicorp/vault-helm/pull/437)
+
+Bugs:
+* CSI: `global.imagePullSecrets` are now also used for CSI daemonset [GH-519](https://github.com/hashicorp/vault-helm/pull/519)
+
+## 0.11.0 (April 14th, 2021)
+
+Features:
+* Added `server.enabled` to explicitly skip installing a Vault server [GH-486](https://github.com/hashicorp/vault-helm/pull/486)
+* Injector now supports enabling host network [GH-471](https://github.com/hashicorp/vault-helm/pull/471)
+* Injector port is now configurable [GH-489](https://github.com/hashicorp/vault-helm/pull/489)
+* Injector Vault Agent resource defaults are now configurable [GH-493](https://github.com/hashicorp/vault-helm/pull/493)
+* Extra paths can now be added to the Vault ingress service [GH-460](https://github.com/hashicorp/vault-helm/pull/460)
+* Log level and format can now be set directly using `server.logFormat` and `server.logLevel` [GH-488](https://github.com/hashicorp/vault-helm/pull/488)
+
+Improvements:
+* Added `https` name to injector service port [GH-495](https://github.com/hashicorp/vault-helm/pull/495)
+
+Bugs:
+* CSI: Fix ClusterRole name and DaemonSet's service account to properly match deployment name [GH-486](https://github.com/hashicorp/vault-helm/pull/486)
+
+## 0.10.0 (March 25th, 2021)
+
+Features:
+* Add support for [Vault CSI provider](https://github.com/hashicorp/vault-csi-provider) [GH-461](https://github.com/hashicorp/vault-helm/pull/461)
+
+Improvements:
+* `objectSelector` can now be set on the mutating admission webhook [GH-456](https://github.com/hashicorp/vault-helm/pull/456)
+
+## 0.9.1 (February 2nd, 2021)
+
+Bugs:
+* Injector: fix labels for default anti-affinity rule [GH-441](https://github.com/hashicorp/vault-helm/pull/441), [GH-442](https://github.com/hashicorp/vault-helm/pull/442)
+* Set VAULT_DEV_LISTEN_ADDRESS in dev mode [GH-446](https://github.com/hashicorp/vault-helm/pull/446)
+
+## 0.9.0 (January 5th, 2021)
+
+Features:
+* Injector now supports configurable number of replicas [GH-436](https://github.com/hashicorp/vault-helm/pull/436)
+* Injector now supports auto TLS for multiple replicas using leader elections [GH-436](https://github.com/hashicorp/vault-helm/pull/436)
+
+Improvements:
+* Dev mode now supports `server.extraArgs` [GH-421](https://github.com/hashicorp/vault-helm/pull/421)
+* Dev mode root token is now configurable with `server.dev.devRootToken` [GH-415](https://github.com/hashicorp/vault-helm/pull/415)
+* ClusterRoleBinding updated to `v1` [GH-395](https://github.com/hashicorp/vault-helm/pull/395)
+* MutatingWebhook updated to `v1` [GH-408](https://github.com/hashicorp/vault-helm/pull/408)
+* Injector service now supports `injector.service.annotations` [425](https://github.com/hashicorp/vault-helm/pull/425)
+* Injector now supports `injector.extraLabels` [428](https://github.com/hashicorp/vault-helm/pull/428)
+* Added `allowPrivilegeEscalation: false` to Vault and Injector containers [429](https://github.com/hashicorp/vault-helm/pull/429)
+* Network Policy now supports `server.networkPolicy.egress` [389](https://github.com/hashicorp/vault-helm/pull/389)
+
+## 0.8.0 (October 20th, 2020)
+
+Improvements:
+* Make server NetworkPolicy independent of OpenShift [GH-381](https://github.com/hashicorp/vault-helm/pull/381)
+* Added configurables for all probe values [GH-387](https://github.com/hashicorp/vault-helm/pull/387)
+* MountPath for audit and data storage is now configurable [GH-393](https://github.com/hashicorp/vault-helm/pull/393)
+* Annotations can now be added to the Injector pods [GH-394](https://github.com/hashicorp/vault-helm/pull/394)
+* The injector can now be configured with a failurePolicy [GH-400](https://github.com/hashicorp/vault-helm/pull/400)
+* Added additional environment variables for rendering within Vault config [GH-398](https://github.com/hashicorp/vault-helm/pull/398)
+* Service account for Vault K8s auth is automatically created when `injector.externalVaultAddr` is set [GH-392](https://github.com/hashicorp/vault-helm/pull/392)
+
+Bugs:
+* Fixed install output using Helm V2 command [GH-378](https://github.com/hashicorp/vault-helm/pull/378)
+
+## 0.7.0 (August 24th, 2020)
+
+Features:
+* Added `volumes` and `volumeMounts` for mounting _any_ type of volume [GH-314](https://github.com/hashicorp/vault-helm/pull/314).
+* Added configurable to enable prometheus telemetery exporter for Vault Agent Injector [GH-372](https://github.com/hashicorp/vault-helm/pull/372)
+
+Improvements:
+* Added `defaultMode` configurable to `extraVolumes`[GH-321](https://github.com/hashicorp/vault-helm/pull/321)
+* Option to install and use PodSecurityPolicy's for vault server and injector [GH-177](https://github.com/hashicorp/vault-helm/pull/177)
+* `VAULT_API_ADDR` is now configurable [GH-290](https://github.com/hashicorp/vault-helm/pull/290)
+* Removed deprecated tolerate unready endpoint annotations [GH-363](https://github.com/hashicorp/vault-helm/pull/363)
+* Add an option to set annotations on the StatefulSet [GH-199](https://github.com/hashicorp/vault-helm/pull/199)
+* Make the vault server serviceAccount name a configuration option [GH-367](https://github.com/hashicorp/vault-helm/pull/367)
+* Removed annotation striction from `dev` mode [GH-371](https://github.com/hashicorp/vault-helm/pull/371)
+* Add an option to set annotations on PVCs [GH-364](https://github.com/hashicorp/vault-helm/pull/364)
+* Added service configurables for UI [GH-285](https://github.com/hashicorp/vault-helm/pull/285)
+
+Bugs:
+* Fix python dependency in test image [GH-337](https://github.com/hashicorp/vault-helm/pull/337)
+* Fix caBundle not being quoted causing validation issues with Helm 3 [GH-352](https://github.com/hashicorp/vault-helm/pull/352)
+* Fix injector network policy being rendered when injector is not enabled [GH-358](https://github.com/hashicorp/vault-helm/pull/358)
+
+## 0.6.0 (June 3rd, 2020)
+
+Features:
+* Added `extraInitContainers` to define init containers for the Vault cluster [GH-258](https://github.com/hashicorp/vault-helm/pull/258)
+* Added `postStart` lifecycle hook allowing users to configure commands to run on the Vault pods after they're ready [GH-315](https://github.com/hashicorp/vault-helm/pull/315)
+* Beta: Added OpenShift support [GH-319](https://github.com/hashicorp/vault-helm/pull/319)
+
+Improvements:
+* Server configs can now be defined in YAML. Multi-line string configs are still compatible [GH-213](https://github.com/hashicorp/vault-helm/pull/213)
+* Removed IPC_LOCK privileges since swap is disabled on containers [[GH-198](https://github.com/hashicorp/vault-helm/pull/198)]
+* Use port names that map to vault.scheme [[GH-223](https://github.com/hashicorp/vault-helm/pull/223)]
+* Allow both yaml and multi-line string annotations [[GH-272](https://github.com/hashicorp/vault-helm/pull/272)]
+* Added configurable to set the Raft node name to hostname [[GH-269](https://github.com/hashicorp/vault-helm/pull/269)]
+* Support setting priorityClassName on pods [[GH-282](https://github.com/hashicorp/vault-helm/pull/282)]
+* Added support for ingress apiVersion `networking.k8s.io/v1beta1` [[GH-310](https://github.com/hashicorp/vault-helm/pull/310)]
+* Added configurable to change service type for the HA active service [GH-317](https://github.com/hashicorp/vault-helm/pull/317)
+
+Bugs:
+* Fixed default ingress path [[GH-224](https://github.com/hashicorp/vault-helm/pull/224)]
+* Fixed annotations for HA standby/active services [[GH-268](https://github.com/hashicorp/vault-helm/pull/268)]
+* Updated some value defaults to match their use in templates [[GH-309](https://github.com/hashicorp/vault-helm/pull/309)]
+* Use active service on ingress when ha [[GH-270](https://github.com/hashicorp/vault-helm/pull/270)]
+* Fixed bug where pull secrets weren't being used for injector image [GH-298](https://github.com/hashicorp/vault-helm/pull/298)
+
+## 0.5.0 (April 9th, 2020)
+
+Features:
+
+* Added Raft support for HA mode [[GH-228](https://github.com/hashicorp/vault-helm/pull/229)]
+* Now supports Vault Enterprise [[GH-250](https://github.com/hashicorp/vault-helm/pull/250)]
+* Added K8s Service Registration for HA modes [[GH-250](https://github.com/hashicorp/vault-helm/pull/250)]
+
+* Option to set `AGENT_INJECT_VAULT_AUTH_PATH` for the injector [[GH-185](https://github.com/hashicorp/vault-helm/pull/185)]
+* Added environment variables for logging and revocation on Vault Agent Injector [[GH-219](https://github.com/hashicorp/vault-helm/pull/219)]
+* Option to set environment variables for the injector deployment [[GH-232](https://github.com/hashicorp/vault-helm/pull/232)]
+* Added affinity, tolerations, and nodeSelector options for the injector deployment [[GH-234](https://github.com/hashicorp/vault-helm/pull/234)]
+* Made all annotations multi-line strings [[GH-227](https://github.com/hashicorp/vault-helm/pull/227)]
+
+## 0.4.0 (February 21st, 2020)
+
+Improvements:
+
+* Allow process namespace sharing between Vault and sidecar containers [[GH-174](https://github.com/hashicorp/vault-helm/pull/174)]
+* Added configurable to change updateStrategy [[GH-172](https://github.com/hashicorp/vault-helm/pull/172)]
+* Added sleep in the preStop lifecycle step [[GH-188](https://github.com/hashicorp/vault-helm/pull/188)]
+* Updated chart and tests to Helm 3 [[GH-195](https://github.com/hashicorp/vault-helm/pull/195)]
+* Adds Values.injector.externalVaultAddr to use the injector with an external vault [[GH-207](https://github.com/hashicorp/vault-helm/pull/207)]
+
+Bugs:
+
+* Fix bug where Vault lifecycle was appended after extra containers. [[GH-179](https://github.com/hashicorp/vault-helm/pull/179)]
+
+## 0.3.3 (January 14th, 2020)
+
+Security:
+
+* Added `server.extraArgs` to allow loading of additional Vault configurations containing sensitive settings [GH-175](https://github.com/hashicorp/vault-helm/issues/175)
+
+Bugs:
+
+* Fixed injection bug where wrong environment variables were being used for manually mounted TLS files
+
+## 0.3.2 (January 8th, 2020)
+
+Bugs:
+
+* Fixed injection bug where TLS Skip Verify was true by default [VK8S-35]
+
+## 0.3.1 (January 2nd, 2020)
+
+Bugs:
+
+* Fixed injection bug causing kube-system pods to be rejected [VK8S-14]
+
+## 0.3.0 (December 19th, 2019)
+
+Features:
+
+* Extra containers can now be added to the Vault pods
+* Added configurability of pod probes
+* Added Vault Agent Injector
+
+Improvements:
+
+* Moved `global.image` to `server.image`
+* Changed UI service template to route pods that aren't ready via `publishNotReadyAddresses: true`
+* Added better HTTP/HTTPS scheme support to http probes
+* Added configurable node port for Vault service
+* `server.authDelegator` is now enabled by default
+
+Bugs:
+
+* Fixed upgrade bug by removing chart label which contained the version
+* Fixed typo on `serviceAccount` (was `serviceaccount`)
+* Fixed readiness/liveliness HTTP probe default to accept standbys
+
+## 0.2.1 (November 12th, 2019)
+
+Bugs:
+
+* Removed `readOnlyRootFilesystem` causing issues when validating deployments
+
+## 0.2.0 (October 29th, 2019)
+
+Features:
+
+* Added load balancer support
+* Added ingress support
+* Added configurable for service types (ClusterIP, NodePort, LoadBalancer, etc)
+* Removed root requirements, now runs as Vault user
+
+Improvements:
+
+* Added namespace value to all rendered objects
+* Made ports configurable in services
+* Added the ability to add custom annotations to services
+* Added docker image for running bats test in CircleCI
+* Removed restrictions around `dev` mode such as annotations
+* `readOnlyRootFilesystem` is now configurable
+* Image Pull Policy is now configurable
+
+Bugs:
+
+* Fixed selector bugs related to Helm label updates (services, affinities, and pod disruption)
+* Fixed bug where audit storage was not being mounted in HA mode
+* Fixed bug where Vault pod wasn't receiving SIGTERM signals
+
+
+## 0.1.2 (August 22nd, 2019)
+
+Features:
+
+* Added `extraSecretEnvironmentVars` to allow users to mount secrets as
+ environment variables
+* Added `tlsDisable` configurable to change HTTP protocols from HTTP/HTTPS
+ depending on the value
+* Added `serviceNodePort` to configure a NodePort value when setting `serviceType`
+ to "NodePort"
+
+Improvements:
+
+* Changed UI port to 8200 for better HTTP protocol support
+* Added `path` to `extraVolumes` to define where the volume should be
+ mounted. Defaults to `/vault/userconfig`
+* Upgraded Vault to 1.2.2
+
+Bugs:
+
+* Fixed bug where upgrade would fail because immutable labels were being
+ changed (Helm Version label)
+* Fixed bug where UI service used wrong selector after updating helm labels
+* Added `VAULT_API_ADDR` env to Vault pod to fixed bug where Vault thinks
+ Consul is the active node
+* Removed `step-down` preStop since it requires authentication. Shutdown signal
+ sent by Kube acts similar to `step-down`
+
+
+## 0.1.1 (August 7th, 2019)
+
+Features:
+
+* Added `authDelegator` Cluster Role Binding to Vault service account for
+ bootstrapping Kube auth method
+
+Improvements:
+
+* Added `server.service.clusterIP` to `values.yml` so users can toggle
+ the Vault service to headless by using the value `None`.
+* Upgraded Vault to 1.2.1
+
+## 0.1.0 (August 6th, 2019)
+
+Initial release
diff --git a/charts/vault/CODEOWNERS b/charts/vault/CODEOWNERS
new file mode 100644
index 0000000..a765f7e
--- /dev/null
+++ b/charts/vault/CODEOWNERS
@@ -0,0 +1 @@
+* @hashicorp/vault-ecosystem
diff --git a/charts/vault/CONTRIBUTING.md b/charts/vault/CONTRIBUTING.md
new file mode 100644
index 0000000..ad31ac9
--- /dev/null
+++ b/charts/vault/CONTRIBUTING.md
@@ -0,0 +1,247 @@
+# Contributing to Vault Helm
+
+**Please note:** We take Vault's security and our users' trust very seriously.
+If you believe you have found a security issue in Vault, please responsibly
+disclose by contacting us at security@hashicorp.com.
+
+**First:** if you're unsure or afraid of _anything_, just ask or submit the
+issue or pull request anyways. You won't be yelled at for giving it your best
+effort. The worst that can happen is that you'll be politely asked to change
+something. We appreciate any sort of contributions, and don't want a wall of
+rules to get in the way of that.
+
+That said, if you want to ensure that a pull request is likely to be merged,
+talk to us! You can find out our thoughts and ensure that your contribution
+won't clash or be obviated by Vault's normal direction. A great way to do this
+is via the [Vault Discussion Forum][1].
+
+This document will cover what we're looking for in terms of reporting issues.
+By addressing all the points we're looking for, it raises the chances we can
+quickly merge or address your contributions.
+
+[1]: https://discuss.hashicorp.com/c/vault
+
+## Issues
+
+### Reporting an Issue
+
+* Make sure you test against the latest released version. It is possible
+ we already fixed the bug you're experiencing. Even better is if you can test
+ against `main`, as bugs are fixed regularly but new versions are only
+ released every few months.
+
+* Provide steps to reproduce the issue, and if possible include the expected
+ results as well as the actual results. Please provide text, not screen shots!
+
+* Respond as promptly as possible to any questions made by the Vault
+ team to your issue. Stale issues will be closed periodically.
+
+### Issue Lifecycle
+
+1. The issue is reported.
+
+2. The issue is verified and categorized by a Vault Helm collaborator.
+ Categorization is done via tags. For example, bugs are marked as "bugs".
+
+3. Unless it is critical, the issue may be left for a period of time (sometimes
+ many weeks), giving outside contributors -- maybe you!? -- a chance to
+ address the issue.
+
+4. The issue is addressed in a pull request or commit. The issue will be
+ referenced in the commit message so that the code that fixes it is clearly
+ linked.
+
+5. The issue is closed. Sometimes, valid issues will be closed to keep
+ the issue tracker clean. The issue is still indexed and available for
+ future viewers, or can be re-opened if necessary.
+
+## Testing
+
+The Helm chart ships with both unit and acceptance tests.
+
+The unit tests don't require any active Kubernetes cluster and complete
+very quickly. These should be used for fast feedback during development.
+The acceptance tests require a Kubernetes cluster with a configured `kubectl`.
+
+### Test Using Docker Container
+
+The following are the instructions for running bats tests using a Docker container.
+
+#### Prerequisites
+
+* Docker installed
+* `vault-helm` checked out locally
+
+#### Test
+
+**Note:** the following commands should be run from the `vault-helm` directory.
+
+First, build the Docker image for running the tests:
+
+```shell
+docker build -f ${PWD}/test/docker/Test.dockerfile ${PWD}/test/docker/ -t vault-helm-test
+```
+Next, execute the tests with the following commands:
+```shell
+docker run -it --rm -v "${PWD}:/test" vault-helm-test bats /test/test/unit
+```
+It's possible to only run specific bats tests using regular expressions.
+For example, the following will run only tests with "injector" in the name:
+```shell
+docker run -it --rm -v "${PWD}:/test" vault-helm-test bats /test/test/unit -f "injector"
+```
+
+### Test Manually
+The following are the instructions for running bats tests on your workstation.
+#### Prerequisites
+* [Bats](https://github.com/bats-core/bats-core)
+ ```bash
+ brew install bats-core
+ ```
+* [yq](https://pypi.org/project/yq/)
+ ```bash
+ brew install python-yq
+ ```
+* [helm](https://helm.sh)
+ ```bash
+ brew install kubernetes-helm
+ ```
+
+#### Test
+
+To run the unit tests:
+
+ bats ./test/unit
+
+To run the acceptance tests:
+
+ bats ./test/acceptance
+
+If the acceptance tests fail, deployed resources in the Kubernetes cluster
+may not be properly cleaned up. We recommend recycling the Kubernetes cluster to
+start from a clean slate.
+
+**Note:** There is a Terraform configuration in the
+[`test/terraform/`](https://github.com/hashicorp/vault-helm/tree/main/test/terraform) directory
+that can be used to quickly bring up a GKE cluster and configure
+`kubectl` and `helm` locally. This can be used to quickly spin up a test
+cluster for acceptance tests. Unit tests _do not_ require a running Kubernetes
+cluster.
+
+### Writing Unit Tests
+
+Changes to the Helm chart should be accompanied by appropriate unit tests.
+
+#### Formatting
+
+- Put tests in the test file in the same order as the variables appear in the `values.yaml`.
+- Start tests for a chart value with a header that says what is being tested, like this:
+ ```
+ #--------------------------------------------------------------------
+ # annotations
+ ```
+
+- Name the test based on what it's testing in the following format (this will be its first line):
+ ```
+ @test ": " {
+ ```
+
+ When adding tests to an existing file, the first section will be the same as the other tests in the file.
+
+#### Test Details
+
+[Bats](https://github.com/bats-core/bats-core) provides a way to run commands in a shell and inspect the output in an automated way.
+In all of the tests in this repo, the base command being run is [helm template](https://docs.helm.sh/helm/#helm-template) which turns the templated files into straight yaml output.
+In this way, we're able to test that the various conditionals in the templates render as we would expect.
+
+Each test defines the files that should be rendered using the `--show-only` flag, then it might adjust chart values by adding `--set` flags as well.
+The output from this `helm template` command is then piped to [yq](https://pypi.org/project/yq/).
+`yq` allows us to pull out just the information we're interested in, either by referencing its position in the yaml file directly or giving information about it (like its length).
+The `-r` flag can be used with `yq` to return a raw string instead of a quoted one which is especially useful when looking for an exact match.
+
+The test passes or fails based on the conditional at the end that is in square brackets, which is a comparison of our expected value and the output of `helm template` piped to `yq`.
+
+The `| tee /dev/stderr ` pieces direct any terminal output of the `helm template` and `yq` commands to stderr so that it doesn't interfere with `bats`.
+
+#### Test Examples
+
+Here are some examples of common test patterns:
+
+- Check that a value is disabled by default
+
+ ```
+ @test "ui/Service: no type by default" {
+ cd `chart_dir`
+ local actual=$(helm template \
+ --show-only templates/ui-service.yaml \
+ . | tee /dev/stderr |
+ yq -r '.spec.type' | tee /dev/stderr)
+ [ "${actual}" = "null" ]
+ }
+ ```
+
+ In this example, nothing is changed from the default templates (no `--set` flags), then we use `yq` to retrieve the value we're checking, `.spec.type`.
+ This output is then compared against our expected value (`null` in this case) in the assertion `[ "${actual}" = "null" ]`.
+
+
+- Check that a template value is rendered to a specific value
+ ```
+ @test "ui/Service: specified type" {
+ cd `chart_dir`
+ local actual=$(helm template \
+ --show-only templates/ui-service.yaml \
+ --set 'ui.serviceType=LoadBalancer' \
+ . | tee /dev/stderr |
+ yq -r '.spec.type' | tee /dev/stderr)
+ [ "${actual}" = "LoadBalancer" ]
+ }
+ ```
+
+ This is very similar to the last example, except we've changed a default value with the `--set` flag and correspondingly changed the expected value.
+
+- Check that a template value contains several values
+ ```
+ @test "server/standalone-StatefulSet: custom resources" {
+ cd `chart_dir`
+ local actual=$(helm template \
+ --show-only templates/server-statefulset.yaml \
+ --set 'server.standalone.enabled=true' \
+ --set 'server.resources.requests.memory=256Mi' \
+ --set 'server.resources.requests.cpu=250m' \
+ . | tee /dev/stderr |
+ yq -r '.spec.template.spec.containers[0].resources.requests.memory' | tee /dev/stderr)
+ [ "${actual}" = "256Mi" ]
+
+ local actual=$(helm template \
+ --show-only templates/server-statefulset.yaml \
+ --set 'server.standalone.enabled=true' \
+ --set 'server.resources.limits.memory=256Mi' \
+ --set 'server.resources.limits.cpu=250m' \
+ . | tee /dev/stderr |
+ yq -r '.spec.template.spec.containers[0].resources.limits.memory' | tee /dev/stderr)
+ [ "${actual}" = "256Mi" ]
+ ```
+
+ *Note:* If testing more than two conditions, it would be good to separate the `helm template` part of the command from the `yq` sections to reduce redundant work.
+
+- Check that an entire template file is not rendered
+ ```
+ @test "syncCatalog/Deployment: disabled by default" {
+ cd `chart_dir`
+ local actual=$( (helm template \
+ --show-only templates/server-statefulset.yaml \
+ --set 'global.enabled=false' \
+ . || echo "---") | tee /dev/stderr |
+ yq 'length > 0' | tee /dev/stderr)
+ [ "${actual}" = "false" ]
+ }
+ ```
+ Here we are check the length of the command output to see if the anything is rendered.
+ This style can easily be switched to check that a file is rendered instead.
+
+## Contributor License Agreement
+
+We require that all contributors sign our Contributor License Agreement ("CLA")
+before we can accept the contribution.
+
+[Learn more about why HashiCorp requires a CLA and what the CLA includes](https://www.hashicorp.com/cla)
diff --git a/charts/vault/Chart.yaml b/charts/vault/Chart.yaml
new file mode 100644
index 0000000..8332de0
--- /dev/null
+++ b/charts/vault/Chart.yaml
@@ -0,0 +1,23 @@
+annotations:
+ charts.openshift.io/name: HashiCorp Vault
+apiVersion: v2
+appVersion: 1.19.0
+description: Official HashiCorp Vault Chart
+home: https://www.vaultproject.io
+icon: https://github.com/hashicorp/vault/raw/f22d202cde2018f9455dec755118a9b84586e082/Vault_PrimaryLogo_Black.png
+keywords:
+- vault
+- security
+- encryption
+- secrets
+- management
+- automation
+- infrastructure
+kubeVersion: '>= 1.20.0-0'
+name: vault
+sources:
+- https://github.com/hashicorp/vault
+- https://github.com/hashicorp/vault-helm
+- https://github.com/hashicorp/vault-k8s
+- https://github.com/hashicorp/vault-csi-provider
+version: 0.30.0
diff --git a/charts/vault/LICENSE b/charts/vault/LICENSE
new file mode 100644
index 0000000..74f38c0
--- /dev/null
+++ b/charts/vault/LICENSE
@@ -0,0 +1,355 @@
+Copyright (c) 2018 HashiCorp, Inc.
+
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. “Contributor”
+
+ means each individual or legal entity that creates, contributes to the
+ creation of, or owns Covered Software.
+
+1.2. “Contributor Version”
+
+ means the combination of the Contributions of others (if any) used by a
+ Contributor and that particular Contributor’s Contribution.
+
+1.3. “Contribution”
+
+ means Covered Software of a particular Contributor.
+
+1.4. “Covered Software”
+
+ means Source Code Form to which the initial Contributor has attached the
+ notice in Exhibit A, the Executable Form of such Source Code Form, and
+ Modifications of such Source Code Form, in each case including portions
+ thereof.
+
+1.5. “Incompatible With Secondary Licenses”
+ means
+
+ a. that the initial Contributor has attached the notice described in
+ Exhibit B to the Covered Software; or
+
+ b. that the Covered Software was made available under the terms of version
+ 1.1 or earlier of the License, but not also under the terms of a
+ Secondary License.
+
+1.6. “Executable Form”
+
+ means any form of the work other than Source Code Form.
+
+1.7. “Larger Work”
+
+ means a work that combines Covered Software with other material, in a separate
+ file or files, that is not Covered Software.
+
+1.8. “License”
+
+ means this document.
+
+1.9. “Licensable”
+
+ means having the right to grant, to the maximum extent possible, whether at the
+ time of the initial grant or subsequently, any and all of the rights conveyed by
+ this License.
+
+1.10. “Modifications”
+
+ means any of the following:
+
+ a. any file in Source Code Form that results from an addition to, deletion
+ from, or modification of the contents of Covered Software; or
+
+ b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. “Patent Claims” of a Contributor
+
+ means any patent claim(s), including without limitation, method, process,
+ and apparatus claims, in any patent Licensable by such Contributor that
+ would be infringed, but for the grant of the License, by the making,
+ using, selling, offering for sale, having made, import, or transfer of
+ either its Contributions or its Contributor Version.
+
+1.12. “Secondary License”
+
+ means either the GNU General Public License, Version 2.0, the GNU Lesser
+ General Public License, Version 2.1, the GNU Affero General Public
+ License, Version 3.0, or any later versions of those licenses.
+
+1.13. “Source Code Form”
+
+ means the form of the work preferred for making modifications.
+
+1.14. “You” (or “Your”)
+
+ means an individual or a legal entity exercising rights under this
+ License. For legal entities, “You” includes any entity that controls, is
+ controlled by, or is under common control with You. For purposes of this
+ definition, “control” means (a) the power, direct or indirect, to cause
+ the direction or management of such entity, whether by contract or
+ otherwise, or (b) ownership of more than fifty percent (50%) of the
+ outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+ Each Contributor hereby grants You a world-wide, royalty-free,
+ non-exclusive license:
+
+ a. under intellectual property rights (other than patent or trademark)
+ Licensable by such Contributor to use, reproduce, make available,
+ modify, display, perform, distribute, and otherwise exploit its
+ Contributions, either on an unmodified basis, with Modifications, or as
+ part of a Larger Work; and
+
+ b. under Patent Claims of such Contributor to make, use, sell, offer for
+ sale, have made, import, and otherwise transfer either its Contributions
+ or its Contributor Version.
+
+2.2. Effective Date
+
+ The licenses granted in Section 2.1 with respect to any Contribution become
+ effective for each Contribution on the date the Contributor first distributes
+ such Contribution.
+
+2.3. Limitations on Grant Scope
+
+ The licenses granted in this Section 2 are the only rights granted under this
+ License. No additional rights or licenses will be implied from the distribution
+ or licensing of Covered Software under this License. Notwithstanding Section
+ 2.1(b) above, no patent license is granted by a Contributor:
+
+ a. for any code that a Contributor has removed from Covered Software; or
+
+ b. for infringements caused by: (i) Your and any other third party’s
+ modifications of Covered Software, or (ii) the combination of its
+ Contributions with other software (except as part of its Contributor
+ Version); or
+
+ c. under Patent Claims infringed by Covered Software in the absence of its
+ Contributions.
+
+ This License does not grant any rights in the trademarks, service marks, or
+ logos of any Contributor (except as may be necessary to comply with the
+ notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+ No Contributor makes additional grants as a result of Your choice to
+ distribute the Covered Software under a subsequent version of this License
+ (see Section 10.2) or under the terms of a Secondary License (if permitted
+ under the terms of Section 3.3).
+
+2.5. Representation
+
+ Each Contributor represents that the Contributor believes its Contributions
+ are its original creation(s) or it has sufficient rights to grant the
+ rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+ This License is not intended to limit any rights You have under applicable
+ copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+
+ Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+ Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+ All distribution of Covered Software in Source Code Form, including any
+ Modifications that You create or to which You contribute, must be under the
+ terms of this License. You must inform recipients that the Source Code Form
+ of the Covered Software is governed by the terms of this License, and how
+ they can obtain a copy of this License. You may not attempt to alter or
+ restrict the recipients’ rights in the Source Code Form.
+
+3.2. Distribution of Executable Form
+
+ If You distribute Covered Software in Executable Form then:
+
+ a. such Covered Software must also be made available in Source Code Form,
+ as described in Section 3.1, and You must inform recipients of the
+ Executable Form how they can obtain a copy of such Source Code Form by
+ reasonable means in a timely manner, at a charge no more than the cost
+ of distribution to the recipient; and
+
+ b. You may distribute such Executable Form under the terms of this License,
+ or sublicense it under different terms, provided that the license for
+ the Executable Form does not attempt to limit or alter the recipients’
+ rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+ You may create and distribute a Larger Work under terms of Your choice,
+ provided that You also comply with the requirements of this License for the
+ Covered Software. If the Larger Work is a combination of Covered Software
+ with a work governed by one or more Secondary Licenses, and the Covered
+ Software is not Incompatible With Secondary Licenses, this License permits
+ You to additionally distribute such Covered Software under the terms of
+ such Secondary License(s), so that the recipient of the Larger Work may, at
+ their option, further distribute the Covered Software under the terms of
+ either this License or such Secondary License(s).
+
+3.4. Notices
+
+ You may not remove or alter the substance of any license notices (including
+ copyright notices, patent notices, disclaimers of warranty, or limitations
+ of liability) contained within the Source Code Form of the Covered
+ Software, except that You may alter any license notices to the extent
+ required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+ You may choose to offer, and to charge a fee for, warranty, support,
+ indemnity or liability obligations to one or more recipients of Covered
+ Software. However, You may do so only on Your own behalf, and not on behalf
+ of any Contributor. You must make it absolutely clear that any such
+ warranty, support, indemnity, or liability obligation is offered by You
+ alone, and You hereby agree to indemnify every Contributor for any
+ liability incurred by such Contributor as a result of warranty, support,
+ indemnity or liability terms You offer. You may include additional
+ disclaimers of warranty and limitations of liability specific to any
+ jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+ If it is impossible for You to comply with any of the terms of this License
+ with respect to some or all of the Covered Software due to statute, judicial
+ order, or regulation then You must: (a) comply with the terms of this License
+ to the maximum extent possible; and (b) describe the limitations and the code
+ they affect. Such description must be placed in a text file included with all
+ distributions of the Covered Software under this License. Except to the
+ extent prohibited by statute or regulation, such description must be
+ sufficiently detailed for a recipient of ordinary skill to be able to
+ understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+ fail to comply with any of its terms. However, if You become compliant,
+ then the rights granted under this License from a particular Contributor
+ are reinstated (a) provisionally, unless and until such Contributor
+ explicitly and finally terminates Your grants, and (b) on an ongoing basis,
+ if such Contributor fails to notify You of the non-compliance by some
+ reasonable means prior to 60 days after You have come back into compliance.
+ Moreover, Your grants from a particular Contributor are reinstated on an
+ ongoing basis if such Contributor notifies You of the non-compliance by
+ some reasonable means, this is the first time You have received notice of
+ non-compliance with this License from such Contributor, and You become
+ compliant prior to 30 days after Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+ infringement claim (excluding declaratory judgment actions, counter-claims,
+ and cross-claims) alleging that a Contributor Version directly or
+ indirectly infringes any patent, then the rights granted to You by any and
+ all Contributors for the Covered Software under Section 2.1 of this License
+ shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+ license agreements (excluding distributors and resellers) which have been
+ validly granted by You or Your distributors under this License prior to
+ termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+ Covered Software is provided under this License on an “as is” basis, without
+ warranty of any kind, either expressed, implied, or statutory, including,
+ without limitation, warranties that the Covered Software is free of defects,
+ merchantable, fit for a particular purpose or non-infringing. The entire
+ risk as to the quality and performance of the Covered Software is with You.
+ Should any Covered Software prove defective in any respect, You (not any
+ Contributor) assume the cost of any necessary servicing, repair, or
+ correction. This disclaimer of warranty constitutes an essential part of this
+ License. No use of any Covered Software is authorized under this License
+ except under this disclaimer.
+
+7. Limitation of Liability
+
+ Under no circumstances and under no legal theory, whether tort (including
+ negligence), contract, or otherwise, shall any Contributor, or anyone who
+ distributes Covered Software as permitted above, be liable to You for any
+ direct, indirect, special, incidental, or consequential damages of any
+ character including, without limitation, damages for lost profits, loss of
+ goodwill, work stoppage, computer failure or malfunction, or any and all
+ other commercial damages or losses, even if such party shall have been
+ informed of the possibility of such damages. This limitation of liability
+ shall not apply to liability for death or personal injury resulting from such
+ party’s negligence to the extent applicable law prohibits such limitation.
+ Some jurisdictions do not allow the exclusion or limitation of incidental or
+ consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+
+ Any litigation relating to this License may be brought only in the courts of
+ a jurisdiction where the defendant maintains its principal place of business
+ and such litigation shall be governed by laws of that jurisdiction, without
+ reference to its conflict-of-law provisions. Nothing in this Section shall
+ prevent a party’s ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+
+ This License represents the complete agreement concerning the subject matter
+ hereof. If any provision of this License is held to be unenforceable, such
+ provision shall be reformed only to the extent necessary to make it
+ enforceable. Any law or regulation which provides that the language of a
+ contract shall be construed against the drafter shall not be used to construe
+ this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+ Mozilla Foundation is the license steward. Except as provided in Section
+ 10.3, no one other than the license steward has the right to modify or
+ publish new versions of this License. Each version will be given a
+ distinguishing version number.
+
+10.2. Effect of New Versions
+
+ You may distribute the Covered Software under the terms of the version of
+ the License under which You originally received the Covered Software, or
+ under the terms of any subsequent version published by the license
+ steward.
+
+10.3. Modified Versions
+
+ If you create software not governed by this License, and you want to
+ create a new license for such software, you may create and use a modified
+ version of this License if you rename the license and remove any
+ references to the name of the license steward (except to note that such
+ modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+ If You choose to distribute Source Code Form that is Incompatible With
+ Secondary Licenses under the terms of this version of the License, the
+ notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+ This Source Code Form is subject to the
+ terms of the Mozilla Public License, v.
+ 2.0. If a copy of the MPL was not
+ distributed with this file, You can
+ obtain one at
+ http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then
+You may include the notice in a location (such as a LICENSE file in a relevant
+directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - “Incompatible With Secondary Licenses” Notice
+
+ This Source Code Form is “Incompatible
+ With Secondary Licenses”, as defined by
+ the Mozilla Public License, v. 2.0.
diff --git a/charts/vault/Makefile b/charts/vault/Makefile
new file mode 100644
index 0000000..97bf7bf
--- /dev/null
+++ b/charts/vault/Makefile
@@ -0,0 +1,101 @@
+TEST_IMAGE?=vault-helm-test
+GOOGLE_CREDENTIALS?=vault-helm-test.json
+CLOUDSDK_CORE_PROJECT?=vault-helm-dev-246514
+# set to run a single test - e.g acceptance/server-ha-enterprise-dr.bats
+ACCEPTANCE_TESTS?=acceptance
+
+# filter bats unit tests to run.
+UNIT_TESTS_FILTER?='.*'
+
+# set to 'true' to run acceptance tests locally in a kind cluster
+LOCAL_ACCEPTANCE_TESTS?=false
+
+# kind cluster name
+KIND_CLUSTER_NAME?=vault-helm
+
+# kind k8s version
+KIND_K8S_VERSION?=v1.32.3
+
+# Generate json schema for chart values. See test/README.md for more details.
+values-schema:
+ helm schema-gen values.yaml > values.schema.json
+
+test-image:
+ @docker build --rm -t $(TEST_IMAGE) -f $(CURDIR)/test/docker/Test.dockerfile $(CURDIR)
+
+test-unit:
+ @docker run --rm -it -v ${PWD}:/helm-test $(TEST_IMAGE) bats -f $(UNIT_TESTS_FILTER) /helm-test/test/unit
+
+test-bats: test-unit test-acceptance
+
+test: test-image test-bats
+
+# run acceptance tests on GKE
+# set google project/credential vars above
+test-acceptance:
+ifeq ($(LOCAL_ACCEPTANCE_TESTS),true)
+ make setup-kind acceptance
+else
+ @docker run -it -v ${PWD}:/helm-test \
+ -e GOOGLE_CREDENTIALS=${GOOGLE_CREDENTIALS} \
+ -e CLOUDSDK_CORE_PROJECT=${CLOUDSDK_CORE_PROJECT} \
+ -e KUBECONFIG=/helm-test/.kube/config \
+ -e VAULT_LICENSE_CI=${VAULT_LICENSE_CI} \
+ -w /helm-test \
+ $(TEST_IMAGE) \
+ make acceptance
+endif
+
+# destroy GKE cluster using terraform
+test-destroy:
+ @docker run -it -v ${PWD}:/helm-test \
+ -e GOOGLE_CREDENTIALS=${GOOGLE_CREDENTIALS} \
+ -e CLOUDSDK_CORE_PROJECT=${CLOUDSDK_CORE_PROJECT} \
+ -w /helm-test \
+ $(TEST_IMAGE) \
+ make destroy-cluster
+
+# provision GKE cluster using terraform
+test-provision:
+ @docker run -it -v ${PWD}:/helm-test \
+ -e GOOGLE_CREDENTIALS=${GOOGLE_CREDENTIALS} \
+ -e CLOUDSDK_CORE_PROJECT=${CLOUDSDK_CORE_PROJECT} \
+ -e KUBECONFIG=/helm-test/.kube/config \
+ -w /helm-test \
+ $(TEST_IMAGE) \
+ make provision-cluster
+
+# this target is for running the acceptance tests
+# it is run in the docker container above when the test-acceptance target is invoked
+acceptance:
+ifneq ($(LOCAL_ACCEPTANCE_TESTS),true)
+ gcloud auth activate-service-account --key-file=${GOOGLE_CREDENTIALS}
+endif
+ bats --tap --timing test/${ACCEPTANCE_TESTS}
+
+# this target is for provisioning the GKE cluster
+# it is run in the docker container above when the test-provision target is invoked
+provision-cluster:
+ gcloud auth activate-service-account --key-file=${GOOGLE_CREDENTIALS}
+ terraform init test/terraform
+ terraform apply -var project=${CLOUDSDK_CORE_PROJECT} -var init_cli=true -auto-approve test/terraform
+
+# this target is for removing the GKE cluster
+# it is run in the docker container above when the test-destroy target is invoked
+destroy-cluster:
+ terraform destroy -auto-approve
+
+# create a kind cluster for running the acceptance tests locally
+setup-kind:
+ kind get clusters | grep -q "^${KIND_CLUSTER_NAME}$$" || \
+ kind create cluster \
+ --image kindest/node:${KIND_K8S_VERSION} \
+ --name ${KIND_CLUSTER_NAME} \
+ --config $(CURDIR)/test/kind/config.yaml
+ kubectl config use-context kind-${KIND_CLUSTER_NAME}
+
+# delete the kind cluster
+delete-kind:
+ kind delete cluster --name ${KIND_CLUSTER_NAME} || :
+
+.PHONY: values-schema test-image test-unit test-bats test test-acceptance test-destroy test-provision acceptance provision-cluster destroy-cluster
diff --git a/charts/vault/README.md b/charts/vault/README.md
new file mode 100644
index 0000000..2e58a67
--- /dev/null
+++ b/charts/vault/README.md
@@ -0,0 +1,43 @@
+# Vault Helm Chart
+
+> :warning: **Please note**: We take Vault's security and our users' trust very seriously. If
+you believe you have found a security issue in Vault Helm, _please responsibly disclose_
+by contacting us at [security@hashicorp.com](mailto:security@hashicorp.com).
+
+This repository contains the official HashiCorp Helm chart for installing
+and configuring Vault on Kubernetes. This chart supports multiple use
+cases of Vault on Kubernetes depending on the values provided.
+
+For full documentation on this Helm chart along with all the ways you can
+use Vault with Kubernetes, please see the
+[Vault and Kubernetes documentation](https://developer.hashicorp.com/vault/docs/platform/k8s).
+
+## Prerequisites
+
+To use the charts here, [Helm](https://helm.sh/) must be configured for your
+Kubernetes cluster. Setting up Kubernetes and Helm is outside the scope of
+this README. Please refer to the Kubernetes and Helm documentation.
+
+The versions required are:
+
+ * **Helm 3.6+**
+ * **Kubernetes 1.28+** - This is the earliest version of Kubernetes tested.
+ It is possible that this chart works with earlier versions but it is
+ untested.
+
+## Usage
+
+To install the latest version of this chart, add the Hashicorp helm repository
+and run `helm install`:
+
+```console
+$ helm repo add hashicorp https://helm.releases.hashicorp.com
+"hashicorp" has been added to your repositories
+
+$ helm install vault hashicorp/vault
+```
+
+Please see the many options supported in the `values.yaml` file. These are also
+fully documented directly on the [Vault
+website](https://developer.hashicorp.com/vault/docs/platform/k8s/helm) along with more
+detailed installation instructions.
diff --git a/charts/vault/templates/NOTES.txt b/charts/vault/templates/NOTES.txt
new file mode 100644
index 0000000..60d99a4
--- /dev/null
+++ b/charts/vault/templates/NOTES.txt
@@ -0,0 +1,14 @@
+
+Thank you for installing HashiCorp Vault!
+
+Now that you have deployed Vault, you should look over the docs on using
+Vault with Kubernetes available here:
+
+https://developer.hashicorp.com/vault/docs
+
+
+Your release is named {{ .Release.Name }}. To learn more about the release, try:
+
+ $ helm status {{ .Release.Name }}
+ $ helm get manifest {{ .Release.Name }}
+
diff --git a/charts/vault/templates/_helpers.tpl b/charts/vault/templates/_helpers.tpl
new file mode 100644
index 0000000..255d2e8
--- /dev/null
+++ b/charts/vault/templates/_helpers.tpl
@@ -0,0 +1,1114 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to
+this (by the DNS naming spec). If release name contains chart name it will
+be used as a full name.
+*/}}
+{{- define "vault.fullname" -}}
+{{- if .Values.fullnameOverride -}}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- if contains $name .Release.Name -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- else -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "vault.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "vault.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Allow the release namespace to be overridden
+*/}}
+{{- define "vault.namespace" -}}
+{{- default .Release.Namespace .Values.global.namespace -}}
+{{- end -}}
+
+{{/*
+Compute if the csi driver is enabled.
+*/}}
+{{- define "vault.csiEnabled" -}}
+{{- $_ := set . "csiEnabled" (or
+ (eq (.Values.csi.enabled | toString) "true")
+ (and (eq (.Values.csi.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the injector is enabled.
+*/}}
+{{- define "vault.injectorEnabled" -}}
+{{- $_ := set . "injectorEnabled" (or
+ (eq (.Values.injector.enabled | toString) "true")
+ (and (eq (.Values.injector.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server is enabled.
+*/}}
+{{- define "vault.serverEnabled" -}}
+{{- $_ := set . "serverEnabled" (or
+ (eq (.Values.server.enabled | toString) "true")
+ (and (eq (.Values.server.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server serviceaccount is enabled.
+*/}}
+{{- define "vault.serverServiceAccountEnabled" -}}
+{{- $_ := set . "serverServiceAccountEnabled"
+ (and
+ (eq (.Values.server.serviceAccount.create | toString) "true" )
+ (or
+ (eq (.Values.server.enabled | toString) "true")
+ (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server serviceaccount should have a token created and mounted to the serviceaccount.
+*/}}
+{{- define "vault.serverServiceAccountSecretCreationEnabled" -}}
+{{- $_ := set . "serverServiceAccountSecretCreationEnabled"
+ (and
+ (eq (.Values.server.serviceAccount.create | toString) "true")
+ (eq (.Values.server.serviceAccount.createSecret | toString) "true")) -}}
+{{- end -}}
+
+
+{{/*
+Compute if the server auth delegator serviceaccount is enabled.
+*/}}
+{{- define "vault.serverAuthDelegator" -}}
+{{- $_ := set . "serverAuthDelegator"
+ (and
+ (eq (.Values.server.authDelegator.enabled | toString) "true" )
+ (or (eq (.Values.server.serviceAccount.create | toString) "true")
+ (not (eq .Values.server.serviceAccount.name "")))
+ (or
+ (eq (.Values.server.enabled | toString) "true")
+ (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute if the server service is enabled.
+*/}}
+{{- define "vault.serverServiceEnabled" -}}
+{{- template "vault.serverEnabled" . -}}
+{{- $_ := set . "serverServiceEnabled" (and .serverEnabled (eq (.Values.server.service.enabled | toString) "true")) -}}
+{{- end -}}
+
+{{/*
+Compute if the ui is enabled.
+*/}}
+{{- define "vault.uiEnabled" -}}
+{{- $_ := set . "uiEnabled" (or
+ (eq (.Values.ui.enabled | toString) "true")
+ (and (eq (.Values.ui.enabled | toString) "-") (eq (.Values.global.enabled | toString) "true"))) -}}
+{{- end -}}
+
+{{/*
+Compute the maximum number of unavailable replicas for the PodDisruptionBudget.
+This defaults to (n/2)-1 where n is the number of members of the server cluster.
+Add a special case for replicas=1, where it should default to 0 as well.
+*/}}
+{{- define "vault.pdb.maxUnavailable" -}}
+{{- if eq (int .Values.server.ha.replicas) 1 -}}
+{{ 0 }}
+{{- else if .Values.server.ha.disruptionBudget.maxUnavailable -}}
+{{ .Values.server.ha.disruptionBudget.maxUnavailable -}}
+{{- else -}}
+{{- div (sub (div (mul (int .Values.server.ha.replicas) 10) 2) 1) 10 -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Set the variable 'mode' to the server mode requested by the user to simplify
+template logic.
+*/}}
+{{- define "vault.mode" -}}
+ {{- template "vault.serverEnabled" . -}}
+ {{- if or (.Values.injector.externalVaultAddr) (.Values.global.externalVaultAddr) -}}
+ {{- $_ := set . "mode" "external" -}}
+ {{- else if not .serverEnabled -}}
+ {{- $_ := set . "mode" "external" -}}
+ {{- else if eq (.Values.server.dev.enabled | toString) "true" -}}
+ {{- $_ := set . "mode" "dev" -}}
+ {{- else if eq (.Values.server.ha.enabled | toString) "true" -}}
+ {{- $_ := set . "mode" "ha" -}}
+ {{- else if or (eq (.Values.server.standalone.enabled | toString) "true") (eq (.Values.server.standalone.enabled | toString) "-") -}}
+ {{- $_ := set . "mode" "standalone" -}}
+ {{- else -}}
+ {{- $_ := set . "mode" "" -}}
+ {{- end -}}
+{{- end -}}
+
+{{/*
+Set's the replica count based on the different modes configured by user
+*/}}
+{{- define "vault.replicas" -}}
+ {{ if eq .mode "standalone" }}
+ {{- default 1 -}}
+ {{ else if eq .mode "ha" }}
+ {{- if or (kindIs "int64" .Values.server.ha.replicas) (kindIs "float64" .Values.server.ha.replicas) -}}
+ {{- .Values.server.ha.replicas -}}
+ {{ else }}
+ {{- 3 -}}
+ {{- end -}}
+ {{ else }}
+ {{- default 1 -}}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Set's up configmap mounts if this isn't a dev deployment and the user
+defined a custom configuration. Additionally iterates over any
+extra volumes the user may have specified (such as a secret with TLS).
+*/}}
+{{- define "vault.volumes" -}}
+ {{- if and (ne .mode "dev") (or (.Values.server.standalone.config) (.Values.server.ha.config) (.Values.server.ha.raft.config)) }}
+ - name: config
+ configMap:
+ name: {{ template "vault.fullname" . }}-config
+ {{ end }}
+ {{- range .Values.server.extraVolumes }}
+ - name: userconfig-{{ .name }}
+ {{ .type }}:
+ {{- if (eq .type "configMap") }}
+ name: {{ .name }}
+ {{- else if (eq .type "secret") }}
+ secretName: {{ .name }}
+ {{- end }}
+ defaultMode: {{ .defaultMode | default 420 }}
+ {{- end }}
+ {{- if .Values.server.volumes }}
+ {{- toYaml .Values.server.volumes | nindent 8}}
+ {{- end }}
+ {{- if (and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey) }}
+ - name: vault-license
+ secret:
+ secretName: {{ .Values.server.enterpriseLicense.secretName }}
+ defaultMode: 0440
+ {{- end }}
+{{- end -}}
+
+{{/*
+Set's the args for custom command to render the Vault configuration
+file with IP addresses to make the out of box experience easier
+for users looking to use this chart with Consul Helm.
+*/}}
+{{- define "vault.args" -}}
+ {{ if or (eq .mode "standalone") (eq .mode "ha") }}
+ - |
+ cp /vault/config/extraconfig-from-values.hcl /tmp/storageconfig.hcl;
+ [ -n "${HOST_IP}" ] && sed -Ei "s|HOST_IP|${HOST_IP?}|g" /tmp/storageconfig.hcl;
+ [ -n "${POD_IP}" ] && sed -Ei "s|POD_IP|${POD_IP?}|g" /tmp/storageconfig.hcl;
+ [ -n "${HOSTNAME}" ] && sed -Ei "s|HOSTNAME|${HOSTNAME?}|g" /tmp/storageconfig.hcl;
+ [ -n "${API_ADDR}" ] && sed -Ei "s|API_ADDR|${API_ADDR?}|g" /tmp/storageconfig.hcl;
+ [ -n "${TRANSIT_ADDR}" ] && sed -Ei "s|TRANSIT_ADDR|${TRANSIT_ADDR?}|g" /tmp/storageconfig.hcl;
+ [ -n "${RAFT_ADDR}" ] && sed -Ei "s|RAFT_ADDR|${RAFT_ADDR?}|g" /tmp/storageconfig.hcl;
+ /usr/local/bin/docker-entrypoint.sh vault server -config=/tmp/storageconfig.hcl {{ .Values.server.extraArgs }}
+ {{ else if eq .mode "dev" }}
+ - |
+ /usr/local/bin/docker-entrypoint.sh vault server -dev {{ .Values.server.extraArgs }}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Set's additional environment variables based on the mode.
+*/}}
+{{- define "vault.envs" -}}
+ {{ if eq .mode "dev" }}
+ - name: VAULT_DEV_ROOT_TOKEN_ID
+ value: {{ .Values.server.dev.devRootToken }}
+ - name: VAULT_DEV_LISTEN_ADDRESS
+ value: "[::]:8200"
+ {{ end }}
+{{- end -}}
+
+{{/*
+Set's which additional volumes should be mounted to the container
+based on the mode configured.
+*/}}
+{{- define "vault.mounts" -}}
+ {{ if eq (.Values.server.auditStorage.enabled | toString) "true" }}
+ - name: audit
+ mountPath: {{ .Values.server.auditStorage.mountPath }}
+ {{ end }}
+ {{ if or (eq .mode "standalone") (and (eq .mode "ha") (eq (.Values.server.ha.raft.enabled | toString) "true")) }}
+ {{ if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+ - name: data
+ mountPath: {{ .Values.server.dataStorage.mountPath }}
+ {{ end }}
+ {{ end }}
+ {{ if and (ne .mode "dev") (or (.Values.server.standalone.config) (.Values.server.ha.config)) }}
+ - name: config
+ mountPath: /vault/config
+ {{ end }}
+ {{- range .Values.server.extraVolumes }}
+ - name: userconfig-{{ .name }}
+ readOnly: true
+ mountPath: {{ .path | default "/vault/userconfig" }}/{{ .name }}
+ {{- end }}
+ {{- if .Values.server.volumeMounts }}
+ {{- toYaml .Values.server.volumeMounts | nindent 12}}
+ {{- end }}
+ {{- if (and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey) }}
+ - name: vault-license
+ mountPath: /vault/license
+ readOnly: true
+ {{- end }}
+{{- end -}}
+
+{{/*
+Set's up the volumeClaimTemplates when data or audit storage is required. HA
+might not use data storage since Consul is likely it's backend, however, audit
+storage might be desired by the user.
+*/}}
+{{- define "vault.volumeclaims" -}}
+ {{- if and (ne .mode "dev") (or .Values.server.dataStorage.enabled .Values.server.auditStorage.enabled) }}
+ volumeClaimTemplates:
+ {{- if and (eq (.Values.server.dataStorage.enabled | toString) "true") (or (eq .mode "standalone") (eq (.Values.server.ha.raft.enabled | toString ) "true" )) }}
+ - metadata:
+ name: data
+ {{- include "vault.dataVolumeClaim.annotations" . | nindent 6 }}
+ {{- include "vault.dataVolumeClaim.labels" . | nindent 6 }}
+ spec:
+ accessModes:
+ - {{ .Values.server.dataStorage.accessMode | default "ReadWriteOnce" }}
+ resources:
+ requests:
+ storage: {{ .Values.server.dataStorage.size }}
+ {{- if .Values.server.dataStorage.storageClass }}
+ storageClassName: {{ .Values.server.dataStorage.storageClass }}
+ {{- end }}
+ {{ end }}
+ {{- if eq (.Values.server.auditStorage.enabled | toString) "true" }}
+ - metadata:
+ name: audit
+ {{- include "vault.auditVolumeClaim.annotations" . | nindent 6 }}
+ {{- include "vault.auditVolumeClaim.labels" . | nindent 6 }}
+ spec:
+ accessModes:
+ - {{ .Values.server.auditStorage.accessMode | default "ReadWriteOnce" }}
+ resources:
+ requests:
+ storage: {{ .Values.server.auditStorage.size }}
+ {{- if .Values.server.auditStorage.storageClass }}
+ storageClassName: {{ .Values.server.auditStorage.storageClass }}
+ {{- end }}
+ {{ end }}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Set's the affinity for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "vault.affinity" -}}
+ {{- if and (ne .mode "dev") .Values.server.affinity }}
+ affinity:
+ {{ $tp := typeOf .Values.server.affinity }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.affinity . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.server.affinity | nindent 8 }}
+ {{- end }}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Sets the injector affinity for pod placement
+*/}}
+{{- define "injector.affinity" -}}
+ {{- if .Values.injector.affinity }}
+ affinity:
+ {{ $tp := typeOf .Values.injector.affinity }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.injector.affinity . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.injector.affinity | nindent 8 }}
+ {{- end }}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Sets the topologySpreadConstraints when running in standalone and HA modes.
+*/}}
+{{- define "vault.topologySpreadConstraints" -}}
+ {{- if and (ne .mode "dev") .Values.server.topologySpreadConstraints }}
+ topologySpreadConstraints:
+ {{ $tp := typeOf .Values.server.topologySpreadConstraints }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.topologySpreadConstraints . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.server.topologySpreadConstraints | nindent 8 }}
+ {{- end }}
+ {{ end }}
+{{- end -}}
+
+
+{{/*
+Sets the injector topologySpreadConstraints for pod placement
+*/}}
+{{- define "injector.topologySpreadConstraints" -}}
+ {{- if .Values.injector.topologySpreadConstraints }}
+ topologySpreadConstraints:
+ {{ $tp := typeOf .Values.injector.topologySpreadConstraints }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.injector.topologySpreadConstraints . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.injector.topologySpreadConstraints | nindent 8 }}
+ {{- end }}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Sets the toleration for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "vault.tolerations" -}}
+ {{- if and (ne .mode "dev") .Values.server.tolerations }}
+ tolerations:
+ {{- $tp := typeOf .Values.server.tolerations }}
+ {{- if eq $tp "string" }}
+ {{ tpl .Values.server.tolerations . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.server.tolerations | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector toleration for pod placement
+*/}}
+{{- define "injector.tolerations" -}}
+ {{- if .Values.injector.tolerations }}
+ tolerations:
+ {{- $tp := typeOf .Values.injector.tolerations }}
+ {{- if eq $tp "string" }}
+ {{ tpl .Values.injector.tolerations . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.injector.tolerations | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Set's the node selector for pod placement when running in standalone and HA modes.
+*/}}
+{{- define "vault.nodeselector" -}}
+ {{- if and (ne .mode "dev") .Values.server.nodeSelector }}
+ nodeSelector:
+ {{- $tp := typeOf .Values.server.nodeSelector }}
+ {{- if eq $tp "string" }}
+ {{ tpl .Values.server.nodeSelector . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.server.nodeSelector | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector node selector for pod placement
+*/}}
+{{- define "injector.nodeselector" -}}
+ {{- if .Values.injector.nodeSelector }}
+ nodeSelector:
+ {{- $tp := typeOf .Values.injector.nodeSelector }}
+ {{- if eq $tp "string" }}
+ {{ tpl .Values.injector.nodeSelector . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.injector.nodeSelector | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets the injector deployment update strategy
+*/}}
+{{- define "injector.strategy" -}}
+ {{- if .Values.injector.strategy }}
+ strategy:
+ {{- $tp := typeOf .Values.injector.strategy }}
+ {{- if eq $tp "string" }}
+ {{ tpl .Values.injector.strategy . | nindent 4 | trim }}
+ {{- else }}
+ {{- toYaml .Values.injector.strategy | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra pod annotations
+*/}}
+{{- define "vault.annotations" }}
+ annotations:
+ {{- if .Values.server.includeConfigAnnotation }}
+ vault.hashicorp.com/config-checksum: {{ include "vault.config" . | sha256sum }}
+ {{- end }}
+ {{- if .Values.server.annotations }}
+ {{- $tp := typeOf .Values.server.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.annotations . | nindent 8 }}
+ {{- else }}
+ {{- toYaml .Values.server.annotations | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector pod annotations
+*/}}
+{{- define "injector.annotations" -}}
+ {{- if .Values.injector.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.injector.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.injector.annotations . | nindent 8 }}
+ {{- else }}
+ {{- toYaml .Values.injector.annotations | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector service annotations
+*/}}
+{{- define "injector.service.annotations" -}}
+ {{- if .Values.injector.service.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.injector.service.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.injector.service.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.injector.service.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the injector pod level.
+*/}}
+{{- define "injector.securityContext.pod" -}}
+ {{- if .Values.injector.securityContext.pod }}
+ securityContext:
+ {{- $tp := typeOf .Values.injector.securityContext.pod }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.injector.securityContext.pod . | nindent 8 }}
+ {{- else }}
+ {{- toYaml .Values.injector.securityContext.pod | nindent 8 }}
+ {{- end }}
+ {{- else if not .Values.global.openshift }}
+ securityContext:
+ runAsNonRoot: true
+ runAsGroup: {{ .Values.injector.gid | default 1000 }}
+ runAsUser: {{ .Values.injector.uid | default 100 }}
+ fsGroup: {{ .Values.injector.gid | default 1000 }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the injector container level.
+*/}}
+{{- define "injector.securityContext.container" -}}
+ {{- if .Values.injector.securityContext.container}}
+ securityContext:
+ {{- $tp := typeOf .Values.injector.securityContext.container }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.injector.securityContext.container . | nindent 12 }}
+ {{- else }}
+ {{- toYaml .Values.injector.securityContext.container | nindent 12 }}
+ {{- end }}
+ {{- else if not .Values.global.openshift }}
+ securityContext:
+ allowPrivilegeEscalation: false
+ capabilities:
+ drop:
+ - ALL
+ {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the statefulset pod template.
+*/}}
+{{- define "server.statefulSet.securityContext.pod" -}}
+ {{- if .Values.server.statefulSet.securityContext.pod }}
+ securityContext:
+ {{- $tp := typeOf .Values.server.statefulSet.securityContext.pod }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.statefulSet.securityContext.pod . | nindent 8 }}
+ {{- else }}
+ {{- toYaml .Values.server.statefulSet.securityContext.pod | nindent 8 }}
+ {{- end }}
+ {{- else if not .Values.global.openshift }}
+ securityContext:
+ runAsNonRoot: true
+ runAsGroup: {{ .Values.server.gid | default 1000 }}
+ runAsUser: {{ .Values.server.uid | default 100 }}
+ fsGroup: {{ .Values.server.gid | default 1000 }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+securityContext for the statefulset vault container
+*/}}
+{{- define "server.statefulSet.securityContext.container" -}}
+ {{- if .Values.server.statefulSet.securityContext.container }}
+ securityContext:
+ {{- $tp := typeOf .Values.server.statefulSet.securityContext.container }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.statefulSet.securityContext.container . | nindent 12 }}
+ {{- else }}
+ {{- toYaml .Values.server.statefulSet.securityContext.container | nindent 12 }}
+ {{- end }}
+ {{- else if not .Values.global.openshift }}
+ securityContext:
+ allowPrivilegeEscalation: false
+ {{- end }}
+{{- end -}}
+
+
+{{/*
+Sets extra injector service account annotations
+*/}}
+{{- define "injector.serviceAccount.annotations" -}}
+ {{- if and (ne .mode "dev") .Values.injector.serviceAccount.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.injector.serviceAccount.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.injector.serviceAccount.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.injector.serviceAccount.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra injector webhook annotations
+*/}}
+{{- define "injector.webhookAnnotations" -}}
+ {{- if or (((.Values.injector.webhook)).annotations) (.Values.injector.webhookAnnotations) }}
+ annotations:
+ {{- $tp := typeOf (or (((.Values.injector.webhook)).annotations) (.Values.injector.webhookAnnotations)) }}
+ {{- if eq $tp "string" }}
+ {{- tpl (((.Values.injector.webhook)).annotations | default .Values.injector.webhookAnnotations) . | nindent 4 }}
+ {{- else }}
+ {{- toYaml (((.Values.injector.webhook)).annotations | default .Values.injector.webhookAnnotations) | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Set's the injector webhook objectSelector
+*/}}
+{{- define "injector.objectSelector" -}}
+ {{- $v := or (((.Values.injector.webhook)).objectSelector) (.Values.injector.objectSelector) -}}
+ {{ if $v }}
+ objectSelector:
+ {{- $tp := typeOf $v -}}
+ {{ if eq $tp "string" }}
+ {{ tpl $v . | indent 6 | trim }}
+ {{ else }}
+ {{ toYaml $v | indent 6 | trim }}
+ {{ end }}
+ {{ end }}
+{{ end }}
+
+{{/*
+Sets extra ui service annotations
+*/}}
+{{- define "vault.ui.annotations" -}}
+ {{- if .Values.ui.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.ui.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.ui.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.ui.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "vault.serviceAccount.name" -}}
+{{- if .Values.server.serviceAccount.create -}}
+ {{ default (include "vault.fullname" .) .Values.server.serviceAccount.name }}
+{{- else -}}
+ {{ default "default" .Values.server.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Sets extra service account annotations
+*/}}
+{{- define "vault.serviceAccount.annotations" -}}
+ {{- if and (ne .mode "dev") .Values.server.serviceAccount.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.server.serviceAccount.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.serviceAccount.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.serviceAccount.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra ingress annotations
+*/}}
+{{- define "vault.ingress.annotations" -}}
+ {{- if .Values.server.ingress.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.server.ingress.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.ingress.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.ingress.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra route annotations
+*/}}
+{{- define "vault.route.annotations" -}}
+ {{- if .Values.server.route.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.server.route.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.route.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.route.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra vault server Service annotations
+*/}}
+{{- define "vault.service.annotations" -}}
+ {{- if .Values.server.service.annotations }}
+ {{- $tp := typeOf .Values.server.service.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.service.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.service.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra vault server Service (active) annotations
+*/}}
+{{- define "vault.service.active.annotations" -}}
+ {{- if .Values.server.service.active.annotations }}
+ {{- $tp := typeOf .Values.server.service.active.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.service.active.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.service.active.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+{{/*
+Sets extra vault server Service annotations
+*/}}
+{{- define "vault.service.standby.annotations" -}}
+ {{- if .Values.server.service.standby.annotations }}
+ {{- $tp := typeOf .Values.server.service.standby.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.service.standby.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.service.standby.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets PodSecurityPolicy annotations
+*/}}
+{{- define "vault.psp.annotations" -}}
+ {{- if .Values.global.psp.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.global.psp.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.global.psp.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.global.psp.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra statefulset annotations
+*/}}
+{{- define "vault.statefulSet.annotations" -}}
+ {{- if .Values.server.statefulSet.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.server.statefulSet.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.statefulSet.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.statefulSet.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim annotations for data volume
+*/}}
+{{- define "vault.dataVolumeClaim.annotations" -}}
+ {{- if and (ne .mode "dev") (.Values.server.dataStorage.enabled) (.Values.server.dataStorage.annotations) }}
+ annotations:
+ {{- $tp := typeOf .Values.server.dataStorage.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.dataStorage.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.dataStorage.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim labels for data volume
+*/}}
+{{- define "vault.dataVolumeClaim.labels" -}}
+ {{- if and (ne .mode "dev") (.Values.server.dataStorage.enabled) (.Values.server.dataStorage.labels) }}
+ labels:
+ {{- $tp := typeOf .Values.server.dataStorage.labels }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.dataStorage.labels . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.dataStorage.labels | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim annotations for audit volume
+*/}}
+{{- define "vault.auditVolumeClaim.annotations" -}}
+ {{- if and (ne .mode "dev") (.Values.server.auditStorage.enabled) (.Values.server.auditStorage.annotations) }}
+ annotations:
+ {{- $tp := typeOf .Values.server.auditStorage.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.auditStorage.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.auditStorage.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets VolumeClaim labels for audit volume
+*/}}
+{{- define "vault.auditVolumeClaim.labels" -}}
+ {{- if and (ne .mode "dev") (.Values.server.auditStorage.enabled) (.Values.server.auditStorage.labels) }}
+ labels:
+ {{- $tp := typeOf .Values.server.auditStorage.labels }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.server.auditStorage.labels . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.server.auditStorage.labels | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Set's the container resources if the user has set any.
+*/}}
+{{- define "vault.resources" -}}
+ {{- if .Values.server.resources -}}
+ resources:
+{{ toYaml .Values.server.resources | indent 12}}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources if the user has set any.
+*/}}
+{{- define "injector.resources" -}}
+ {{- if .Values.injector.resources -}}
+ resources:
+{{ toYaml .Values.injector.resources | indent 12}}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources if the user has set any.
+*/}}
+{{- define "csi.resources" -}}
+ {{- if .Values.csi.resources -}}
+ resources:
+{{ toYaml .Values.csi.resources | indent 12}}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Sets the container resources for CSI's Agent sidecar if the user has set any.
+*/}}
+{{- define "csi.agent.resources" -}}
+ {{- if .Values.csi.agent.resources -}}
+ resources:
+{{ toYaml .Values.csi.agent.resources | indent 12}}
+ {{ end }}
+{{- end -}}
+
+{{/*
+Sets extra CSI daemonset annotations
+*/}}
+{{- define "csi.daemonSet.annotations" -}}
+ {{- if .Values.csi.daemonSet.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.csi.daemonSet.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.csi.daemonSet.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.csi.daemonSet.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets CSI daemonset securityContext for pod template
+*/}}
+{{- define "csi.daemonSet.securityContext.pod" -}}
+ {{- if .Values.csi.daemonSet.securityContext.pod }}
+ securityContext:
+ {{- $tp := typeOf .Values.csi.daemonSet.securityContext.pod }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.csi.daemonSet.securityContext.pod . | nindent 8 }}
+ {{- else }}
+ {{- toYaml .Values.csi.daemonSet.securityContext.pod | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets CSI daemonset securityContext for container
+*/}}
+{{- define "csi.daemonSet.securityContext.container" -}}
+ {{- if .Values.csi.daemonSet.securityContext.container }}
+ securityContext:
+ {{- $tp := typeOf .Values.csi.daemonSet.securityContext.container }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.csi.daemonSet.securityContext.container . | nindent 12 }}
+ {{- else }}
+ {{- toYaml .Values.csi.daemonSet.securityContext.container | nindent 12 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+
+{{/*
+Sets the injector toleration for pod placement
+*/}}
+{{- define "csi.pod.tolerations" -}}
+ {{- if .Values.csi.pod.tolerations }}
+ tolerations:
+ {{- $tp := typeOf .Values.csi.pod.tolerations }}
+ {{- if eq $tp "string" }}
+ {{ tpl .Values.csi.pod.tolerations . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.csi.pod.tolerations | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets the CSI provider nodeSelector for pod placement
+*/}}
+{{- define "csi.pod.nodeselector" -}}
+ {{- if .Values.csi.pod.nodeSelector }}
+ nodeSelector:
+ {{- $tp := typeOf .Values.csi.pod.nodeSelector }}
+ {{- if eq $tp "string" }}
+ {{ tpl .Values.csi.pod.nodeSelector . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.csi.pod.nodeSelector | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+{{/*
+Sets the CSI provider affinity for pod placement.
+*/}}
+{{- define "csi.pod.affinity" -}}
+ {{- if .Values.csi.pod.affinity }}
+ affinity:
+ {{ $tp := typeOf .Values.csi.pod.affinity }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.csi.pod.affinity . | nindent 8 | trim }}
+ {{- else }}
+ {{- toYaml .Values.csi.pod.affinity | nindent 8 }}
+ {{- end }}
+ {{ end }}
+{{- end -}}
+{{/*
+Sets extra CSI provider pod annotations
+*/}}
+{{- define "csi.pod.annotations" -}}
+ {{- if .Values.csi.pod.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.csi.pod.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.csi.pod.annotations . | nindent 8 }}
+ {{- else }}
+ {{- toYaml .Values.csi.pod.annotations | nindent 8 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Sets extra CSI service account annotations
+*/}}
+{{- define "csi.serviceAccount.annotations" -}}
+ {{- if .Values.csi.serviceAccount.annotations }}
+ annotations:
+ {{- $tp := typeOf .Values.csi.serviceAccount.annotations }}
+ {{- if eq $tp "string" }}
+ {{- tpl .Values.csi.serviceAccount.annotations . | nindent 4 }}
+ {{- else }}
+ {{- toYaml .Values.csi.serviceAccount.annotations | nindent 4 }}
+ {{- end }}
+ {{- end }}
+{{- end -}}
+
+{{/*
+Inject extra environment vars in the format key:value, if populated
+*/}}
+{{- define "vault.extraEnvironmentVars" -}}
+{{- if .extraEnvironmentVars -}}
+{{- range $key, $value := .extraEnvironmentVars }}
+- name: {{ printf "%s" $key | replace "." "_" | upper | quote }}
+ value: {{ $value | quote }}
+{{- end }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Inject extra environment populated by secrets, if populated
+*/}}
+{{- define "vault.extraSecretEnvironmentVars" -}}
+{{- if .extraSecretEnvironmentVars -}}
+{{- range .extraSecretEnvironmentVars }}
+- name: {{ .envName }}
+ valueFrom:
+ secretKeyRef:
+ name: {{ .secretName }}
+ key: {{ .secretKey }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Scheme for health check and local endpoint */}}
+{{- define "vault.scheme" -}}
+{{- if .Values.global.tlsDisable -}}
+{{ "http" }}
+{{- else -}}
+{{ "https" }}
+{{- end -}}
+{{- end -}}
+
+{{/*
+imagePullSecrets generates pull secrets from either string or map values.
+A map value must be indexable by the key 'name'.
+*/}}
+{{- define "imagePullSecrets" -}}
+{{- with .Values.global.imagePullSecrets -}}
+imagePullSecrets:
+{{- range . -}}
+{{- if typeIs "string" . }}
+ - name: {{ . }}
+{{- else if index . "name" }}
+ - name: {{ .name }}
+{{- end }}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+externalTrafficPolicy sets a Service's externalTrafficPolicy if applicable.
+Supported inputs are Values.server.service and Values.ui
+*/}}
+{{- define "service.externalTrafficPolicy" -}}
+{{- $type := "" -}}
+{{- if .serviceType -}}
+{{- $type = .serviceType -}}
+{{- else if .type -}}
+{{- $type = .type -}}
+{{- end -}}
+{{- if and .externalTrafficPolicy (or (eq $type "LoadBalancer") (eq $type "NodePort")) }}
+ externalTrafficPolicy: {{ .externalTrafficPolicy }}
+{{- else }}
+{{- end }}
+{{- end -}}
+
+{{/*
+loadBalancer configuration for the the UI service.
+Supported inputs are Values.ui
+*/}}
+{{- define "service.loadBalancer" -}}
+{{- if eq (.serviceType | toString) "LoadBalancer" }}
+{{- if .loadBalancerIP }}
+ loadBalancerIP: {{ .loadBalancerIP }}
+{{- end }}
+{{- with .loadBalancerSourceRanges }}
+ loadBalancerSourceRanges:
+{{- range . }}
+ - {{ . }}
+{{- end }}
+{{- end -}}
+{{- end }}
+{{- end -}}
+
+{{/*
+config file from values
+*/}}
+{{- define "vault.config" -}}
+{{- if or (eq .mode "ha") (eq .mode "standalone") }}
+{{- $config := (index .Values.server .mode).config -}}
+{{- if .Values.server.ha.raft.enabled -}}
+{{- $config = .Values.server.ha.raft.config -}}
+{{- end -}}
+{{- $type := typeOf $config -}}
+{{- if eq $type "string" -}}
+{{/* Vault supports both HCL and JSON as its configuration format */}}
+{{- $json := tpl $config . | fromJson -}}
+{{/*
+Helm's fromJson does not behave according to the corresponding sprig function nor Helm docs,
+which claim that it should return empty string on invalid JSON, it actually returns
+a map containing a single 'Error' element.
+https://github.com/helm/helm/blob/50c22ed7f953fadb32755e5881ba95a92da852b2/pkg/engine/funcs.go#L158
+ */}}
+{{- if or (and (eq ($json | len) 1) (hasKey $json "Error")) (eq ($json | len) 0) -}}
+{{- $config = printf "%s\n%s" $config "disable_mlock = true" -}}
+{{- else -}}
+{{- if not (hasKey $json "disable_mlock") -}}
+{{- $_ := set $json "disable_mlock" true -}}
+{{- end -}}
+{{- $config = $json | mustToJson -}}
+{{- end -}}
+{{- else }}
+{{- fail "structured server config is not supported, value must be a string"}}
+{{- end }}
+{{- tpl $config . | nindent 4 | trim }}
+{{- end -}}
+{{- end -}}
diff --git a/charts/vault/templates/csi-agent-configmap.yaml b/charts/vault/templates/csi-agent-configmap.yaml
new file mode 100644
index 0000000..18cdb04
--- /dev/null
+++ b/charts/vault/templates/csi-agent-configmap.yaml
@@ -0,0 +1,34 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if and (.csiEnabled) (eq (.Values.csi.agent.enabled | toString) "true") -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ template "vault.fullname" . }}-csi-provider-agent-config
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+data:
+ config.hcl: |
+ vault {
+ {{- if .Values.global.externalVaultAddr }}
+ "address" = "{{ .Values.global.externalVaultAddr }}"
+ {{- else }}
+ "address" = "{{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}"
+ {{- end }}
+ }
+
+ cache {}
+
+ listener "unix" {
+ address = "/var/run/vault/agent.sock"
+ tls_disable = true
+ }
+{{- end }}
diff --git a/charts/vault/templates/csi-clusterrole.yaml b/charts/vault/templates/csi-clusterrole.yaml
new file mode 100644
index 0000000..6d979ea
--- /dev/null
+++ b/charts/vault/templates/csi-clusterrole.yaml
@@ -0,0 +1,23 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: {{ template "vault.fullname" . }}-csi-provider-clusterrole
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups:
+ - ""
+ resources:
+ - serviceaccounts/token
+ verbs:
+ - create
+{{- end }}
diff --git a/charts/vault/templates/csi-clusterrolebinding.yaml b/charts/vault/templates/csi-clusterrolebinding.yaml
new file mode 100644
index 0000000..506ec94
--- /dev/null
+++ b/charts/vault/templates/csi-clusterrolebinding.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-csi-provider-clusterrolebinding
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: {{ template "vault.fullname" . }}-csi-provider-clusterrole
+subjects:
+- kind: ServiceAccount
+ name: {{ template "vault.fullname" . }}-csi-provider
+ namespace: {{ include "vault.namespace" . }}
+{{- end }}
diff --git a/charts/vault/templates/csi-daemonset.yaml b/charts/vault/templates/csi-daemonset.yaml
new file mode 100644
index 0000000..aacce0a
--- /dev/null
+++ b/charts/vault/templates/csi-daemonset.yaml
@@ -0,0 +1,162 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+ name: {{ template "vault.fullname" . }}-csi-provider
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- if .Values.csi.daemonSet.extraLabels -}}
+ {{- toYaml .Values.csi.daemonSet.extraLabels | nindent 4 -}}
+ {{- end -}}
+ {{ template "csi.daemonSet.annotations" . }}
+spec:
+ updateStrategy:
+ type: {{ .Values.csi.daemonSet.updateStrategy.type }}
+ {{- if .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
+ rollingUpdate:
+ maxUnavailable: {{ .Values.csi.daemonSet.updateStrategy.maxUnavailable }}
+ {{- end }}
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ {{- if .Values.csi.pod.extraLabels -}}
+ {{- toYaml .Values.csi.pod.extraLabels | nindent 8 -}}
+ {{- end -}}
+ {{ template "csi.pod.annotations" . }}
+ spec:
+ {{ template "csi.daemonSet.securityContext.pod" . }}
+ {{- if .Values.csi.priorityClassName }}
+ priorityClassName: {{ .Values.csi.priorityClassName }}
+ {{- end }}
+ hostNetwork: {{ .Values.csi.hostNetwork }}
+ serviceAccountName: {{ template "vault.fullname" . }}-csi-provider
+ {{- template "csi.pod.tolerations" . }}
+ {{- template "csi.pod.nodeselector" . }}
+ {{- template "csi.pod.affinity" . }}
+ containers:
+ - name: {{ include "vault.name" . }}-csi-provider
+ {{ template "csi.resources" . }}
+ {{ template "csi.daemonSet.securityContext.container" . }}
+ image: "{{ .Values.csi.image.repository }}:{{ .Values.csi.image.tag }}"
+ imagePullPolicy: {{ .Values.csi.image.pullPolicy }}
+ args:
+ - --endpoint=/provider/vault.sock
+ {{- if .Values.csi.debug }}
+ - --log-level=debug
+ {{- else }}
+ - --log-level={{ .Values.csi.logLevel }}
+ {{- end }}
+ {{- if .Values.csi.hmacSecretName }}
+ - --hmac-secret-name={{ .Values.csi.hmacSecretName }}
+ {{- else }}
+ - --hmac-secret-name={{- include "vault.name" . }}-csi-provider-hmac-key
+ {{- end }}
+ {{- if .Values.csi.extraArgs }}
+ {{- toYaml .Values.csi.extraArgs | nindent 12 }}
+ {{- end }}
+ env:
+ - name: VAULT_ADDR
+ {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+ value: "unix:///var/run/vault/agent.sock"
+ {{- else if .Values.global.externalVaultAddr }}
+ value: "{{ .Values.global.externalVaultAddr }}"
+ {{- else }}
+ value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}
+ {{- end }}
+ volumeMounts:
+ - name: providervol
+ mountPath: "/provider"
+ {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+ - name: agent-unix-socket
+ mountPath: /var/run/vault
+ {{- end }}
+ {{- if .Values.csi.volumeMounts }}
+ {{- toYaml .Values.csi.volumeMounts | nindent 12}}
+ {{- end }}
+ livenessProbe:
+ httpGet:
+ path: /health/ready
+ port: 8080
+ failureThreshold: {{ .Values.csi.livenessProbe.failureThreshold }}
+ initialDelaySeconds: {{ .Values.csi.livenessProbe.initialDelaySeconds }}
+ periodSeconds: {{ .Values.csi.livenessProbe.periodSeconds }}
+ successThreshold: {{ .Values.csi.livenessProbe.successThreshold }}
+ timeoutSeconds: {{ .Values.csi.livenessProbe.timeoutSeconds }}
+ readinessProbe:
+ httpGet:
+ path: /health/ready
+ port: 8080
+ failureThreshold: {{ .Values.csi.readinessProbe.failureThreshold }}
+ initialDelaySeconds: {{ .Values.csi.readinessProbe.initialDelaySeconds }}
+ periodSeconds: {{ .Values.csi.readinessProbe.periodSeconds }}
+ successThreshold: {{ .Values.csi.readinessProbe.successThreshold }}
+ timeoutSeconds: {{ .Values.csi.readinessProbe.timeoutSeconds }}
+ {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+ - name: {{ include "vault.name" . }}-agent
+ image: "{{ .Values.csi.agent.image.repository }}:{{ .Values.csi.agent.image.tag }}"
+ imagePullPolicy: {{ .Values.csi.agent.image.pullPolicy }}
+ {{ template "csi.agent.resources" . }}
+ command:
+ - vault
+ args:
+ - agent
+ - -config=/etc/vault/config.hcl
+ {{- if .Values.csi.agent.extraArgs }}
+ {{- toYaml .Values.csi.agent.extraArgs | nindent 12 }}
+ {{- end }}
+ ports:
+ - containerPort: 8200
+ env:
+ - name: VAULT_LOG_LEVEL
+ value: "{{ .Values.csi.agent.logLevel }}"
+ - name: VAULT_LOG_FORMAT
+ value: "{{ .Values.csi.agent.logFormat }}"
+ securityContext:
+ runAsNonRoot: true
+ allowPrivilegeEscalation: false
+ readOnlyRootFilesystem: true
+ runAsUser: 100
+ runAsGroup: 1000
+ volumeMounts:
+ - name: agent-config
+ mountPath: /etc/vault/config.hcl
+ subPath: config.hcl
+ readOnly: true
+ - name: agent-unix-socket
+ mountPath: /var/run/vault
+ {{- if .Values.csi.volumeMounts }}
+ {{- toYaml .Values.csi.volumeMounts | nindent 12 }}
+ {{- end }}
+ {{- end }}
+ volumes:
+ - name: providervol
+ hostPath:
+ path: {{ .Values.csi.daemonSet.providersDir }}
+ {{- if eq (.Values.csi.agent.enabled | toString) "true" }}
+ - name: agent-config
+ configMap:
+ name: {{ template "vault.fullname" . }}-csi-provider-agent-config
+ - name: agent-unix-socket
+ emptyDir:
+ medium: Memory
+ {{- end }}
+ {{- if .Values.csi.volumes }}
+ {{- toYaml .Values.csi.volumes | nindent 8}}
+ {{- end }}
+ {{- include "imagePullSecrets" . | nindent 6 }}
+{{- end }}
diff --git a/charts/vault/templates/csi-role.yaml b/charts/vault/templates/csi-role.yaml
new file mode 100644
index 0000000..17e1918
--- /dev/null
+++ b/charts/vault/templates/csi-role.yaml
@@ -0,0 +1,32 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ template "vault.fullname" . }}-csi-provider-role
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: [""]
+ resources: ["secrets"]
+ verbs: ["get"]
+ resourceNames:
+ {{- if .Values.csi.hmacSecretName }}
+ - {{ .Values.csi.hmacSecretName }}
+ {{- else }}
+ - {{ include "vault.name" . }}-csi-provider-hmac-key
+ {{- end }}
+# 'create' permissions cannot be restricted by resource name:
+# https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-resources
+- apiGroups: [""]
+ resources: ["secrets"]
+ verbs: ["create"]
+{{- end }}
diff --git a/charts/vault/templates/csi-rolebinding.yaml b/charts/vault/templates/csi-rolebinding.yaml
new file mode 100644
index 0000000..3d3b981
--- /dev/null
+++ b/charts/vault/templates/csi-rolebinding.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-csi-provider-rolebinding
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: {{ template "vault.fullname" . }}-csi-provider-role
+subjects:
+- kind: ServiceAccount
+ name: {{ template "vault.fullname" . }}-csi-provider
+ namespace: {{ include "vault.namespace" . }}
+{{- end }}
diff --git a/charts/vault/templates/csi-serviceaccount.yaml b/charts/vault/templates/csi-serviceaccount.yaml
new file mode 100644
index 0000000..6327a7b
--- /dev/null
+++ b/charts/vault/templates/csi-serviceaccount.yaml
@@ -0,0 +1,21 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.csiEnabled" . -}}
+{{- if .csiEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ template "vault.fullname" . }}-csi-provider
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-csi-provider
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- if .Values.csi.serviceAccount.extraLabels -}}
+ {{- toYaml .Values.csi.serviceAccount.extraLabels | nindent 4 -}}
+ {{- end -}}
+ {{ template "csi.serviceAccount.annotations" . }}
+{{- end }}
diff --git a/charts/vault/templates/injector-certs-secret.yaml b/charts/vault/templates/injector-certs-secret.yaml
new file mode 100644
index 0000000..f6995af
--- /dev/null
+++ b/charts/vault/templates/injector-certs-secret.yaml
@@ -0,0 +1,19 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: vault-injector-certs
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/vault/templates/injector-clusterrole.yaml b/charts/vault/templates/injector-clusterrole.yaml
new file mode 100644
index 0000000..df603f2
--- /dev/null
+++ b/charts/vault/templates/injector-clusterrole.yaml
@@ -0,0 +1,30 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-clusterrole
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ["admissionregistration.k8s.io"]
+ resources: ["mutatingwebhookconfigurations"]
+ verbs:
+ - "get"
+ - "list"
+ - "watch"
+ - "patch"
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+- apiGroups: [""]
+ resources: ["nodes"]
+ verbs:
+ - "get"
+{{ end }}
+{{ end }}
diff --git a/charts/vault/templates/injector-clusterrolebinding.yaml b/charts/vault/templates/injector-clusterrolebinding.yaml
new file mode 100644
index 0000000..82cbce0
--- /dev/null
+++ b/charts/vault/templates/injector-clusterrolebinding.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-binding
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: {{ template "vault.fullname" . }}-agent-injector-clusterrole
+subjects:
+- kind: ServiceAccount
+ name: {{ template "vault.fullname" . }}-agent-injector
+ namespace: {{ include "vault.namespace" . }}
+{{ end }}
diff --git a/charts/vault/templates/injector-deployment.yaml b/charts/vault/templates/injector-deployment.yaml
new file mode 100644
index 0000000..822e8e4
--- /dev/null
+++ b/charts/vault/templates/injector-deployment.yaml
@@ -0,0 +1,179 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+# Deployment for the injector
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ component: webhook
+spec:
+ replicas: {{ .Values.injector.replicas }}
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: webhook
+ {{ template "injector.strategy" . }}
+ template:
+ metadata:
+ labels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: webhook
+ {{- if .Values.injector.extraLabels -}}
+ {{- toYaml .Values.injector.extraLabels | nindent 8 -}}
+ {{- end -}}
+ {{ template "injector.annotations" . }}
+ spec:
+ {{ template "injector.affinity" . }}
+ {{ template "injector.topologySpreadConstraints" . }}
+ {{ template "injector.tolerations" . }}
+ {{ template "injector.nodeselector" . }}
+ {{- if .Values.injector.priorityClassName }}
+ priorityClassName: {{ .Values.injector.priorityClassName }}
+ {{- end }}
+ serviceAccountName: "{{ template "vault.fullname" . }}-agent-injector"
+ {{ template "injector.securityContext.pod" . -}}
+ {{- if not .Values.global.openshift }}
+ hostNetwork: {{ .Values.injector.hostNetwork }}
+ {{- end }}
+ containers:
+ - name: sidecar-injector
+ {{ template "injector.resources" . }}
+ image: "{{ .Values.injector.image.repository }}:{{ .Values.injector.image.tag }}"
+ imagePullPolicy: "{{ .Values.injector.image.pullPolicy }}"
+ {{- template "injector.securityContext.container" . }}
+ env:
+ - name: AGENT_INJECT_LISTEN
+ value: {{ printf ":%v" .Values.injector.port }}
+ - name: AGENT_INJECT_LOG_LEVEL
+ value: {{ .Values.injector.logLevel | default "info" }}
+ - name: AGENT_INJECT_VAULT_ADDR
+ {{- if .Values.global.externalVaultAddr }}
+ value: "{{ .Values.global.externalVaultAddr }}"
+ {{- else if .Values.injector.externalVaultAddr }}
+ value: "{{ .Values.injector.externalVaultAddr }}"
+ {{- else }}
+ value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}
+ {{- end }}
+ - name: AGENT_INJECT_VAULT_AUTH_PATH
+ value: {{ .Values.injector.authPath }}
+ - name: AGENT_INJECT_VAULT_IMAGE
+ value: "{{ .Values.injector.agentImage.repository }}:{{ .Values.injector.agentImage.tag }}"
+ {{- if .Values.injector.certs.secretName }}
+ - name: AGENT_INJECT_TLS_CERT_FILE
+ value: "/etc/webhook/certs/{{ .Values.injector.certs.certName }}"
+ - name: AGENT_INJECT_TLS_KEY_FILE
+ value: "/etc/webhook/certs/{{ .Values.injector.certs.keyName }}"
+ {{- else }}
+ - name: AGENT_INJECT_TLS_AUTO
+ value: {{ template "vault.fullname" . }}-agent-injector-cfg
+ - name: AGENT_INJECT_TLS_AUTO_HOSTS
+ value: {{ template "vault.fullname" . }}-agent-injector-svc,{{ template "vault.fullname" . }}-agent-injector-svc.{{ include "vault.namespace" . }},{{ template "vault.fullname" . }}-agent-injector-svc.{{ include "vault.namespace" . }}.svc
+ {{- end }}
+ - name: AGENT_INJECT_LOG_FORMAT
+ value: {{ .Values.injector.logFormat | default "standard" }}
+ - name: AGENT_INJECT_REVOKE_ON_SHUTDOWN
+ value: "{{ .Values.injector.revokeOnShutdown | default false }}"
+ {{- if .Values.global.openshift }}
+ - name: AGENT_INJECT_SET_SECURITY_CONTEXT
+ value: "false"
+ {{- end }}
+ {{- if .Values.injector.metrics.enabled }}
+ - name: AGENT_INJECT_TELEMETRY_PATH
+ value: "/metrics"
+ {{- end }}
+ {{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+ - name: AGENT_INJECT_USE_LEADER_ELECTOR
+ value: "true"
+ - name: NAMESPACE
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.namespace
+ {{- end }}
+ - name: AGENT_INJECT_CPU_REQUEST
+ value: "{{ .Values.injector.agentDefaults.cpuRequest }}"
+ - name: AGENT_INJECT_CPU_LIMIT
+ value: "{{ .Values.injector.agentDefaults.cpuLimit }}"
+ - name: AGENT_INJECT_MEM_REQUEST
+ value: "{{ .Values.injector.agentDefaults.memRequest }}"
+ - name: AGENT_INJECT_MEM_LIMIT
+ value: "{{ .Values.injector.agentDefaults.memLimit }}"
+ {{- if .Values.injector.agentDefaults.ephemeralRequest }}
+ - name: AGENT_INJECT_EPHEMERAL_REQUEST
+ value: "{{ .Values.injector.agentDefaults.ephemeralRequest }}"
+ {{- end }}
+ {{- if .Values.injector.agentDefaults.ephemeralLimit }}
+ - name: AGENT_INJECT_EPHEMERAL_LIMIT
+ value: "{{ .Values.injector.agentDefaults.ephemeralLimit }}"
+ {{- end }}
+ - name: AGENT_INJECT_DEFAULT_TEMPLATE
+ value: "{{ .Values.injector.agentDefaults.template }}"
+ - name: AGENT_INJECT_TEMPLATE_CONFIG_EXIT_ON_RETRY_FAILURE
+ value: "{{ .Values.injector.agentDefaults.templateConfig.exitOnRetryFailure }}"
+ {{- if .Values.injector.agentDefaults.templateConfig.staticSecretRenderInterval }}
+ - name: AGENT_INJECT_TEMPLATE_STATIC_SECRET_RENDER_INTERVAL
+ value: "{{ .Values.injector.agentDefaults.templateConfig.staticSecretRenderInterval }}"
+ {{- end }}
+ {{- include "vault.extraEnvironmentVars" .Values.injector | nindent 12 }}
+ - name: POD_NAME
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.name
+ args:
+ - agent-inject
+ - 2>&1
+ livenessProbe:
+ httpGet:
+ path: /health/ready
+ port: {{ .Values.injector.port }}
+ scheme: HTTPS
+ failureThreshold: {{ .Values.injector.livenessProbe.failureThreshold }}
+ initialDelaySeconds: {{ .Values.injector.livenessProbe.initialDelaySeconds }}
+ periodSeconds: {{ .Values.injector.livenessProbe.periodSeconds }}
+ successThreshold: {{ .Values.injector.livenessProbe.successThreshold }}
+ timeoutSeconds: {{ .Values.injector.livenessProbe.timeoutSeconds }}
+ readinessProbe:
+ httpGet:
+ path: /health/ready
+ port: {{ .Values.injector.port }}
+ scheme: HTTPS
+ failureThreshold: {{ .Values.injector.readinessProbe.failureThreshold }}
+ initialDelaySeconds: {{ .Values.injector.readinessProbe.initialDelaySeconds }}
+ periodSeconds: {{ .Values.injector.readinessProbe.periodSeconds }}
+ successThreshold: {{ .Values.injector.readinessProbe.successThreshold }}
+ timeoutSeconds: {{ .Values.injector.readinessProbe.timeoutSeconds }}
+ startupProbe:
+ httpGet:
+ path: /health/ready
+ port: {{ .Values.injector.port }}
+ scheme: HTTPS
+ failureThreshold: {{ .Values.injector.startupProbe.failureThreshold }}
+ initialDelaySeconds: {{ .Values.injector.startupProbe.initialDelaySeconds }}
+ periodSeconds: {{ .Values.injector.startupProbe.periodSeconds }}
+ successThreshold: {{ .Values.injector.startupProbe.successThreshold }}
+ timeoutSeconds: {{ .Values.injector.startupProbe.timeoutSeconds }}
+{{- if .Values.injector.certs.secretName }}
+ volumeMounts:
+ - name: webhook-certs
+ mountPath: /etc/webhook/certs
+ readOnly: true
+{{- end }}
+{{- if .Values.injector.certs.secretName }}
+ volumes:
+ - name: webhook-certs
+ secret:
+ secretName: "{{ .Values.injector.certs.secretName }}"
+{{- end }}
+ {{- include "imagePullSecrets" . | nindent 6 }}
+{{ end }}
diff --git a/charts/vault/templates/injector-disruptionbudget.yaml b/charts/vault/templates/injector-disruptionbudget.yaml
new file mode 100644
index 0000000..2b2a61c
--- /dev/null
+++ b/charts/vault/templates/injector-disruptionbudget.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if .Values.injector.podDisruptionBudget }}
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ component: webhook
+spec:
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: webhook
+ {{- toYaml .Values.injector.podDisruptionBudget | nindent 2 }}
+{{- end -}}
diff --git a/charts/vault/templates/injector-mutating-webhook.yaml b/charts/vault/templates/injector-mutating-webhook.yaml
new file mode 100644
index 0000000..d0cafa6
--- /dev/null
+++ b/charts/vault/templates/injector-mutating-webhook.yaml
@@ -0,0 +1,45 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if .Capabilities.APIVersions.Has "admissionregistration.k8s.io/v1" }}
+apiVersion: admissionregistration.k8s.io/v1
+{{- else }}
+apiVersion: admissionregistration.k8s.io/v1beta1
+{{- end }}
+kind: MutatingWebhookConfiguration
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-cfg
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- template "injector.webhookAnnotations" . }}
+webhooks:
+ - name: vault.hashicorp.com
+ failurePolicy: {{ ((.Values.injector.webhook)).failurePolicy | default .Values.injector.failurePolicy }}
+ matchPolicy: {{ ((.Values.injector.webhook)).matchPolicy | default "Exact" }}
+ sideEffects: None
+ timeoutSeconds: {{ ((.Values.injector.webhook)).timeoutSeconds | default "30" }}
+ admissionReviewVersions: ["v1", "v1beta1"]
+ clientConfig:
+ service:
+ name: {{ template "vault.fullname" . }}-agent-injector-svc
+ namespace: {{ include "vault.namespace" . }}
+ path: "/mutate"
+ caBundle: {{ .Values.injector.certs.caBundle | quote }}
+ rules:
+ - operations: ["CREATE"]
+ apiGroups: [""]
+ apiVersions: ["v1"]
+ resources: ["pods"]
+ scope: "Namespaced"
+{{- if or (.Values.injector.namespaceSelector) (((.Values.injector.webhook)).namespaceSelector) }}
+ namespaceSelector:
+{{ toYaml (((.Values.injector.webhook)).namespaceSelector | default .Values.injector.namespaceSelector) | indent 6}}
+{{ end }}
+{{- template "injector.objectSelector" . -}}
+{{ end }}
diff --git a/charts/vault/templates/injector-network-policy.yaml b/charts/vault/templates/injector-network-policy.yaml
new file mode 100644
index 0000000..4c3b087
--- /dev/null
+++ b/charts/vault/templates/injector-network-policy.yaml
@@ -0,0 +1,29 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.openshift | toString) "true" }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector
+ labels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: webhook
+ ingress:
+ - from:
+ - namespaceSelector: {}
+ ports:
+ - port: 8080
+ protocol: TCP
+{{ end }}
+{{ end }}
diff --git a/charts/vault/templates/injector-psp-role.yaml b/charts/vault/templates/injector-psp-role.yaml
new file mode 100644
index 0000000..a07f8f6
--- /dev/null
+++ b/charts/vault/templates/injector-psp-role.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-psp
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ['policy']
+ resources: ['podsecuritypolicies']
+ verbs: ['use']
+ resourceNames:
+ - {{ template "vault.fullname" . }}-agent-injector
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/injector-psp-rolebinding.yaml b/charts/vault/templates/injector-psp-rolebinding.yaml
new file mode 100644
index 0000000..3c97e8d
--- /dev/null
+++ b/charts/vault/templates/injector-psp-rolebinding.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-psp
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ kind: Role
+ name: {{ template "vault.fullname" . }}-agent-injector-psp
+ apiGroup: rbac.authorization.k8s.io
+subjects:
+ - kind: ServiceAccount
+ name: {{ template "vault.fullname" . }}-agent-injector
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/vault/templates/injector-psp.yaml b/charts/vault/templates/injector-psp.yaml
new file mode 100644
index 0000000..0eca9a8
--- /dev/null
+++ b/charts/vault/templates/injector-psp.yaml
@@ -0,0 +1,51 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if eq (.Values.global.psp.enable | toString) "true" }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- template "vault.psp.annotations" . }}
+spec:
+ privileged: false
+ # Required to prevent escalations to root.
+ allowPrivilegeEscalation: false
+ volumes:
+ - configMap
+ - emptyDir
+ - projected
+ - secret
+ - downwardAPI
+ hostNetwork: false
+ hostIPC: false
+ hostPID: false
+ runAsUser:
+ # Require the container to run without root privileges.
+ rule: MustRunAsNonRoot
+ seLinux:
+ # This policy assumes the nodes are using AppArmor rather than SELinux.
+ rule: RunAsAny
+ supplementalGroups:
+ rule: MustRunAs
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ fsGroup:
+ rule: MustRunAs
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ readOnlyRootFilesystem: false
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/vault/templates/injector-role.yaml b/charts/vault/templates/injector-role.yaml
new file mode 100644
index 0000000..167f3a3
--- /dev/null
+++ b/charts/vault/templates/injector-role.yaml
@@ -0,0 +1,38 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-leader-elector-role
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+ - apiGroups: [""]
+ resources: ["secrets", "configmaps"]
+ verbs:
+ - "create"
+ - "get"
+ - "watch"
+ - "list"
+ - "update"
+ - apiGroups: [""]
+ resources: ["configmaps"]
+ verbs:
+ - "delete"
+ - apiGroups: [""]
+ resources: ["pods"]
+ verbs:
+ - "get"
+ - "patch"
+ - "delete"
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/injector-rolebinding.yaml b/charts/vault/templates/injector-rolebinding.yaml
new file mode 100644
index 0000000..6ad25ca
--- /dev/null
+++ b/charts/vault/templates/injector-rolebinding.yaml
@@ -0,0 +1,27 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+{{- if and (eq (.Values.injector.leaderElector.enabled | toString) "true") (gt (.Values.injector.replicas | int) 1) }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-leader-elector-binding
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: {{ template "vault.fullname" . }}-agent-injector-leader-elector-role
+subjects:
+ - kind: ServiceAccount
+ name: {{ template "vault.fullname" . }}-agent-injector
+ namespace: {{ include "vault.namespace" . }}
+{{- end }}
+{{- end }}
\ No newline at end of file
diff --git a/charts/vault/templates/injector-service.yaml b/charts/vault/templates/injector-service.yaml
new file mode 100644
index 0000000..1479cd1
--- /dev/null
+++ b/charts/vault/templates/injector-service.yaml
@@ -0,0 +1,27 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector-svc
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{ template "injector.service.annotations" . }}
+spec:
+ ports:
+ - name: https
+ port: 443
+ targetPort: {{ .Values.injector.port }}
+ selector:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: webhook
+{{- end }}
diff --git a/charts/vault/templates/injector-serviceaccount.yaml b/charts/vault/templates/injector-serviceaccount.yaml
new file mode 100644
index 0000000..2f91c3d
--- /dev/null
+++ b/charts/vault/templates/injector-serviceaccount.yaml
@@ -0,0 +1,18 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- template "vault.injectorEnabled" . -}}
+{{- if .injectorEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ template "vault.fullname" . }}-agent-injector
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{ template "injector.serviceAccount.annotations" . }}
+{{ end }}
diff --git a/charts/vault/templates/prometheus-prometheusrules.yaml b/charts/vault/templates/prometheus-prometheusrules.yaml
new file mode 100644
index 0000000..7e58a0e
--- /dev/null
+++ b/charts/vault/templates/prometheus-prometheusrules.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ if and (.Values.serverTelemetry.prometheusRules.rules)
+ (or (.Values.global.serverTelemetry.prometheusOperator) (.Values.serverTelemetry.prometheusRules.enabled) )
+}}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+ name: {{ template "vault.fullname" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- /* update the selectors docs in values.yaml whenever the defaults below change. */ -}}
+ {{- $selectors := .Values.serverTelemetry.prometheusRules.selectors }}
+ {{- if $selectors }}
+ {{- toYaml $selectors | nindent 4 }}
+ {{- else }}
+ release: prometheus
+ {{- end }}
+spec:
+ groups:
+ - name: {{ include "vault.fullname" . }}
+ rules:
+ {{- toYaml .Values.serverTelemetry.prometheusRules.rules | nindent 6 }}
+{{- end }}
diff --git a/charts/vault/templates/prometheus-servicemonitor.yaml b/charts/vault/templates/prometheus-servicemonitor.yaml
new file mode 100644
index 0000000..62d924a
--- /dev/null
+++ b/charts/vault/templates/prometheus-servicemonitor.yaml
@@ -0,0 +1,58 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{ if or (.Values.global.serverTelemetry.prometheusOperator) (.Values.serverTelemetry.serviceMonitor.enabled) }}
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+ name: {{ template "vault.fullname" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- /* update the selectors docs in values.yaml whenever the defaults below change. */ -}}
+ {{- $selectors := .Values.serverTelemetry.serviceMonitor.selectors }}
+ {{- if $selectors }}
+ {{- toYaml $selectors | nindent 4 }}
+ {{- else }}
+ release: prometheus
+ {{- end }}
+spec:
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ {{- if eq .mode "ha" }}
+ vault-active: "true"
+ {{- else }}
+ vault-internal: "true"
+ {{- end }}
+ endpoints:
+ - port: {{ include "vault.scheme" . }}
+ interval: {{ .Values.serverTelemetry.serviceMonitor.interval }}
+ scrapeTimeout: {{ .Values.serverTelemetry.serviceMonitor.scrapeTimeout }}
+ scheme: {{ include "vault.scheme" . | lower }}
+ path: /v1/sys/metrics
+ params:
+ format:
+ - prometheus
+ {{- with .Values.serverTelemetry.serviceMonitor.tlsConfig }}
+ tlsConfig:
+ {{- toYaml . | nindent 6 }}
+ {{- else }}
+ tlsConfig:
+ insecureSkipVerify: true
+ {{- end }}
+ {{- with .Values.serverTelemetry.serviceMonitor.authorization }}
+ authorization:
+ {{- toYaml . | nindent 6 }}
+ {{- end }}
+ namespaceSelector:
+ matchNames:
+ - {{ include "vault.namespace" . }}
+{{ end }}
diff --git a/charts/vault/templates/server-clusterrolebinding.yaml b/charts/vault/templates/server-clusterrolebinding.yaml
new file mode 100644
index 0000000..14ec838
--- /dev/null
+++ b/charts/vault/templates/server-clusterrolebinding.yaml
@@ -0,0 +1,29 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.serverAuthDelegator" . }}
+{{- if .serverAuthDelegator -}}
+{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: ClusterRoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-server-binding
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: ClusterRole
+ name: system:auth-delegator
+subjects:
+- kind: ServiceAccount
+ name: {{ template "vault.serviceAccount.name" . }}
+ namespace: {{ include "vault.namespace" . }}
+{{ end }}
\ No newline at end of file
diff --git a/charts/vault/templates/server-config-configmap.yaml b/charts/vault/templates/server-config-configmap.yaml
new file mode 100644
index 0000000..1fed2e6
--- /dev/null
+++ b/charts/vault/templates/server-config-configmap.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .serverEnabled -}}
+{{- if ne .mode "dev" -}}
+{{ if or (.Values.server.standalone.config) (.Values.server.ha.config) -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+ name: {{ template "vault.fullname" . }}-config
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- if .Values.server.includeConfigAnnotation }}
+ annotations:
+ vault.hashicorp.com/config-checksum: {{ include "vault.config" . | sha256sum }}
+{{- end }}
+data:
+ extraconfig-from-values.hcl: |-
+ {{ template "vault.config" . }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-discovery-role.yaml b/charts/vault/templates/server-discovery-role.yaml
new file mode 100644
index 0000000..0cbdefa
--- /dev/null
+++ b/charts/vault/templates/server-discovery-role.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ namespace: {{ include "vault.namespace" . }}
+ name: {{ template "vault.fullname" . }}-discovery-role
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: [""]
+ resources: ["pods"]
+ verbs: ["get", "watch", "list", "update", "patch"]
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/charts/vault/templates/server-discovery-rolebinding.yaml b/charts/vault/templates/server-discovery-rolebinding.yaml
new file mode 100644
index 0000000..87b0f61
--- /dev/null
+++ b/charts/vault/templates/server-discovery-rolebinding.yaml
@@ -0,0 +1,34 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.serviceAccount.serviceDiscovery.enabled | toString) "true" }}
+{{- if .Capabilities.APIVersions.Has "rbac.authorization.k8s.io/v1" -}}
+apiVersion: rbac.authorization.k8s.io/v1
+{{- else }}
+apiVersion: rbac.authorization.k8s.io/v1beta1
+{{- end }}
+kind: RoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-discovery-rolebinding
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ apiGroup: rbac.authorization.k8s.io
+ kind: Role
+ name: {{ template "vault.fullname" . }}-discovery-role
+subjects:
+- kind: ServiceAccount
+ name: {{ template "vault.serviceAccount.name" . }}
+ namespace: {{ include "vault.namespace" . }}
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/charts/vault/templates/server-disruptionbudget.yaml b/charts/vault/templates/server-disruptionbudget.yaml
new file mode 100644
index 0000000..bbe9eb2
--- /dev/null
+++ b/charts/vault/templates/server-disruptionbudget.yaml
@@ -0,0 +1,31 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" -}}
+{{- if .serverEnabled -}}
+{{- if and (eq .mode "ha") (eq (.Values.server.ha.disruptionBudget.enabled | toString) "true") -}}
+# PodDisruptionBudget to prevent degrading the server cluster through
+# voluntary cluster changes.
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+ name: {{ template "vault.fullname" . }}
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+spec:
+ maxUnavailable: {{ template "vault.pdb.maxUnavailable" . }}
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: server
+{{- end -}}
+{{- end -}}
+{{- end -}}
diff --git a/charts/vault/templates/server-ha-active-service.yaml b/charts/vault/templates/server-ha-active-service.yaml
new file mode 100644
index 0000000..9d2abfb
--- /dev/null
+++ b/charts/vault/templates/server-ha-active-service.yaml
@@ -0,0 +1,64 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.active.enabled | toString) "true" }}
+# Service for active Vault pod
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "vault.fullname" . }}-active
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ vault-active: "true"
+ annotations:
+{{- template "vault.service.active.annotations" . }}
+{{- template "vault.service.annotations" . }}
+spec:
+ {{- if .Values.server.service.type}}
+ type: {{ .Values.server.service.type }}
+ {{- end}}
+ {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+ {{- if .Values.server.service.ipFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.server.service.ipFamilies }}
+ ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.server.service.clusterIP }}
+ clusterIP: {{ .Values.server.service.clusterIP }}
+ {{- end }}
+ {{- include "service.externalTrafficPolicy" .Values.server.service }}
+ publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+ ports:
+ - name: {{ include "vault.scheme" . }}
+ port: {{ .Values.server.service.port }}
+ targetPort: {{ .Values.server.service.targetPort }}
+ {{- if and (.Values.server.service.activeNodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+ nodePort: {{ .Values.server.service.activeNodePort }}
+ {{- end }}
+ - name: https-internal
+ port: 8201
+ targetPort: 8201
+ selector:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ {{- end }}
+ component: server
+ vault-active: "true"
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-ha-standby-service.yaml b/charts/vault/templates/server-ha-standby-service.yaml
new file mode 100644
index 0000000..bae1e28
--- /dev/null
+++ b/charts/vault/templates/server-ha-standby-service.yaml
@@ -0,0 +1,63 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if eq .mode "ha" }}
+{{- if eq (.Values.server.service.standby.enabled | toString) "true" }}
+# Service for standby Vault pod
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "vault.fullname" . }}-standby
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ annotations:
+{{- template "vault.service.standby.annotations" . }}
+{{- template "vault.service.annotations" . }}
+spec:
+ {{- if .Values.server.service.type}}
+ type: {{ .Values.server.service.type }}
+ {{- end}}
+ {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+ {{- if .Values.server.service.ipFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.server.service.ipFamilies }}
+ ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.server.service.clusterIP }}
+ clusterIP: {{ .Values.server.service.clusterIP }}
+ {{- end }}
+ {{- include "service.externalTrafficPolicy" .Values.server.service }}
+ publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+ ports:
+ - name: {{ include "vault.scheme" . }}
+ port: {{ .Values.server.service.port }}
+ targetPort: {{ .Values.server.service.targetPort }}
+ {{- if and (.Values.server.service.standbyNodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+ nodePort: {{ .Values.server.service.standbyNodePort }}
+ {{- end }}
+ - name: https-internal
+ port: 8201
+ targetPort: 8201
+ selector:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ {{- end }}
+ component: server
+ vault-active: "false"
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-headless-service.yaml b/charts/vault/templates/server-headless-service.yaml
new file mode 100644
index 0000000..c0f4d34
--- /dev/null
+++ b/charts/vault/templates/server-headless-service.yaml
@@ -0,0 +1,47 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+# Service for Vault cluster
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "vault.fullname" . }}-internal
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ vault-internal: "true"
+ annotations:
+{{ template "vault.service.annotations" .}}
+spec:
+ {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+ {{- if .Values.server.service.ipFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.server.service.ipFamilies }}
+ ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ {{- end }}
+ clusterIP: None
+ publishNotReadyAddresses: true
+ ports:
+ - name: "{{ include "vault.scheme" . }}"
+ port: {{ .Values.server.service.port }}
+ targetPort: {{ .Values.server.service.targetPort }}
+ - name: https-internal
+ port: 8201
+ targetPort: 8201
+ selector:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: server
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-ingress.yaml b/charts/vault/templates/server-ingress.yaml
new file mode 100644
index 0000000..d796bae
--- /dev/null
+++ b/charts/vault/templates/server-ingress.yaml
@@ -0,0 +1,69 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if not .Values.global.openshift }}
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.ingress.enabled -}}
+{{- $extraPaths := .Values.server.ingress.extraPaths -}}
+{{- $serviceName := include "vault.fullname" . -}}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.ingress.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+{{- $servicePort := .Values.server.service.port -}}
+{{- $pathType := .Values.server.ingress.pathType -}}
+{{- $kubeVersion := .Capabilities.KubeVersion.Version }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+ name: {{ template "vault.fullname" . }}
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- with .Values.server.ingress.labels }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ {{- template "vault.ingress.annotations" . }}
+spec:
+{{- if .Values.server.ingress.tls }}
+ tls:
+ {{- range .Values.server.ingress.tls }}
+ - hosts:
+ {{- range .hosts }}
+ - {{ . | quote }}
+ {{- end }}
+ secretName: {{ .secretName }}
+ {{- end }}
+{{- end }}
+{{- if .Values.server.ingress.ingressClassName }}
+ ingressClassName: {{ .Values.server.ingress.ingressClassName }}
+{{- end }}
+ rules:
+ {{- range .Values.server.ingress.hosts }}
+ - host: {{ .host | quote }}
+ http:
+ paths:
+{{ if $extraPaths }}
+{{ toYaml $extraPaths | indent 10 }}
+{{- end }}
+ {{- range (.paths | default (list "/")) }}
+ - path: {{ . }}
+ pathType: {{ $pathType }}
+ backend:
+ service:
+ name: {{ $serviceName }}
+ port:
+ number: {{ $servicePort }}
+ {{- end }}
+ {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-network-policy.yaml b/charts/vault/templates/server-network-policy.yaml
new file mode 100644
index 0000000..43dcdb1
--- /dev/null
+++ b/charts/vault/templates/server-network-policy.yaml
@@ -0,0 +1,24 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if eq (.Values.server.networkPolicy.enabled | toString) "true" }}
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+ name: {{ template "vault.fullname" . }}
+ labels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+spec:
+ podSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ ingress: {{- toYaml .Values.server.networkPolicy.ingress | nindent 4 }}
+ {{- if .Values.server.networkPolicy.egress }}
+ egress:
+ {{- toYaml .Values.server.networkPolicy.egress | nindent 4 }}
+ {{ end }}
+{{ end }}
diff --git a/charts/vault/templates/server-psp-role.yaml b/charts/vault/templates/server-psp-role.yaml
new file mode 100644
index 0000000..64cd6c5
--- /dev/null
+++ b/charts/vault/templates/server-psp-role.yaml
@@ -0,0 +1,25 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+ name: {{ template "vault.fullname" . }}-psp
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+rules:
+- apiGroups: ['policy']
+ resources: ['podsecuritypolicies']
+ verbs: ['use']
+ resourceNames:
+ - {{ template "vault.fullname" . }}
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-psp-rolebinding.yaml b/charts/vault/templates/server-psp-rolebinding.yaml
new file mode 100644
index 0000000..342f553
--- /dev/null
+++ b/charts/vault/templates/server-psp-rolebinding.yaml
@@ -0,0 +1,26 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+ name: {{ template "vault.fullname" . }}-psp
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+roleRef:
+ kind: Role
+ name: {{ template "vault.fullname" . }}-psp
+ apiGroup: rbac.authorization.k8s.io
+subjects:
+ - kind: ServiceAccount
+ name: {{ template "vault.fullname" . }}
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-psp.yaml b/charts/vault/templates/server-psp.yaml
new file mode 100644
index 0000000..567e662
--- /dev/null
+++ b/charts/vault/templates/server-psp.yaml
@@ -0,0 +1,54 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if .serverEnabled -}}
+{{- if and (ne .mode "") (eq (.Values.global.psp.enable | toString) "true") }}
+apiVersion: policy/v1beta1
+kind: PodSecurityPolicy
+metadata:
+ name: {{ template "vault.fullname" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- template "vault.psp.annotations" . }}
+spec:
+ privileged: false
+ # Required to prevent escalations to root.
+ allowPrivilegeEscalation: false
+ volumes:
+ - configMap
+ - emptyDir
+ - projected
+ - secret
+ - downwardAPI
+ {{- if eq (.Values.server.dataStorage.enabled | toString) "true" }}
+ - persistentVolumeClaim
+ {{- end }}
+ hostNetwork: false
+ hostIPC: false
+ hostPID: false
+ runAsUser:
+ # Require the container to run without root privileges.
+ rule: MustRunAsNonRoot
+ seLinux:
+ # This policy assumes the nodes are using AppArmor rather than SELinux.
+ rule: RunAsAny
+ supplementalGroups:
+ rule: MustRunAs
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ fsGroup:
+ rule: MustRunAs
+ ranges:
+ # Forbid adding the root group.
+ - min: 1
+ max: 65535
+ readOnlyRootFilesystem: false
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-route.yaml b/charts/vault/templates/server-route.yaml
new file mode 100644
index 0000000..4e95555
--- /dev/null
+++ b/charts/vault/templates/server-route.yaml
@@ -0,0 +1,39 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{- if .Values.global.openshift }}
+{{- if ne .mode "external" }}
+{{- if .Values.server.route.enabled -}}
+{{- $serviceName := include "vault.fullname" . -}}
+{{- if and (eq .mode "ha" ) (eq (.Values.server.route.activeService | toString) "true") }}
+{{- $serviceName = printf "%s-%s" $serviceName "active" -}}
+{{- end }}
+kind: Route
+apiVersion: route.openshift.io/v1
+metadata:
+ name: {{ template "vault.fullname" . }}
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- with .Values.server.route.labels }}
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+ {{- template "vault.route.annotations" . }}
+spec:
+ host: {{ .Values.server.route.host }}
+ to:
+ kind: Service
+ name: {{ $serviceName }}
+ weight: 100
+ port:
+ targetPort: 8200
+ tls:
+ {{- toYaml .Values.server.route.tls | nindent 4 }}
+{{- end }}
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-service.yaml b/charts/vault/templates/server-service.yaml
new file mode 100644
index 0000000..c12e190
--- /dev/null
+++ b/charts/vault/templates/server-service.yaml
@@ -0,0 +1,59 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.serverServiceEnabled" . -}}
+{{- if .serverServiceEnabled -}}
+# Service for Vault cluster
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "vault.fullname" . }}
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ annotations:
+{{ template "vault.service.annotations" .}}
+spec:
+ {{- if .Values.server.service.type}}
+ type: {{ .Values.server.service.type }}
+ {{- end}}
+ {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+ {{- if .Values.server.service.ipFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.server.service.ipFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.server.service.ipFamilies }}
+ ipFamilies: {{ .Values.server.service.ipFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.server.service.clusterIP }}
+ clusterIP: {{ .Values.server.service.clusterIP }}
+ {{- end }}
+ {{- include "service.externalTrafficPolicy" .Values.server.service }}
+ # We want the servers to become available even if they're not ready
+ # since this DNS is also used for join operations.
+ publishNotReadyAddresses: {{ .Values.server.service.publishNotReadyAddresses }}
+ ports:
+ - name: {{ include "vault.scheme" . }}
+ port: {{ .Values.server.service.port }}
+ targetPort: {{ .Values.server.service.targetPort }}
+ {{- if and (.Values.server.service.nodePort) (eq (.Values.server.service.type | toString) "NodePort") }}
+ nodePort: {{ .Values.server.service.nodePort }}
+ {{- end }}
+ - name: https-internal
+ port: 8201
+ targetPort: 8201
+ selector:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ {{- if eq (.Values.server.service.instanceSelector.enabled | toString) "true" }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ {{- end }}
+ component: server
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/server-serviceaccount-secret.yaml b/charts/vault/templates/server-serviceaccount-secret.yaml
new file mode 100644
index 0000000..74d70f9
--- /dev/null
+++ b/charts/vault/templates/server-serviceaccount-secret.yaml
@@ -0,0 +1,21 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.serverServiceAccountSecretCreationEnabled" . }}
+{{- if .serverServiceAccountSecretCreationEnabled -}}
+apiVersion: v1
+kind: Secret
+metadata:
+ name: {{ template "vault.serviceAccount.name" . }}-token
+ namespace: {{ include "vault.namespace" . }}
+ annotations:
+ kubernetes.io/service-account.name: {{ template "vault.serviceAccount.name" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+type: kubernetes.io/service-account-token
+{{ end }}
\ No newline at end of file
diff --git a/charts/vault/templates/server-serviceaccount.yaml b/charts/vault/templates/server-serviceaccount.yaml
new file mode 100644
index 0000000..216ea61
--- /dev/null
+++ b/charts/vault/templates/server-serviceaccount.yaml
@@ -0,0 +1,22 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.serverServiceAccountEnabled" . }}
+{{- if .serverServiceAccountEnabled -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+ name: {{ template "vault.serviceAccount.name" . }}
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- if .Values.server.serviceAccount.extraLabels -}}
+ {{- toYaml .Values.server.serviceAccount.extraLabels | nindent 4 -}}
+ {{- end -}}
+ {{ template "vault.serviceAccount.annotations" . }}
+{{ end }}
diff --git a/charts/vault/templates/server-statefulset.yaml b/charts/vault/templates/server-statefulset.yaml
new file mode 100644
index 0000000..7e5810c
--- /dev/null
+++ b/charts/vault/templates/server-statefulset.yaml
@@ -0,0 +1,240 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if ne .mode "" }}
+{{- if .serverEnabled -}}
+# StatefulSet to run the actual vault server cluster.
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+ name: {{ template "vault.fullname" . }}
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- template "vault.statefulSet.annotations" . }}
+spec:
+ serviceName: {{ template "vault.fullname" . }}-internal
+ podManagementPolicy: Parallel
+ replicas: {{ template "vault.replicas" . }}
+ updateStrategy:
+ type: {{ .Values.server.updateStrategyType }}
+ {{- if and (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) (.Values.server.persistentVolumeClaimRetentionPolicy) }}
+ persistentVolumeClaimRetentionPolicy: {{ toYaml .Values.server.persistentVolumeClaimRetentionPolicy | nindent 4 }}
+ {{- end }}
+ selector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: server
+ template:
+ metadata:
+ labels:
+ helm.sh/chart: {{ template "vault.chart" . }}
+ app.kubernetes.io/name: {{ template "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: server
+ {{- if .Values.server.extraLabels -}}
+ {{- toYaml .Values.server.extraLabels | nindent 8 -}}
+ {{- end -}}
+ {{ template "vault.annotations" . }}
+ spec:
+ {{ template "vault.affinity" . }}
+ {{ template "vault.topologySpreadConstraints" . }}
+ {{ template "vault.tolerations" . }}
+ {{ template "vault.nodeselector" . }}
+ {{- if .Values.server.priorityClassName }}
+ priorityClassName: {{ .Values.server.priorityClassName }}
+ {{- end }}
+ terminationGracePeriodSeconds: {{ .Values.server.terminationGracePeriodSeconds }}
+ serviceAccountName: {{ template "vault.serviceAccount.name" . }}
+ {{ if .Values.server.shareProcessNamespace }}
+ shareProcessNamespace: true
+ {{ end }}
+ {{- template "server.statefulSet.securityContext.pod" . }}
+ {{- if not .Values.global.openshift }}
+ hostNetwork: {{ .Values.server.hostNetwork }}
+ {{- end }}
+ volumes:
+ {{ template "vault.volumes" . }}
+ - name: home
+ emptyDir: {}
+ {{- if .Values.server.hostAliases }}
+ hostAliases:
+ {{ toYaml .Values.server.hostAliases | nindent 8}}
+ {{- end }}
+ {{- if .Values.server.extraInitContainers }}
+ initContainers:
+ {{ toYaml .Values.server.extraInitContainers | nindent 8}}
+ {{- end }}
+ containers:
+ - name: vault
+ {{ template "vault.resources" . }}
+ image: {{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default "latest" }}
+ imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+ command:
+ - "/bin/sh"
+ - "-ec"
+ args: {{ template "vault.args" . }}
+ {{- template "server.statefulSet.securityContext.container" . }}
+ env:
+ - name: HOST_IP
+ valueFrom:
+ fieldRef:
+ fieldPath: status.hostIP
+ - name: POD_IP
+ valueFrom:
+ fieldRef:
+ fieldPath: status.podIP
+ - name: VAULT_K8S_POD_NAME
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.name
+ - name: VAULT_K8S_NAMESPACE
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.namespace
+ - name: VAULT_ADDR
+ value: "{{ include "vault.scheme" . }}://127.0.0.1:8200"
+ - name: VAULT_API_ADDR
+ {{- if .Values.server.ha.apiAddr }}
+ value: {{ .Values.server.ha.apiAddr }}
+ {{- else }}
+ value: "{{ include "vault.scheme" . }}://$(POD_IP):8200"
+ {{- end }}
+ - name: SKIP_CHOWN
+ value: "true"
+ - name: SKIP_SETCAP
+ value: "true"
+ - name: HOSTNAME
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.name
+ - name: VAULT_CLUSTER_ADDR
+ {{- if .Values.server.ha.clusterAddr }}
+ value: {{ .Values.server.ha.clusterAddr | quote }}
+ {{- else }}
+ value: "https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201"
+ {{- end }}
+ {{- if and (eq (.Values.server.ha.raft.enabled | toString) "true") (eq (.Values.server.ha.raft.setNodeId | toString) "true") }}
+ - name: VAULT_RAFT_NODE_ID
+ valueFrom:
+ fieldRef:
+ fieldPath: metadata.name
+ {{- end }}
+ - name: HOME
+ value: "/home/vault"
+ {{- if .Values.server.logLevel }}
+ - name: VAULT_LOG_LEVEL
+ value: "{{ .Values.server.logLevel }}"
+ {{- end }}
+ {{- if .Values.server.logFormat }}
+ - name: VAULT_LOG_FORMAT
+ value: "{{ .Values.server.logFormat }}"
+ {{- end }}
+ {{- if (and .Values.server.enterpriseLicense.secretName .Values.server.enterpriseLicense.secretKey) }}
+ - name: VAULT_LICENSE_PATH
+ value: /vault/license/{{ .Values.server.enterpriseLicense.secretKey }}
+ {{- end }}
+ {{ template "vault.envs" . }}
+ {{- include "vault.extraEnvironmentVars" .Values.server | nindent 12 }}
+ {{- include "vault.extraSecretEnvironmentVars" .Values.server | nindent 12 }}
+ volumeMounts:
+ {{ template "vault.mounts" . }}
+ - name: home
+ mountPath: /home/vault
+ ports:
+ - containerPort: 8200
+ name: {{ include "vault.scheme" . }}
+ - containerPort: 8201
+ name: https-internal
+ - containerPort: 8202
+ name: {{ include "vault.scheme" . }}-rep
+ {{- if .Values.server.extraPorts -}}
+ {{ toYaml .Values.server.extraPorts | nindent 12}}
+ {{- end }}
+ {{- if .Values.server.readinessProbe.enabled }}
+ readinessProbe:
+ {{- if .Values.server.readinessProbe.path }}
+ httpGet:
+ path: {{ .Values.server.readinessProbe.path | quote }}
+ port: {{ .Values.server.readinessProbe.port }}
+ scheme: {{ include "vault.scheme" . | upper }}
+ {{- else }}
+ # Check status; unsealed vault servers return 0
+ # The exit code reflects the seal status:
+ # 0 - unsealed
+ # 1 - error
+ # 2 - sealed
+ exec:
+ command: ["/bin/sh", "-ec", "vault status -tls-skip-verify"]
+ {{- end }}
+ failureThreshold: {{ .Values.server.readinessProbe.failureThreshold }}
+ initialDelaySeconds: {{ .Values.server.readinessProbe.initialDelaySeconds }}
+ periodSeconds: {{ .Values.server.readinessProbe.periodSeconds }}
+ successThreshold: {{ .Values.server.readinessProbe.successThreshold }}
+ timeoutSeconds: {{ .Values.server.readinessProbe.timeoutSeconds }}
+ {{- end }}
+ {{- if .Values.server.livenessProbe.enabled }}
+ livenessProbe:
+ {{- if .Values.server.livenessProbe.execCommand }}
+ exec:
+ command:
+ {{- range (.Values.server.livenessProbe.execCommand) }}
+ - {{ . | quote }}
+ {{- end }}
+ {{- else }}
+ httpGet:
+ path: {{ .Values.server.livenessProbe.path | quote }}
+ port: {{ .Values.server.livenessProbe.port }}
+ scheme: {{ include "vault.scheme" . | upper }}
+ {{- end }}
+ failureThreshold: {{ .Values.server.livenessProbe.failureThreshold }}
+ initialDelaySeconds: {{ .Values.server.livenessProbe.initialDelaySeconds }}
+ periodSeconds: {{ .Values.server.livenessProbe.periodSeconds }}
+ successThreshold: {{ .Values.server.livenessProbe.successThreshold }}
+ timeoutSeconds: {{ .Values.server.livenessProbe.timeoutSeconds }}
+ {{- end }}
+ lifecycle:
+ # Vault container doesn't receive SIGTERM from Kubernetes
+ # and after the grace period ends, Kube sends SIGKILL. This
+ # causes issues with graceful shutdowns such as deregistering itself
+ # from Consul (zombie services).
+ preStop:
+ {{- if .Values.server.preStop }}
+ exec:
+ command:
+ {{- range (.Values.server.preStop) }}
+ - {{ . | quote }}
+ {{- end }}
+ {{- else }}
+ exec:
+ command:
+ - "/bin/sh"
+ - "-c"
+ # Adding a sleep here to give the pod eviction a
+ # chance to propagate, so requests will not be made
+ # to this pod while it's terminating
+ - "sleep {{ .Values.server.preStopSleepSeconds }} && kill -SIGTERM $(pidof vault)"
+ {{- end}}
+ {{- if .Values.server.postStart }}
+ postStart:
+ exec:
+ command:
+ {{- range (.Values.server.postStart) }}
+ - {{ . | quote }}
+ {{- end }}
+ {{- end }}
+ {{- if .Values.server.extraContainers }}
+ {{ toYaml .Values.server.extraContainers | nindent 8}}
+ {{- end }}
+ {{- include "imagePullSecrets" . | nindent 6 }}
+ {{ template "vault.volumeclaims" . }}
+{{ end }}
+{{ end }}
+{{ end }}
diff --git a/charts/vault/templates/tests/server-test.yaml b/charts/vault/templates/tests/server-test.yaml
new file mode 100644
index 0000000..065415f
--- /dev/null
+++ b/charts/vault/templates/tests/server-test.yaml
@@ -0,0 +1,60 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- if .serverEnabled -}}
+apiVersion: v1
+kind: Pod
+metadata:
+ name: {{ template "vault.fullname" . }}-server-test
+ namespace: {{ include "vault.namespace" . }}
+ annotations:
+ "helm.sh/hook": test
+ {{- with .Values.server.extraLabels }}
+ labels:
+ {{- toYaml . | nindent 4 }}
+ {{- end }}
+spec:
+ {{- include "imagePullSecrets" . | nindent 2 }}
+ containers:
+ - name: {{ .Release.Name }}-server-test
+ image: {{ .Values.server.image.repository }}:{{ .Values.server.image.tag | default "latest" }}
+ imagePullPolicy: {{ .Values.server.image.pullPolicy }}
+ env:
+ - name: VAULT_ADDR
+ value: {{ include "vault.scheme" . }}://{{ template "vault.fullname" . }}.{{ include "vault.namespace" . }}.svc:{{ .Values.server.service.port }}
+ {{- include "vault.extraEnvironmentVars" .Values.server | nindent 8 }}
+ command:
+ - /bin/sh
+ - -c
+ - |
+ echo "Checking for sealed info in 'vault status' output"
+ ATTEMPTS=10
+ n=0
+ until [ "$n" -ge $ATTEMPTS ]
+ do
+ echo "Attempt" $n...
+ vault status -format yaml | grep -E '^sealed: (true|false)' && break
+ n=$((n+1))
+ sleep 5
+ done
+ if [ $n -ge $ATTEMPTS ]; then
+ echo "timed out looking for sealed info in 'vault status' output"
+ exit 1
+ fi
+
+ exit 0
+ {{- if .Values.server.volumeMounts }}
+ volumeMounts:
+ {{- toYaml .Values.server.volumeMounts | nindent 8}}
+ {{- end }}
+ {{- if .Values.server.volumes }}
+ volumes:
+ {{- toYaml .Values.server.volumes | nindent 4}}
+ {{- end }}
+ restartPolicy: Never
+{{- end }}
+{{- end }}
diff --git a/charts/vault/templates/ui-service.yaml b/charts/vault/templates/ui-service.yaml
new file mode 100644
index 0000000..9537084
--- /dev/null
+++ b/charts/vault/templates/ui-service.yaml
@@ -0,0 +1,50 @@
+{{/*
+Copyright (c) HashiCorp, Inc.
+SPDX-License-Identifier: MPL-2.0
+*/}}
+
+{{ template "vault.mode" . }}
+{{- if ne .mode "external" }}
+{{- template "vault.uiEnabled" . -}}
+{{- if .uiEnabled -}}
+
+apiVersion: v1
+kind: Service
+metadata:
+ name: {{ template "vault.fullname" . }}-ui
+ namespace: {{ include "vault.namespace" . }}
+ labels:
+ helm.sh/chart: {{ include "vault.chart" . }}
+ app.kubernetes.io/name: {{ include "vault.name" . }}-ui
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ app.kubernetes.io/managed-by: {{ .Release.Service }}
+ {{- template "vault.ui.annotations" . }}
+spec:
+ {{- if (semverCompare ">= 1.23-0" .Capabilities.KubeVersion.Version) }}
+ {{- if .Values.ui.serviceIPFamilyPolicy }}
+ ipFamilyPolicy: {{ .Values.ui.serviceIPFamilyPolicy }}
+ {{- end }}
+ {{- if .Values.ui.serviceIPFamilies }}
+ ipFamilies: {{ .Values.ui.serviceIPFamilies | toYaml | nindent 2 }}
+ {{- end }}
+ {{- end }}
+ selector:
+ app.kubernetes.io/name: {{ include "vault.name" . }}
+ app.kubernetes.io/instance: {{ .Release.Name }}
+ component: server
+ {{- if and (.Values.ui.activeVaultPodOnly) (eq .mode "ha") }}
+ vault-active: "true"
+ {{- end }}
+ publishNotReadyAddresses: {{ .Values.ui.publishNotReadyAddresses }}
+ ports:
+ - name: {{ include "vault.scheme" . }}
+ port: {{ .Values.ui.externalPort }}
+ targetPort: {{ .Values.ui.targetPort }}
+ {{- if .Values.ui.serviceNodePort }}
+ nodePort: {{ .Values.ui.serviceNodePort }}
+ {{- end }}
+ type: {{ .Values.ui.serviceType }}
+ {{- include "service.externalTrafficPolicy" .Values.ui }}
+ {{- include "service.loadBalancer" .Values.ui }}
+{{- end -}}
+{{- end }}
diff --git a/charts/vault/values.openshift.yaml b/charts/vault/values.openshift.yaml
new file mode 100644
index 0000000..1956020
--- /dev/null
+++ b/charts/vault/values.openshift.yaml
@@ -0,0 +1,24 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# These overrides are appropriate defaults for deploying this chart on OpenShift
+
+global:
+ openshift: true
+
+injector:
+ image:
+ repository: "registry.connect.redhat.com/hashicorp/vault-k8s"
+ tag: "1.6.2-ubi"
+
+ agentImage:
+ repository: "registry.connect.redhat.com/hashicorp/vault"
+ tag: "1.19.0-ubi"
+
+server:
+ image:
+ repository: "registry.connect.redhat.com/hashicorp/vault"
+ tag: "1.19.0-ubi"
+
+ readinessProbe:
+ path: "/v1/sys/health?uninitcode=204"
diff --git a/charts/vault/values.schema.json b/charts/vault/values.schema.json
new file mode 100644
index 0000000..34506f9
--- /dev/null
+++ b/charts/vault/values.schema.json
@@ -0,0 +1,1315 @@
+{
+ "$schema": "http://json-schema.org/schema#",
+ "type": "object",
+ "properties": {
+ "csi": {
+ "type": "object",
+ "properties": {
+ "agent": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "extraArgs": {
+ "type": "array"
+ },
+ "image": {
+ "type": "object",
+ "properties": {
+ "pullPolicy": {
+ "type": "string"
+ },
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ }
+ },
+ "logFormat": {
+ "type": "string"
+ },
+ "logLevel": {
+ "type": "string"
+ },
+ "resources": {
+ "type": "object"
+ }
+ }
+ },
+ "daemonSet": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "extraLabels": {
+ "type": "object"
+ },
+ "kubeletRootDir": {
+ "type": "string"
+ },
+ "providersDir": {
+ "type": "string"
+ },
+ "securityContext": {
+ "type": "object",
+ "properties": {
+ "container": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "pod": {
+ "type": [
+ "object",
+ "string"
+ ]
+ }
+ }
+ },
+ "updateStrategy": {
+ "type": "object",
+ "properties": {
+ "maxUnavailable": {
+ "type": "string"
+ },
+ "type": {
+ "type": "string"
+ }
+ }
+ }
+ }
+ },
+ "debug": {
+ "type": "boolean"
+ },
+ "enabled": {
+ "type": [
+ "boolean",
+ "string"
+ ]
+ },
+ "extraArgs": {
+ "type": "array"
+ },
+ "hmacSecretName": {
+ "type": "string"
+ },
+ "hostNetwork": {
+ "type": "boolean"
+ },
+ "image": {
+ "type": "object",
+ "properties": {
+ "pullPolicy": {
+ "type": "string"
+ },
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ }
+ },
+ "livenessProbe": {
+ "type": "object",
+ "properties": {
+ "failureThreshold": {
+ "type": "integer"
+ },
+ "initialDelaySeconds": {
+ "type": "integer"
+ },
+ "periodSeconds": {
+ "type": "integer"
+ },
+ "successThreshold": {
+ "type": "integer"
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "logLevel": {
+ "type": "string"
+ },
+ "pod": {
+ "type": "object",
+ "properties": {
+ "affinity": {
+ "type": [
+ "null",
+ "object",
+ "string"
+ ]
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "extraLabels": {
+ "type": "object"
+ },
+ "nodeSelector": {
+ "type": [
+ "null",
+ "object",
+ "string"
+ ]
+ },
+ "tolerations": {
+ "type": [
+ "null",
+ "array",
+ "string"
+ ]
+ }
+ }
+ },
+ "priorityClassName": {
+ "type": "string"
+ },
+ "readinessProbe": {
+ "type": "object",
+ "properties": {
+ "failureThreshold": {
+ "type": "integer"
+ },
+ "initialDelaySeconds": {
+ "type": "integer"
+ },
+ "periodSeconds": {
+ "type": "integer"
+ },
+ "successThreshold": {
+ "type": "integer"
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "resources": {
+ "type": "object"
+ },
+ "serviceAccount": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "extraLabels": {
+ "type": "object"
+ }
+ }
+ },
+ "volumeMounts": {
+ "type": [
+ "null",
+ "array"
+ ]
+ },
+ "volumes": {
+ "type": [
+ "null",
+ "array"
+ ]
+ }
+ }
+ },
+ "global": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "externalVaultAddr": {
+ "type": "string"
+ },
+ "imagePullSecrets": {
+ "type": "array"
+ },
+ "namespace": {
+ "type": "string"
+ },
+ "openshift": {
+ "type": "boolean"
+ },
+ "psp": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enable": {
+ "type": "boolean"
+ }
+ }
+ },
+ "serverTelemetry": {
+ "type": "object",
+ "properties": {
+ "prometheusOperator": {
+ "type": "boolean"
+ }
+ }
+ },
+ "tlsDisable": {
+ "type": "boolean"
+ }
+ }
+ },
+ "injector": {
+ "type": "object",
+ "properties": {
+ "affinity": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "agentDefaults": {
+ "type": "object",
+ "properties": {
+ "cpuLimit": {
+ "type": "string"
+ },
+ "cpuRequest": {
+ "type": "string"
+ },
+ "memLimit": {
+ "type": "string"
+ },
+ "memRequest": {
+ "type": "string"
+ },
+ "ephemeralLimit": {
+ "type": "string"
+ },
+ "ephemeralRequest": {
+ "type": "string"
+ },
+ "template": {
+ "type": "string"
+ },
+ "templateConfig": {
+ "type": "object",
+ "properties": {
+ "exitOnRetryFailure": {
+ "type": "boolean"
+ },
+ "staticSecretRenderInterval": {
+ "type": "string"
+ }
+ }
+ }
+ }
+ },
+ "agentImage": {
+ "type": "object",
+ "properties": {
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ }
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "authPath": {
+ "type": "string"
+ },
+ "certs": {
+ "type": "object",
+ "properties": {
+ "caBundle": {
+ "type": "string"
+ },
+ "certName": {
+ "type": "string"
+ },
+ "keyName": {
+ "type": "string"
+ },
+ "secretName": {
+ "type": [
+ "null",
+ "string"
+ ]
+ }
+ }
+ },
+ "enabled": {
+ "type": [
+ "boolean",
+ "string"
+ ]
+ },
+ "externalVaultAddr": {
+ "type": "string"
+ },
+ "extraEnvironmentVars": {
+ "type": "object"
+ },
+ "extraLabels": {
+ "type": "object"
+ },
+ "failurePolicy": {
+ "type": "string"
+ },
+ "hostNetwork": {
+ "type": "boolean"
+ },
+ "image": {
+ "type": "object",
+ "properties": {
+ "pullPolicy": {
+ "type": "string"
+ },
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ }
+ },
+ "leaderElector": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ },
+ "livenessProbe": {
+ "type": "object",
+ "properties": {
+ "failureThreshold": {
+ "type": "integer"
+ },
+ "initialDelaySeconds": {
+ "type": "integer"
+ },
+ "periodSeconds": {
+ "type": "integer"
+ },
+ "successThreshold": {
+ "type": "integer"
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "logFormat": {
+ "type": "string"
+ },
+ "logLevel": {
+ "type": "string"
+ },
+ "metrics": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ },
+ "namespaceSelector": {
+ "type": "object"
+ },
+ "nodeSelector": {
+ "type": [
+ "null",
+ "object",
+ "string"
+ ]
+ },
+ "objectSelector": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "podDisruptionBudget": {
+ "type": "object"
+ },
+ "port": {
+ "type": "integer"
+ },
+ "priorityClassName": {
+ "type": "string"
+ },
+ "readinessProbe": {
+ "type": "object",
+ "properties": {
+ "failureThreshold": {
+ "type": "integer"
+ },
+ "initialDelaySeconds": {
+ "type": "integer"
+ },
+ "periodSeconds": {
+ "type": "integer"
+ },
+ "successThreshold": {
+ "type": "integer"
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "replicas": {
+ "type": "integer"
+ },
+ "resources": {
+ "type": "object"
+ },
+ "revokeOnShutdown": {
+ "type": "boolean"
+ },
+ "securityContext": {
+ "type": "object",
+ "properties": {
+ "container": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "pod": {
+ "type": [
+ "object",
+ "string"
+ ]
+ }
+ }
+ },
+ "service": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ }
+ }
+ },
+ "serviceAccount": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ }
+ }
+ },
+ "startupProbe": {
+ "type": "object",
+ "properties": {
+ "failureThreshold": {
+ "type": "integer"
+ },
+ "initialDelaySeconds": {
+ "type": "integer"
+ },
+ "periodSeconds": {
+ "type": "integer"
+ },
+ "successThreshold": {
+ "type": "integer"
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "strategy": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "tolerations": {
+ "type": [
+ "null",
+ "array",
+ "string"
+ ]
+ },
+ "topologySpreadConstraints": {
+ "type": [
+ "null",
+ "array",
+ "string"
+ ]
+ },
+ "webhook": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "failurePolicy": {
+ "type": "string"
+ },
+ "matchPolicy": {
+ "type": "string"
+ },
+ "namespaceSelector": {
+ "type": "object"
+ },
+ "objectSelector": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "webhookAnnotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ }
+ }
+ },
+ "server": {
+ "type": "object",
+ "properties": {
+ "affinity": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "auditStorage": {
+ "type": "object",
+ "properties": {
+ "accessMode": {
+ "type": "string"
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": [
+ "boolean",
+ "string"
+ ]
+ },
+ "labels": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "mountPath": {
+ "type": "string"
+ },
+ "size": {
+ "type": "string"
+ },
+ "storageClass": {
+ "type": [
+ "null",
+ "string"
+ ]
+ }
+ }
+ },
+ "authDelegator": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ },
+ "dataStorage": {
+ "type": "object",
+ "properties": {
+ "accessMode": {
+ "type": "string"
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": [
+ "boolean",
+ "string"
+ ]
+ },
+ "labels": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "mountPath": {
+ "type": "string"
+ },
+ "size": {
+ "type": "string"
+ },
+ "storageClass": {
+ "type": [
+ "null",
+ "string"
+ ]
+ }
+ }
+ },
+ "dev": {
+ "type": "object",
+ "properties": {
+ "devRootToken": {
+ "type": "string"
+ },
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ },
+ "enabled": {
+ "type": [
+ "boolean",
+ "string"
+ ]
+ },
+ "enterpriseLicense": {
+ "type": "object",
+ "properties": {
+ "secretKey": {
+ "type": "string"
+ },
+ "secretName": {
+ "type": "string"
+ }
+ }
+ },
+ "extraArgs": {
+ "type": "string"
+ },
+ "extraContainers": {
+ "type": [
+ "null",
+ "array"
+ ]
+ },
+ "extraEnvironmentVars": {
+ "type": "object"
+ },
+ "extraInitContainers": {
+ "type": [
+ "null",
+ "array"
+ ]
+ },
+ "extraLabels": {
+ "type": "object"
+ },
+ "extraPorts": {
+ "type": [
+ "null",
+ "array"
+ ]
+ },
+ "extraSecretEnvironmentVars": {
+ "type": "array"
+ },
+ "extraVolumes": {
+ "type": "array"
+ },
+ "ha": {
+ "type": "object",
+ "properties": {
+ "apiAddr": {
+ "type": [
+ "null",
+ "string"
+ ]
+ },
+ "clusterAddr": {
+ "type": [
+ "null",
+ "string"
+ ]
+ },
+ "config": {
+ "type": [
+ "string",
+ "object"
+ ]
+ },
+ "disruptionBudget": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "maxUnavailable": {
+ "type": [
+ "null",
+ "integer"
+ ]
+ }
+ }
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "raft": {
+ "type": "object",
+ "properties": {
+ "config": {
+ "type": [
+ "string",
+ "object"
+ ]
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "setNodeId": {
+ "type": "boolean"
+ }
+ }
+ },
+ "replicas": {
+ "type": "integer"
+ }
+ }
+ },
+ "hostAliases": {
+ "type": "array"
+ },
+ "hostNetwork": {
+ "type": "boolean"
+ },
+ "image": {
+ "type": "object",
+ "properties": {
+ "pullPolicy": {
+ "type": "string"
+ },
+ "repository": {
+ "type": "string"
+ },
+ "tag": {
+ "type": "string"
+ }
+ }
+ },
+ "includeConfigAnnotation": {
+ "type": "boolean"
+ },
+ "ingress": {
+ "type": "object",
+ "properties": {
+ "activeService": {
+ "type": "boolean"
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "extraPaths": {
+ "type": "array"
+ },
+ "hosts": {
+ "type": "array",
+ "items": {
+ "type": "object",
+ "properties": {
+ "host": {
+ "type": "string"
+ },
+ "paths": {
+ "type": "array"
+ }
+ }
+ }
+ },
+ "ingressClassName": {
+ "type": "string"
+ },
+ "labels": {
+ "type": "object"
+ },
+ "pathType": {
+ "type": "string"
+ },
+ "tls": {
+ "type": "array"
+ }
+ }
+ },
+ "livenessProbe": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "execCommand": {
+ "type": "array"
+ },
+ "failureThreshold": {
+ "type": "integer"
+ },
+ "initialDelaySeconds": {
+ "type": "integer"
+ },
+ "path": {
+ "type": "string"
+ },
+ "periodSeconds": {
+ "type": "integer"
+ },
+ "port": {
+ "type": "integer"
+ },
+ "successThreshold": {
+ "type": "integer"
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "logFormat": {
+ "type": "string"
+ },
+ "logLevel": {
+ "type": "string"
+ },
+ "networkPolicy": {
+ "type": "object",
+ "properties": {
+ "egress": {
+ "type": "array"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "ingress": {
+ "type": "array"
+ }
+ }
+ },
+ "nodeSelector": {
+ "type": [
+ "null",
+ "object",
+ "string"
+ ]
+ },
+ "persistentVolumeClaimRetentionPolicy": {
+ "type": "object",
+ "properties": {
+ "whenDeleted": {
+ "type": "string"
+ },
+ "whenScaled": {
+ "type": "string"
+ }
+ }
+ },
+ "postStart": {
+ "type": "array"
+ },
+ "preStopSleepSeconds": {
+ "type": "integer"
+ },
+ "priorityClassName": {
+ "type": "string"
+ },
+ "readinessProbe": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "failureThreshold": {
+ "type": "integer"
+ },
+ "initialDelaySeconds": {
+ "type": "integer"
+ },
+ "periodSeconds": {
+ "type": "integer"
+ },
+ "port": {
+ "type": "integer"
+ },
+ "successThreshold": {
+ "type": "integer"
+ },
+ "timeoutSeconds": {
+ "type": "integer"
+ }
+ }
+ },
+ "resources": {
+ "type": "object"
+ },
+ "route": {
+ "type": "object",
+ "properties": {
+ "activeService": {
+ "type": "boolean"
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "host": {
+ "type": "string"
+ },
+ "labels": {
+ "type": "object"
+ },
+ "tls": {
+ "type": "object"
+ }
+ }
+ },
+ "service": {
+ "type": "object",
+ "properties": {
+ "active": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ },
+ "activeNodePort": {
+ "type": "integer"
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "externalTrafficPolicy": {
+ "type": "string"
+ },
+ "instanceSelector": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ },
+ "ipFamilies": {
+ "type": "array"
+ },
+ "ipFamilyPolicy": {
+ "type": "string"
+ },
+ "nodePort": {
+ "type": "integer"
+ },
+ "port": {
+ "type": "integer"
+ },
+ "publishNotReadyAddresses": {
+ "type": "boolean"
+ },
+ "standby": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ },
+ "standbyNodePort": {
+ "type": "integer"
+ },
+ "targetPort": {
+ "type": "integer"
+ }
+ }
+ },
+ "serviceAccount": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "create": {
+ "type": "boolean"
+ },
+ "createSecret": {
+ "type": "boolean"
+ },
+ "extraLabels": {
+ "type": "object"
+ },
+ "name": {
+ "type": "string"
+ },
+ "serviceDiscovery": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ }
+ }
+ }
+ }
+ },
+ "shareProcessNamespace": {
+ "type": "boolean"
+ },
+ "standalone": {
+ "type": "object",
+ "properties": {
+ "config": {
+ "type": [
+ "string",
+ "object"
+ ]
+ },
+ "enabled": {
+ "type": [
+ "string",
+ "boolean"
+ ]
+ }
+ }
+ },
+ "statefulSet": {
+ "type": "object",
+ "properties": {
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "securityContext": {
+ "type": "object",
+ "properties": {
+ "container": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "pod": {
+ "type": [
+ "object",
+ "string"
+ ]
+ }
+ }
+ }
+ }
+ },
+ "terminationGracePeriodSeconds": {
+ "type": "integer"
+ },
+ "tolerations": {
+ "type": [
+ "null",
+ "array",
+ "string"
+ ]
+ },
+ "topologySpreadConstraints": {
+ "type": [
+ "null",
+ "array",
+ "string"
+ ]
+ },
+ "updateStrategyType": {
+ "type": "string"
+ },
+ "volumeMounts": {
+ "type": [
+ "null",
+ "array"
+ ]
+ },
+ "volumes": {
+ "type": [
+ "null",
+ "array"
+ ]
+ }
+ }
+ },
+ "serverTelemetry": {
+ "type": "object",
+ "properties": {
+ "prometheusRules": {
+ "type": "object",
+ "properties": {
+ "enabled": {
+ "type": "boolean"
+ },
+ "rules": {
+ "type": "array"
+ },
+ "selectors": {
+ "type": "object"
+ }
+ }
+ },
+ "serviceMonitor": {
+ "type": "object",
+ "properties": {
+ "authorization": {
+ "type": "object"
+ },
+ "enabled": {
+ "type": "boolean"
+ },
+ "interval": {
+ "type": "string"
+ },
+ "scrapeTimeout": {
+ "type": "string"
+ },
+ "selectors": {
+ "type": "object"
+ },
+ "tlsConfig": {
+ "type": "object"
+ }
+ }
+ }
+ }
+ },
+ "ui": {
+ "type": "object",
+ "properties": {
+ "activeVaultPodOnly": {
+ "type": "boolean"
+ },
+ "annotations": {
+ "type": [
+ "object",
+ "string"
+ ]
+ },
+ "enabled": {
+ "type": [
+ "boolean",
+ "string"
+ ]
+ },
+ "externalPort": {
+ "type": "integer"
+ },
+ "externalTrafficPolicy": {
+ "type": "string"
+ },
+ "publishNotReadyAddresses": {
+ "type": "boolean"
+ },
+ "serviceIPFamilies": {
+ "type": "array"
+ },
+ "serviceIPFamilyPolicy": {
+ "type": "string"
+ },
+ "serviceNodePort": {
+ "type": [
+ "null",
+ "integer"
+ ]
+ },
+ "serviceType": {
+ "type": "string"
+ },
+ "targetPort": {
+ "type": "integer"
+ }
+ }
+ }
+ }
+}
diff --git a/charts/vault/values.yaml b/charts/vault/values.yaml
new file mode 100644
index 0000000..69d4eb4
--- /dev/null
+++ b/charts/vault/values.yaml
@@ -0,0 +1,1353 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: MPL-2.0
+
+# Available parameters and their default values for the Vault chart.
+
+global:
+ # enabled is the master enabled switch. Setting this to true or false
+ # will enable or disable all the components within this chart by default.
+ enabled: true
+
+ # The namespace to deploy to. Defaults to the `helm` installation namespace.
+ namespace: ""
+
+ # Image pull secret to use for registry authentication.
+ # Alternatively, the value may be specified as an array of strings.
+ imagePullSecrets: []
+ # imagePullSecrets:
+ # - name: image-pull-secret
+
+ # TLS for end-to-end encrypted transport
+ tlsDisable: true
+
+ # External vault server address for the injector and CSI provider to use.
+ # Setting this will disable deployment of a vault server.
+ externalVaultAddr: ""
+
+ # If deploying to OpenShift
+ openshift: false
+
+ # Create PodSecurityPolicy for pods
+ psp:
+ enable: false
+ # Annotation for PodSecurityPolicy.
+ # This is a multi-line templated string map, and can also be set as YAML.
+ annotations: |
+ seccomp.security.alpha.kubernetes.io/allowedProfileNames: docker/default,runtime/default
+ apparmor.security.beta.kubernetes.io/allowedProfileNames: runtime/default
+ seccomp.security.alpha.kubernetes.io/defaultProfileName: runtime/default
+ apparmor.security.beta.kubernetes.io/defaultProfileName: runtime/default
+
+ serverTelemetry:
+ # Enable integration with the Prometheus Operator
+ # See the top level serverTelemetry section below before enabling this feature.
+ prometheusOperator: false
+
+injector:
+ # True if you want to enable vault agent injection.
+ # @default: global.enabled
+ enabled: "-"
+
+ replicas: 1
+
+ # Configures the port the injector should listen on
+ port: 8080
+
+ # If multiple replicas are specified, by default a leader will be determined
+ # so that only one injector attempts to create TLS certificates.
+ leaderElector:
+ enabled: true
+
+ # If true, will enable a node exporter metrics endpoint at /metrics.
+ metrics:
+ enabled: false
+
+ # Deprecated: Please use global.externalVaultAddr instead.
+ externalVaultAddr: ""
+
+ # image sets the repo and tag of the vault-k8s image to use for the injector.
+ image:
+ repository: "hashicorp/vault-k8s"
+ tag: "1.6.2"
+ pullPolicy: IfNotPresent
+
+ # agentImage sets the repo and tag of the Vault image to use for the Vault Agent
+ # containers. This should be set to the official Vault image. Vault 1.3.1+ is
+ # required.
+ agentImage:
+ repository: "hashicorp/vault"
+ tag: "1.19.0"
+
+ # The default values for the injected Vault Agent containers.
+ agentDefaults:
+ # For more information on configuring resources, see the K8s documentation:
+ # https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/
+ cpuLimit: "500m"
+ cpuRequest: "250m"
+ memLimit: "128Mi"
+ memRequest: "64Mi"
+ # ephemeralLimit: "128Mi"
+ # ephemeralRequest: "64Mi"
+
+ # Default template type for secrets when no custom template is specified.
+ # Possible values include: "json" and "map".
+ template: "map"
+
+ # Default values within Agent's template_config stanza.
+ templateConfig:
+ exitOnRetryFailure: true
+ staticSecretRenderInterval: ""
+
+ # Used to define custom livenessProbe settings
+ livenessProbe:
+ # When a probe fails, Kubernetes will try failureThreshold times before giving up
+ failureThreshold: 2
+ # Number of seconds after the container has started before probe initiates
+ initialDelaySeconds: 5
+ # How often (in seconds) to perform the probe
+ periodSeconds: 2
+ # Minimum consecutive successes for the probe to be considered successful after having failed
+ successThreshold: 1
+ # Number of seconds after which the probe times out.
+ timeoutSeconds: 5
+ # Used to define custom readinessProbe settings
+ readinessProbe:
+ # When a probe fails, Kubernetes will try failureThreshold times before giving up
+ failureThreshold: 2
+ # Number of seconds after the container has started before probe initiates
+ initialDelaySeconds: 5
+ # How often (in seconds) to perform the probe
+ periodSeconds: 2
+ # Minimum consecutive successes for the probe to be considered successful after having failed
+ successThreshold: 1
+ # Number of seconds after which the probe times out.
+ timeoutSeconds: 5
+ # Used to define custom startupProbe settings
+ startupProbe:
+ # When a probe fails, Kubernetes will try failureThreshold times before giving up
+ failureThreshold: 12
+ # Number of seconds after the container has started before probe initiates
+ initialDelaySeconds: 5
+ # How often (in seconds) to perform the probe
+ periodSeconds: 5
+ # Minimum consecutive successes for the probe to be considered successful after having failed
+ successThreshold: 1
+ # Number of seconds after which the probe times out.
+ timeoutSeconds: 5
+
+ # Mount Path of the Vault Kubernetes Auth Method.
+ authPath: "auth/kubernetes"
+
+ # Configures the log verbosity of the injector.
+ # Supported log levels include: trace, debug, info, warn, error
+ logLevel: "info"
+
+ # Configures the log format of the injector. Supported log formats: "standard", "json".
+ logFormat: "standard"
+
+ # Configures all Vault Agent sidecars to revoke their token when shutting down
+ revokeOnShutdown: false
+
+ webhook:
+ # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
+ # API Version of the WebHook.
+ # To block pod creation while the webhook is unavailable, set the policy to `Fail` below.
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
+ #
+ failurePolicy: Ignore
+
+ # matchPolicy specifies the approach to accepting changes based on the rules of
+ # the MutatingWebhookConfiguration.
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-matchpolicy
+ # for more details.
+ #
+ matchPolicy: Exact
+
+ # timeoutSeconds is the amount of seconds before the webhook request will be ignored
+ # or fails.
+ # If it is ignored or fails depends on the failurePolicy
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#timeouts
+ # for more details.
+ #
+ timeoutSeconds: 30
+
+ # namespaceSelector is the selector for restricting the webhook to only
+ # specific namespaces.
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
+ # for more details.
+ # Example:
+ # namespaceSelector:
+ # matchLabels:
+ # sidecar-injector: enabled
+ namespaceSelector: {}
+
+ # objectSelector is the selector for restricting the webhook to only
+ # specific labels.
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
+ # for more details.
+ # Example:
+ # objectSelector:
+ # matchLabels:
+ # vault-sidecar-injector: enabled
+ objectSelector: |
+ matchExpressions:
+ - key: app.kubernetes.io/name
+ operator: NotIn
+ values:
+ - {{ template "vault.name" . }}-agent-injector
+
+ # Extra annotations to attach to the webhook
+ annotations: {}
+
+ # Deprecated: please use 'webhook.failurePolicy' instead
+ # Configures failurePolicy of the webhook. The "unspecified" default behaviour depends on the
+ # API Version of the WebHook.
+ # To block pod creation while webhook is unavailable, set the policy to `Fail` below.
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#failure-policy
+ #
+ failurePolicy: Ignore
+
+ # Deprecated: please use 'webhook.namespaceSelector' instead
+ # namespaceSelector is the selector for restricting the webhook to only
+ # specific namespaces.
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-namespaceselector
+ # for more details.
+ # Example:
+ # namespaceSelector:
+ # matchLabels:
+ # sidecar-injector: enabled
+ namespaceSelector: {}
+
+ # Deprecated: please use 'webhook.objectSelector' instead
+ # objectSelector is the selector for restricting the webhook to only
+ # specific labels.
+ # See https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/#matching-requests-objectselector
+ # for more details.
+ # Example:
+ # objectSelector:
+ # matchLabels:
+ # vault-sidecar-injector: enabled
+ objectSelector: {}
+
+ # Deprecated: please use 'webhook.annotations' instead
+ # Extra annotations to attach to the webhook
+ webhookAnnotations: {}
+
+ certs:
+ # secretName is the name of the secret that has the TLS certificate and
+ # private key to serve the injector webhook. If this is null, then the
+ # injector will default to its automatic management mode that will assign
+ # a service account to the injector to generate its own certificates.
+ secretName: null
+
+ # caBundle is a base64-encoded PEM-encoded certificate bundle for the CA
+ # that signed the TLS certificate that the webhook serves. This must be set
+ # if secretName is non-null unless an external service like cert-manager is
+ # keeping the caBundle updated.
+ caBundle: ""
+
+ # certName and keyName are the names of the files within the secret for
+ # the TLS cert and private key, respectively. These have reasonable
+ # defaults but can be customized if necessary.
+ certName: tls.crt
+ keyName: tls.key
+
+ # Security context for the pod template and the injector container
+ # The default pod securityContext is:
+ # runAsNonRoot: true
+ # runAsGroup: {{ .Values.injector.gid | default 1000 }}
+ # runAsUser: {{ .Values.injector.uid | default 100 }}
+ # fsGroup: {{ .Values.injector.gid | default 1000 }}
+ # and for container is
+ # allowPrivilegeEscalation: false
+ # capabilities:
+ # drop:
+ # - ALL
+ securityContext:
+ pod: {}
+ container: {}
+
+ resources: {}
+ # resources:
+ # requests:
+ # memory: 256Mi
+ # cpu: 250m
+ # limits:
+ # memory: 256Mi
+ # cpu: 250m
+
+ # extraEnvironmentVars is a list of extra environment variables to set in the
+ # injector deployment.
+ extraEnvironmentVars: {}
+ # KUBERNETES_SERVICE_HOST: kubernetes.default.svc
+
+ # Affinity Settings for injector pods
+ # This can either be a multi-line string or YAML matching the PodSpec's affinity field.
+ # Commenting out or setting as empty the affinity variable, will allow
+ # deployment of multiple replicas to single node services such as Minikube.
+ affinity: |
+ podAntiAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}-agent-injector
+ app.kubernetes.io/instance: "{{ .Release.Name }}"
+ component: webhook
+ topologyKey: kubernetes.io/hostname
+
+ # Topology settings for injector pods
+ # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+ # This should be either a multi-line string or YAML matching the topologySpreadConstraints array
+ # in a PodSpec.
+ topologySpreadConstraints: []
+
+ # Toleration Settings for injector pods
+ # This should be either a multi-line string or YAML matching the Toleration array
+ # in a PodSpec.
+ tolerations: []
+
+ # nodeSelector labels for server pod assignment, formatted as a multi-line string or YAML map.
+ # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+ # Example:
+ # nodeSelector:
+ # beta.kubernetes.io/arch: amd64
+ nodeSelector: {}
+
+ # Priority class for injector pods
+ priorityClassName: ""
+
+ # Extra annotations to attach to the injector pods
+ # This can either be YAML or a YAML-formatted multi-line templated string map
+ # of the annotations to apply to the injector pods
+ annotations: {}
+
+ # Extra labels to attach to the agent-injector
+ # This should be a YAML map of the labels to apply to the injector
+ extraLabels: {}
+
+ # Should the injector pods run on the host network (useful when using
+ # an alternate CNI in EKS)
+ hostNetwork: false
+
+ # Injector service specific config
+ service:
+ # Extra annotations to attach to the injector service
+ annotations: {}
+
+ # Injector serviceAccount specific config
+ serviceAccount:
+ # Extra annotations to attach to the injector serviceAccount
+ annotations: {}
+
+ # A disruption budget limits the number of pods of a replicated application
+ # that are down simultaneously from voluntary disruptions
+ podDisruptionBudget: {}
+ # podDisruptionBudget:
+ # maxUnavailable: 1
+
+ # strategy for updating the deployment. This can be a multi-line string or a
+ # YAML map.
+ strategy: {}
+ # strategy: |
+ # rollingUpdate:
+ # maxSurge: 25%
+ # maxUnavailable: 25%
+ # type: RollingUpdate
+
+server:
+ # If true, or "-" with global.enabled true, Vault server will be installed.
+ # See vault.mode in _helpers.tpl for implementation details.
+ enabled: "-"
+
+ # [Enterprise Only] This value refers to a Kubernetes secret that you have
+ # created that contains your enterprise license. If you are not using an
+ # enterprise image or if you plan to introduce the license key via another
+ # route, then leave secretName blank ("") or set it to null.
+ # Requires Vault Enterprise 1.8 or later.
+ enterpriseLicense:
+ # The name of the Kubernetes secret that holds the enterprise license. The
+ # secret must be in the same namespace that Vault is installed into.
+ secretName: ""
+ # The key within the Kubernetes secret that holds the enterprise license.
+ secretKey: "license"
+
+ image:
+ repository: "hashicorp/vault"
+ tag: "1.19.0"
+ # Overrides the default Image Pull Policy
+ pullPolicy: IfNotPresent
+
+ # Configure the Update Strategy Type for the StatefulSet
+ # See https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#update-strategies
+ updateStrategyType: "OnDelete"
+
+ # Configure the logging verbosity for the Vault server.
+ # Supported log levels include: trace, debug, info, warn, error
+ logLevel: ""
+
+ # Configure the logging format for the Vault server.
+ # Supported log formats include: standard, json
+ logFormat: ""
+
+ # Resource requests, limits, etc. for the server cluster placement. This
+ # should map directly to the value of the resources field for a PodSpec.
+ # By default no direct resource request is made.
+ resources: {}
+ # resources:
+ # requests:
+ # memory: 256Mi
+ # cpu: 250m
+ # limits:
+ # memory: 256Mi
+ # cpu: 250m
+
+ # Ingress allows ingress services to be created to allow external access
+ # from Kubernetes to access Vault pods.
+ # If deployment is on OpenShift, the following block is ignored.
+ # In order to expose the service, use the route section below
+ ingress:
+ enabled: false
+ labels: {}
+ # traffic: external
+ annotations: {}
+ # |
+ # kubernetes.io/ingress.class: nginx
+ # kubernetes.io/tls-acme: "true"
+ # or
+ # kubernetes.io/ingress.class: nginx
+ # kubernetes.io/tls-acme: "true"
+
+ # Optionally use ingressClassName instead of deprecated annotation.
+ # See: https://kubernetes.io/docs/concepts/services-networking/ingress/#deprecated-annotation
+ ingressClassName: ""
+
+ # As of Kubernetes 1.19, all Ingress Paths must have a pathType configured. The default value below should be sufficient in most cases.
+ # See: https://kubernetes.io/docs/concepts/services-networking/ingress/#path-types for other possible values.
+ pathType: Prefix
+
+ # When HA mode is enabled and K8s service registration is being used,
+ # configure the ingress to point to the Vault active service.
+ activeService: true
+ hosts:
+ - host: chart-example.local
+ paths: []
+ ## Extra paths to prepend to the host configuration. This is useful when working with annotation based services.
+ extraPaths: []
+ # - path: /*
+ # backend:
+ # service:
+ # name: ssl-redirect
+ # port:
+ # number: use-annotation
+ tls: []
+ # - secretName: chart-example-tls
+ # hosts:
+ # - chart-example.local
+
+ # hostAliases is a list of aliases to be added to /etc/hosts. Specified as a YAML list.
+ hostAliases: []
+ # - ip: 127.0.0.1
+ # hostnames:
+ # - chart-example.local
+
+ # OpenShift only - create a route to expose the service
+ # By default the created route will be of type passthrough
+ route:
+ enabled: false
+
+ # When HA mode is enabled and K8s service registration is being used,
+ # configure the route to point to the Vault active service.
+ activeService: true
+
+ labels: {}
+ annotations: {}
+ host: chart-example.local
+ # tls will be passed directly to the route's TLS config, which
+ # can be used to configure other termination methods that terminate
+ # TLS at the router
+ tls:
+ termination: passthrough
+
+ # authDelegator enables a cluster role binding to be attached to the service
+ # account. This cluster role binding can be used to setup Kubernetes auth
+ # method. See https://developer.hashicorp.com/vault/docs/auth/kubernetes
+ authDelegator:
+ enabled: true
+
+ # extraInitContainers is a list of init containers. Specified as a YAML list.
+ # This is useful if you need to run a script to provision TLS certificates or
+ # write out configuration files in a dynamic way.
+ extraInitContainers: null
+ # # This example installs a plugin pulled from github into the /usr/local/libexec/vault/oauthapp folder,
+ # # which is defined in the volumes value.
+ # - name: oauthapp
+ # image: "alpine"
+ # command: [sh, -c]
+ # args:
+ # - cd /tmp &&
+ # wget https://github.com/puppetlabs/vault-plugin-secrets-oauthapp/releases/download/v1.2.0/vault-plugin-secrets-oauthapp-v1.2.0-linux-amd64.tar.xz -O oauthapp.xz &&
+ # tar -xf oauthapp.xz &&
+ # mv vault-plugin-secrets-oauthapp-v1.2.0-linux-amd64 /usr/local/libexec/vault/oauthapp &&
+ # chmod +x /usr/local/libexec/vault/oauthapp
+ # volumeMounts:
+ # - name: plugins
+ # mountPath: /usr/local/libexec/vault
+
+ # extraContainers is a list of sidecar containers. Specified as a YAML list.
+ extraContainers: null
+
+ # shareProcessNamespace enables process namespace sharing between Vault and the extraContainers
+ # This is useful if Vault must be signaled, e.g. to send a SIGHUP for a log rotation
+ shareProcessNamespace: false
+
+ # extraArgs is a string containing additional Vault server arguments.
+ extraArgs: ""
+
+ # extraPorts is a list of extra ports. Specified as a YAML list.
+ # This is useful if you need to add additional ports to the statefulset in dynamic way.
+ extraPorts: null
+ # - containerPort: 8300
+ # name: http-monitoring
+
+ # Used to define custom readinessProbe settings
+ readinessProbe:
+ enabled: true
+ # If you need to use a http path instead of the default exec
+ # path: /v1/sys/health?standbyok=true
+
+ # Port number on which readinessProbe will be checked.
+ port: 8200
+ # When a probe fails, Kubernetes will try failureThreshold times before giving up
+ failureThreshold: 2
+ # Number of seconds after the container has started before probe initiates
+ initialDelaySeconds: 5
+ # How often (in seconds) to perform the probe
+ periodSeconds: 5
+ # Minimum consecutive successes for the probe to be considered successful after having failed
+ successThreshold: 1
+ # Number of seconds after which the probe times out.
+ timeoutSeconds: 3
+ # Used to enable a livenessProbe for the pods
+ livenessProbe:
+ enabled: false
+ # Used to define a liveness exec command. If provided, exec is preferred to httpGet (path) as the livenessProbe handler.
+ execCommand: []
+ # - /bin/sh
+ # - -c
+ # - /vault/userconfig/mylivenessscript/run.sh
+ # Path for the livenessProbe to use httpGet as the livenessProbe handler
+ path: "/v1/sys/health?standbyok=true"
+ # Port number on which livenessProbe will be checked if httpGet is used as the livenessProbe handler
+ port: 8200
+ # When a probe fails, Kubernetes will try failureThreshold times before giving up
+ failureThreshold: 2
+ # Number of seconds after the container has started before probe initiates
+ initialDelaySeconds: 60
+ # How often (in seconds) to perform the probe
+ periodSeconds: 5
+ # Minimum consecutive successes for the probe to be considered successful after having failed
+ successThreshold: 1
+ # Number of seconds after which the probe times out.
+ timeoutSeconds: 3
+
+ # Optional duration in seconds the pod needs to terminate gracefully.
+ # See: https://kubernetes.io/docs/concepts/containers/container-lifecycle-hooks/
+ terminationGracePeriodSeconds: 10
+
+ # Used to set the sleep time during the preStop step, if custom preStop
+ # commands are not set.
+ preStopSleepSeconds: 5
+
+ # Used to define custom preStop exec commands to run before the pod is
+ # terminated. If not set, this will default to:
+ # preStop:
+ # - "/bin/sh"
+ # - "-c"
+ # - "sleep {{ .Values.server.preStopSleepSeconds }} && kill -SIGTERM $(pidof vault)"
+ preStop: []
+
+ # Used to define commands to run after the pod is ready.
+ # This can be used to automate processes such as initialization
+ # or boostrapping auth methods.
+ postStart: []
+ # - /bin/sh
+ # - -c
+ # - /vault/userconfig/myscript/run.sh
+
+ # extraEnvironmentVars is a list of extra environment variables to set with the stateful set. These could be
+ # used to include variables required for auto-unseal.
+ extraEnvironmentVars: {}
+ # GOOGLE_REGION: global
+ # GOOGLE_PROJECT: myproject
+ # GOOGLE_APPLICATION_CREDENTIALS: /vault/userconfig/myproject/myproject-creds.json
+
+ # extraSecretEnvironmentVars is a list of extra environment variables to set with the stateful set.
+ # These variables take value from existing Secret objects.
+ extraSecretEnvironmentVars: []
+ # - envName: AWS_SECRET_ACCESS_KEY
+ # secretName: vault
+ # secretKey: AWS_SECRET_ACCESS_KEY
+
+ # Deprecated: please use 'volumes' instead.
+ # extraVolumes is a list of extra volumes to mount. These will be exposed
+ # to Vault in the path `/vault/userconfig//`. The value below is
+ # an array of objects, examples are shown below.
+ extraVolumes: []
+ # - type: secret (or "configMap")
+ # name: my-secret
+ # path: null # default is `/vault/userconfig`
+
+ # volumes is a list of volumes made available to all containers. These are rendered
+ # via toYaml rather than pre-processed like the extraVolumes value.
+ # The purpose is to make it easy to share volumes between containers.
+ volumes: null
+ # - name: plugins
+ # emptyDir: {}
+
+ # volumeMounts is a list of volumeMounts for the main server container. These are rendered
+ # via toYaml rather than pre-processed like the extraVolumes value.
+ # The purpose is to make it easy to share volumes between containers.
+ volumeMounts: null
+ # - mountPath: /usr/local/libexec/vault
+ # name: plugins
+ # readOnly: true
+
+ # Affinity Settings
+ # Commenting out or setting as empty the affinity variable, will allow
+ # deployment to single node services such as Minikube
+ # This should be either a multi-line string or YAML matching the PodSpec's affinity field.
+ affinity: |
+ podAntiAffinity:
+ requiredDuringSchedulingIgnoredDuringExecution:
+ - labelSelector:
+ matchLabels:
+ app.kubernetes.io/name: {{ template "vault.name" . }}
+ app.kubernetes.io/instance: "{{ .Release.Name }}"
+ component: server
+ topologyKey: kubernetes.io/hostname
+
+ # Topology settings for server pods
+ # ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-topology-spread-constraints/
+ # This should be either a multi-line string or YAML matching the topologySpreadConstraints array
+ # in a PodSpec.
+ topologySpreadConstraints: []
+
+ # Toleration Settings for server pods
+ # This should be either a multi-line string or YAML matching the Toleration array
+ # in a PodSpec.
+ tolerations: []
+
+ # nodeSelector labels for server pod assignment, formatted as a multi-line string or YAML map.
+ # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+ # Example:
+ # nodeSelector:
+ # beta.kubernetes.io/arch: amd64
+ nodeSelector: {}
+
+ # Enables network policy for server pods
+ networkPolicy:
+ enabled: false
+ egress: []
+ # egress:
+ # - to:
+ # - ipBlock:
+ # cidr: 10.0.0.0/24
+ # ports:
+ # - protocol: TCP
+ # port: 443
+ ingress:
+ - from:
+ - namespaceSelector: {}
+ ports:
+ - port: 8200
+ protocol: TCP
+ - port: 8201
+ protocol: TCP
+
+ # Priority class for server pods
+ priorityClassName: ""
+
+ # Extra labels to attach to the server pods
+ # This should be a YAML map of the labels to apply to the server pods
+ extraLabels: {}
+
+ # Extra annotations to attach to the server pods
+ # This can either be YAML or a YAML-formatted multi-line templated string map
+ # of the annotations to apply to the server pods
+ annotations: {}
+
+ # Add an annotation to the server configmap and the statefulset pods,
+ # vaultproject.io/config-checksum, that is a hash of the Vault configuration.
+ # This can be used together with an OnDelete deployment strategy to help
+ # identify which pods still need to be deleted during a deployment to pick up
+ # any configuration changes.
+ includeConfigAnnotation: false
+
+ # Enables a headless service to be used by the Vault Statefulset
+ service:
+ enabled: true
+ # Enable or disable the vault-active service, which selects Vault pods that
+ # have labeled themselves as the cluster leader with `vault-active: "true"`.
+ active:
+ enabled: true
+ # Extra annotations for the service definition. This can either be YAML or a
+ # YAML-formatted multi-line templated string map of the annotations to apply
+ # to the active service.
+ annotations: {}
+ # Enable or disable the vault-standby service, which selects Vault pods that
+ # have labeled themselves as a cluster follower with `vault-active: "false"`.
+ standby:
+ enabled: true
+ # Extra annotations for the service definition. This can either be YAML or a
+ # YAML-formatted multi-line templated string map of the annotations to apply
+ # to the standby service.
+ annotations: {}
+ # If enabled, the service selectors will include `app.kubernetes.io/instance: {{ .Release.Name }}`
+ # When disabled, services may select Vault pods not deployed from the chart.
+ # Does not affect the headless vault-internal service with `ClusterIP: None`
+ instanceSelector:
+ enabled: true
+ # clusterIP controls whether a Cluster IP address is attached to the
+ # Vault service within Kubernetes. By default, the Vault service will
+ # be given a Cluster IP address, set to None to disable. When disabled
+ # Kubernetes will create a "headless" service. Headless services can be
+ # used to communicate with pods directly through DNS instead of a round-robin
+ # load balancer.
+ # clusterIP: None
+
+ # Configures the service type for the main Vault service. Can be ClusterIP
+ # or NodePort.
+ #type: ClusterIP
+
+ # The IP family and IP families options are to set the behaviour in a dual-stack environment.
+ # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
+ # should be.
+ # These are only supported for kubernetes versions >=1.23.0
+ #
+ # Configures the service's supported IP family policy, can be either:
+ # SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
+ # PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
+ # RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
+ ipFamilyPolicy: ""
+
+ # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well.
+ # Can be IPv4 and/or IPv6.
+ ipFamilies: []
+
+ # Do not wait for pods to be ready before including them in the services'
+ # targets. Does not apply to the headless service, which is used for
+ # cluster-internal communication.
+ publishNotReadyAddresses: true
+
+ # The externalTrafficPolicy can be set to either Cluster or Local
+ # and is only valid for LoadBalancer and NodePort service types.
+ # The default value is Cluster.
+ # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
+ externalTrafficPolicy: Cluster
+
+ # If type is set to "NodePort", a specific nodePort value can be configured,
+ # will be random if left blank.
+ #nodePort: 30000
+
+ # When HA mode is enabled
+ # If type is set to "NodePort", a specific nodePort value can be configured,
+ # will be random if left blank.
+ #activeNodePort: 30001
+
+ # When HA mode is enabled
+ # If type is set to "NodePort", a specific nodePort value can be configured,
+ # will be random if left blank.
+ #standbyNodePort: 30002
+
+ # Port on which Vault server is listening
+ port: 8200
+ # Target port to which the service should be mapped to
+ targetPort: 8200
+ # Extra annotations for the service definition. This can either be YAML or a
+ # YAML-formatted multi-line templated string map of the annotations to apply
+ # to the service.
+ annotations: {}
+
+ # This configures the Vault Statefulset to create a PVC for data
+ # storage when using the file or raft backend storage engines.
+ # See https://developer.hashicorp.com/vault/docs/configuration/storage to know more
+ dataStorage:
+ enabled: true
+ # Size of the PVC created
+ size: 10Gi
+ # Location where the PVC will be mounted.
+ mountPath: "/vault/data"
+ # Name of the storage class to use. If null it will use the
+ # configured default Storage Class.
+ storageClass: null
+ # Access Mode of the storage device being used for the PVC
+ accessMode: ReadWriteOnce
+ # Annotations to apply to the PVC
+ annotations: {}
+ # Labels to apply to the PVC
+ labels: {}
+
+ # Persistent Volume Claim (PVC) retention policy
+ # ref: https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#persistentvolumeclaim-retention
+ # Example:
+ # persistentVolumeClaimRetentionPolicy:
+ # whenDeleted: Retain
+ # whenScaled: Retain
+ persistentVolumeClaimRetentionPolicy: {}
+
+ # This configures the Vault Statefulset to create a PVC for audit
+ # logs. Once Vault is deployed, initialized, and unsealed, Vault must
+ # be configured to use this for audit logs. This will be mounted to
+ # /vault/audit
+ # See https://developer.hashicorp.com/vault/docs/audit to know more
+ auditStorage:
+ enabled: false
+ # Size of the PVC created
+ size: 10Gi
+ # Location where the PVC will be mounted.
+ mountPath: "/vault/audit"
+ # Name of the storage class to use. If null it will use the
+ # configured default Storage Class.
+ storageClass: null
+ # Access Mode of the storage device being used for the PVC
+ accessMode: ReadWriteOnce
+ # Annotations to apply to the PVC
+ annotations: {}
+ # Labels to apply to the PVC
+ labels: {}
+
+ # Run Vault in "dev" mode. This requires no further setup, no state management,
+ # and no initialization. This is useful for experimenting with Vault without
+ # needing to unseal, store keys, et. al. All data is lost on restart - do not
+ # use dev mode for anything other than experimenting.
+ # See https://developer.hashicorp.com/vault/docs/concepts/dev-server to know more
+ dev:
+ enabled: false
+
+ # Set VAULT_DEV_ROOT_TOKEN_ID value
+ devRootToken: "root"
+
+ # Run Vault in "standalone" mode. This is the default mode that will deploy if
+ # no arguments are given to helm. This requires a PVC for data storage to use
+ # the "file" backend. This mode is not highly available and should not be scaled
+ # past a single replica.
+ standalone:
+ enabled: "-"
+
+ # config is a raw string of default configuration when using a Stateful
+ # deployment. Default is to use a PersistentVolumeClaim mounted at /vault/data
+ # and store data there. This is only used when using a Replica count of 1, and
+ # using a stateful set. Supported formats are HCL and JSON.
+
+ # Note: Configuration files are stored in ConfigMaps so sensitive data
+ # such as passwords should be either mounted through extraSecretEnvironmentVars
+ # or through a Kube secret. For more information see:
+ # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
+ config: |-
+ ui = true
+
+ listener "tcp" {
+ tls_disable = 1
+ address = "[::]:8200"
+ cluster_address = "[::]:8201"
+ # Enable unauthenticated metrics access (necessary for Prometheus Operator)
+ #telemetry {
+ # unauthenticated_metrics_access = "true"
+ #}
+ }
+ storage "file" {
+ path = "/vault/data"
+ }
+
+ # Example configuration for using auto-unseal, using Google Cloud KMS. The
+ # GKMS keys must already exist, and the cluster must have a service account
+ # that is authorized to access GCP KMS.
+ #seal "gcpckms" {
+ # project = "vault-helm-dev"
+ # region = "global"
+ # key_ring = "vault-helm-unseal-kr"
+ # crypto_key = "vault-helm-unseal-key"
+ #}
+
+ # Example configuration for enabling Prometheus metrics in your config.
+ #telemetry {
+ # prometheus_retention_time = "30s"
+ # disable_hostname = true
+ #}
+
+ # Run Vault in "HA" mode. There are no storage requirements unless the audit log
+ # persistence is required. In HA mode Vault will configure itself to use Consul
+ # for its storage backend. The default configuration provided will work the Consul
+ # Helm project by default. It is possible to manually configure Vault to use a
+ # different HA backend.
+ ha:
+ enabled: false
+ replicas: 3
+
+ # Set the api_addr configuration for Vault HA
+ # See https://developer.hashicorp.com/vault/docs/configuration#api_addr
+ # If set to null, this will be set to the Pod IP Address
+ apiAddr: null
+
+ # Set the cluster_addr configuration for Vault HA
+ # See https://developer.hashicorp.com/vault/docs/configuration#cluster_addr
+ # If set to null, this will be set to https://$(HOSTNAME).{{ template "vault.fullname" . }}-internal:8201
+ clusterAddr: null
+
+ # Enables Vault's integrated Raft storage. Unlike the typical HA modes where
+ # Vault's persistence is external (such as Consul), enabling Raft mode will create
+ # persistent volumes for Vault to store data according to the configuration under server.dataStorage.
+ # The Vault cluster will coordinate leader elections and failovers internally.
+ raft:
+
+ # Enables Raft integrated storage
+ enabled: false
+ # Set the Node Raft ID to the name of the pod
+ setNodeId: false
+
+ # Note: Configuration files are stored in ConfigMaps so sensitive data
+ # such as passwords should be either mounted through extraSecretEnvironmentVars
+ # or through a Kube secret. For more information see:
+ # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
+ # Supported formats are HCL and JSON.
+ config: |
+ ui = true
+
+ listener "tcp" {
+ tls_disable = 1
+ address = "[::]:8200"
+ cluster_address = "[::]:8201"
+ # Enable unauthenticated metrics access (necessary for Prometheus Operator)
+ #telemetry {
+ # unauthenticated_metrics_access = "true"
+ #}
+ }
+
+ storage "raft" {
+ path = "/vault/data"
+ }
+
+ service_registration "kubernetes" {}
+
+ # config is a raw string of default configuration when using a Stateful
+ # deployment. Default is to use a Consul for its HA storage backend.
+ # Supported formats are HCL and JSON.
+
+ # Note: Configuration files are stored in ConfigMaps so sensitive data
+ # such as passwords should be either mounted through extraSecretEnvironmentVars
+ # or through a Kube secret. For more information see:
+ # https://developer.hashicorp.com/vault/docs/platform/k8s/helm/run#protecting-sensitive-vault-configurations
+ config: |
+ ui = true
+
+ listener "tcp" {
+ tls_disable = 1
+ address = "[::]:8200"
+ cluster_address = "[::]:8201"
+ }
+ storage "consul" {
+ path = "vault"
+ address = "HOST_IP:8500"
+ }
+
+ service_registration "kubernetes" {}
+
+ # Example configuration for using auto-unseal, using Google Cloud KMS. The
+ # GKMS keys must already exist, and the cluster must have a service account
+ # that is authorized to access GCP KMS.
+ #seal "gcpckms" {
+ # project = "vault-helm-dev-246514"
+ # region = "global"
+ # key_ring = "vault-helm-unseal-kr"
+ # crypto_key = "vault-helm-unseal-key"
+ #}
+
+ # Example configuration for enabling Prometheus metrics.
+ # If you are using Prometheus Operator you can enable a ServiceMonitor resource below.
+ # You may wish to enable unauthenticated metrics in the listener block above.
+ #telemetry {
+ # prometheus_retention_time = "30s"
+ # disable_hostname = true
+ #}
+
+ # A disruption budget limits the number of pods of a replicated application
+ # that are down simultaneously from voluntary disruptions
+ disruptionBudget:
+ enabled: true
+
+ # maxUnavailable will default to (n/2)-1 where n is the number of
+ # replicas. If you'd like a custom value, you can specify an override here.
+ maxUnavailable: null
+
+ # Definition of the serviceAccount used to run Vault.
+ # These options are also used when using an external Vault server to validate
+ # Kubernetes tokens.
+ serviceAccount:
+ # Specifies whether a service account should be created
+ create: true
+ # The name of the service account to use.
+ # If not set and create is true, a name is generated using the fullname template
+ name: ""
+ # Create a Secret API object to store a non-expiring token for the service account.
+ # Prior to v1.24.0, Kubernetes used to generate this secret for each service account by default.
+ # Kubernetes now recommends using short-lived tokens from the TokenRequest API or projected volumes instead if possible.
+ # For more details, see https://kubernetes.io/docs/concepts/configuration/secret/#service-account-token-secrets
+ # serviceAccount.create must be equal to 'true' in order to use this feature.
+ createSecret: false
+ # Extra annotations for the serviceAccount definition. This can either be
+ # YAML or a YAML-formatted multi-line templated string map of the
+ # annotations to apply to the serviceAccount.
+ annotations: {}
+ # Extra labels to attach to the serviceAccount
+ # This should be a YAML map of the labels to apply to the serviceAccount
+ extraLabels: {}
+ # Enable or disable a service account role binding with the permissions required for
+ # Vault's Kubernetes service_registration config option.
+ # See https://developer.hashicorp.com/vault/docs/configuration/service-registration/kubernetes
+ serviceDiscovery:
+ enabled: true
+
+ # Settings for the statefulSet used to run Vault.
+ statefulSet:
+ # Extra annotations for the statefulSet. This can either be YAML or a
+ # YAML-formatted multi-line templated string map of the annotations to apply
+ # to the statefulSet.
+ annotations: {}
+
+ # Set the pod and container security contexts.
+ # If not set, these will default to, and for *not* OpenShift:
+ # pod:
+ # runAsNonRoot: true
+ # runAsGroup: {{ .Values.server.gid | default 1000 }}
+ # runAsUser: {{ .Values.server.uid | default 100 }}
+ # fsGroup: {{ .Values.server.gid | default 1000 }}
+ # container:
+ # allowPrivilegeEscalation: false
+ #
+ # If not set, these will default to, and for OpenShift:
+ # pod: {}
+ # container: {}
+ securityContext:
+ pod: {}
+ container: {}
+
+ # Should the server pods run on the host network
+ hostNetwork: false
+
+# Vault UI
+ui:
+ # True if you want to create a Service entry for the Vault UI.
+ #
+ # serviceType can be used to control the type of service created. For
+ # example, setting this to "LoadBalancer" will create an external load
+ # balancer (for supported K8S installations) to access the UI.
+ enabled: false
+ publishNotReadyAddresses: true
+ # The service should only contain selectors for active Vault pod
+ activeVaultPodOnly: false
+ serviceType: "ClusterIP"
+ serviceNodePort: null
+ externalPort: 8200
+ targetPort: 8200
+
+ # The IP family and IP families options are to set the behaviour in a dual-stack environment.
+ # Omitting these values will let the service fall back to whatever the CNI dictates the defaults
+ # should be.
+ # These are only supported for kubernetes versions >=1.23.0
+ #
+ # Configures the service's supported IP family, can be either:
+ # SingleStack: Single-stack service. The control plane allocates a cluster IP for the Service, using the first configured service cluster IP range.
+ # PreferDualStack: Allocates IPv4 and IPv6 cluster IPs for the Service.
+ # RequireDualStack: Allocates Service .spec.ClusterIPs from both IPv4 and IPv6 address ranges.
+ serviceIPFamilyPolicy: ""
+
+ # Sets the families that should be supported and the order in which they should be applied to ClusterIP as well
+ # Can be IPv4 and/or IPv6.
+ serviceIPFamilies: []
+
+ # The externalTrafficPolicy can be set to either Cluster or Local
+ # and is only valid for LoadBalancer and NodePort service types.
+ # The default value is Cluster.
+ # ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-traffic-policy
+ externalTrafficPolicy: Cluster
+
+ #loadBalancerSourceRanges:
+ # - 10.0.0.0/16
+ # - 1.78.23.3/32
+
+ # loadBalancerIP:
+
+ # Extra annotations to attach to the ui service
+ # This can either be YAML or a YAML-formatted multi-line templated string map
+ # of the annotations to apply to the ui service
+ annotations: {}
+
+# secrets-store-csi-driver-provider-vault
+csi:
+ # True if you want to install a secrets-store-csi-driver-provider-vault daemonset.
+ #
+ # Requires installing the secrets-store-csi-driver separately, see:
+ # https://github.com/kubernetes-sigs/secrets-store-csi-driver#install-the-secrets-store-csi-driver
+ #
+ # With the driver and provider installed, you can mount Vault secrets into volumes
+ # similar to the Vault Agent injector, and you can also sync those secrets into
+ # Kubernetes secrets.
+ enabled: false
+
+ image:
+ repository: "hashicorp/vault-csi-provider"
+ tag: "1.5.0"
+ pullPolicy: IfNotPresent
+
+ # volumes is a list of volumes made available to all containers. These are rendered
+ # via toYaml rather than pre-processed like the extraVolumes value.
+ # The purpose is to make it easy to share volumes between containers.
+ volumes: null
+ # - name: tls
+ # secret:
+ # secretName: vault-tls
+
+ # volumeMounts is a list of volumeMounts for the main server container. These are rendered
+ # via toYaml rather than pre-processed like the extraVolumes value.
+ # The purpose is to make it easy to share volumes between containers.
+ volumeMounts: null
+ # - name: tls
+ # mountPath: "/vault/tls"
+ # readOnly: true
+
+ resources: {}
+ # resources:
+ # requests:
+ # cpu: 50m
+ # memory: 128Mi
+ # limits:
+ # cpu: 50m
+ # memory: 128Mi
+
+ # Override the default secret name for the CSI Provider's HMAC key used for
+ # generating secret versions.
+ hmacSecretName: ""
+
+ # Allow modification of the hostNetwork parameter to avoid the need of a
+ # dedicated pod ip
+ hostNetwork: false
+
+ # Settings for the daemonSet used to run the provider.
+ daemonSet:
+ updateStrategy:
+ type: RollingUpdate
+ maxUnavailable: ""
+ # Extra annotations for the daemonSet. This can either be YAML or a
+ # YAML-formatted multi-line templated string map of the annotations to apply
+ # to the daemonSet.
+ annotations: {}
+ # Provider host path (must match the CSI provider's path)
+ providersDir: "/etc/kubernetes/secrets-store-csi-providers"
+ # Kubelet host path
+ kubeletRootDir: "/var/lib/kubelet"
+ # Extra labels to attach to the vault-csi-provider daemonSet
+ # This should be a YAML map of the labels to apply to the csi provider daemonSet
+ extraLabels: {}
+ # security context for the pod template and container in the csi provider daemonSet
+ securityContext:
+ pod: {}
+ container: {}
+
+ pod:
+ # Extra annotations for the provider pods. This can either be YAML or a
+ # YAML-formatted multi-line templated string map of the annotations to apply
+ # to the pod.
+ annotations: {}
+
+ # Toleration Settings for provider pods
+ # This should be either a multi-line string or YAML matching the Toleration array
+ # in a PodSpec.
+ tolerations: []
+
+ # nodeSelector labels for csi pod assignment, formatted as a multi-line string or YAML map.
+ # ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+ # Example:
+ # nodeSelector:
+ # beta.kubernetes.io/arch: amd64
+ nodeSelector: {}
+
+ # Affinity Settings
+ # This should be either a multi-line string or YAML matching the PodSpec's affinity field.
+ affinity: {}
+
+ # Extra labels to attach to the vault-csi-provider pod
+ # This should be a YAML map of the labels to apply to the csi provider pod
+ extraLabels: {}
+
+ agent:
+ enabled: true
+ extraArgs: []
+
+ image:
+ repository: "hashicorp/vault"
+ tag: "1.19.0"
+ pullPolicy: IfNotPresent
+
+ logFormat: standard
+ logLevel: info
+
+ resources: {}
+ # resources:
+ # requests:
+ # memory: 256Mi
+ # cpu: 250m
+ # limits:
+ # memory: 256Mi
+ # cpu: 250m
+
+ # Priority class for csi pods
+ priorityClassName: ""
+
+ serviceAccount:
+ # Extra annotations for the serviceAccount definition. This can either be
+ # YAML or a YAML-formatted multi-line templated string map of the
+ # annotations to apply to the serviceAccount.
+ annotations: {}
+
+ # Extra labels to attach to the vault-csi-provider serviceAccount
+ # This should be a YAML map of the labels to apply to the csi provider serviceAccount
+ extraLabels: {}
+
+ # Used to configure readinessProbe for the pods.
+ readinessProbe:
+ # When a probe fails, Kubernetes will try failureThreshold times before giving up
+ failureThreshold: 2
+ # Number of seconds after the container has started before probe initiates
+ initialDelaySeconds: 5
+ # How often (in seconds) to perform the probe
+ periodSeconds: 5
+ # Minimum consecutive successes for the probe to be considered successful after having failed
+ successThreshold: 1
+ # Number of seconds after which the probe times out.
+ timeoutSeconds: 3
+ # Used to configure livenessProbe for the pods.
+ livenessProbe:
+ # When a probe fails, Kubernetes will try failureThreshold times before giving up
+ failureThreshold: 2
+ # Number of seconds after the container has started before probe initiates
+ initialDelaySeconds: 5
+ # How often (in seconds) to perform the probe
+ periodSeconds: 5
+ # Minimum consecutive successes for the probe to be considered successful after having failed
+ successThreshold: 1
+ # Number of seconds after which the probe times out.
+ timeoutSeconds: 3
+
+ # Configures the log level for the Vault CSI provider.
+ # Supported log levels include: trace, debug, info, warn, error, and off
+ logLevel: "info"
+
+ # Deprecated, set logLevel to debug instead.
+ # If set to true, the logLevel will be set to debug.
+ debug: false
+
+ # Pass arbitrary additional arguments to vault-csi-provider.
+ # See https://developer.hashicorp.com/vault/docs/platform/k8s/csi/configurations#command-line-arguments
+ # for the available command line flags.
+ extraArgs: []
+
+# Vault is able to collect and publish various runtime metrics.
+# Enabling this feature requires setting adding `telemetry{}` stanza to
+# the Vault configuration. There are a few examples included in the `config` sections above.
+#
+# For more information see:
+# https://developer.hashicorp.com/vault/docs/configuration/telemetry
+# https://developer.hashicorp.com/vault/docs/internals/telemetry
+serverTelemetry:
+ # Enable support for the Prometheus Operator. If authorization is not set for authenticating
+ # to Vault's metrics endpoint, the following Vault server `telemetry{}` config must be included
+ # in the `listener "tcp"{}` stanza
+ # telemetry {
+ # unauthenticated_metrics_access = "true"
+ # }
+ #
+ # See the `standalone.config` for a more complete example of this.
+ #
+ # In addition, a top level `telemetry{}` stanza must also be included in the Vault configuration:
+ #
+ # example:
+ # telemetry {
+ # prometheus_retention_time = "30s"
+ # disable_hostname = true
+ # }
+ #
+ # Configuration for monitoring the Vault server.
+ serviceMonitor:
+ # The Prometheus operator *must* be installed before enabling this feature,
+ # if not the chart will fail to install due to missing CustomResourceDefinitions
+ # provided by the operator.
+ #
+ # Instructions on how to install the Helm chart can be found here:
+ # https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack
+ # More information can be found here:
+ # https://github.com/prometheus-operator/prometheus-operator
+ # https://github.com/prometheus-operator/kube-prometheus
+
+ # Enable deployment of the Vault Server ServiceMonitor CustomResource.
+ enabled: false
+
+ # Selector labels to add to the ServiceMonitor.
+ # When empty, defaults to:
+ # release: prometheus
+ selectors: {}
+
+ # Interval at which Prometheus scrapes metrics
+ interval: 30s
+
+ # Timeout for Prometheus scrapes
+ scrapeTimeout: 10s
+
+ # tlsConfig used for scraping the Vault metrics API.
+ # See API reference: https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.TLSConfig
+ # example:
+ # tlsConfig:
+ # ca:
+ # secret:
+ # name: vault-metrics-client
+ # key: ca.crt
+ tlsConfig: {}
+
+ # authorization used for scraping the Vault metrics API.
+ # See API reference: https://prometheus-operator.dev/docs/api-reference/api/#monitoring.coreos.com/v1.SafeAuthorization
+ # example:
+ # authorization:
+ # credentials:
+ # name: vault-metrics-client
+ # key: token
+ authorization: {}
+
+ prometheusRules:
+ # The Prometheus operator *must* be installed before enabling this feature,
+ # if not the chart will fail to install due to missing CustomResourceDefinitions
+ # provided by the operator.
+
+ # Deploy the PrometheusRule custom resource for AlertManager based alerts.
+ # Requires that AlertManager is properly deployed.
+ enabled: false
+
+ # Selector labels to add to the PrometheusRules.
+ # When empty, defaults to:
+ # release: prometheus
+ selectors: {}
+
+ # Some example rules.
+ rules: []
+ # - alert: vault-HighResponseTime
+ # annotations:
+ # message: The response time of Vault is over 500ms on average over the last 5 minutes.
+ # expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
+ # for: 5m
+ # labels:
+ # severity: warning
+ # - alert: vault-HighResponseTime
+ # annotations:
+ # message: The response time of Vault is over 1s on average over the last 5 minutes.
+ # expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
+ # for: 5m
+ # labels:
+ # severity: critical
diff --git a/manifests/external-secrets/values.yaml b/manifests/external-secrets/values.yaml
new file mode 100644
index 0000000..50ec221
--- /dev/null
+++ b/manifests/external-secrets/values.yaml
@@ -0,0 +1,10 @@
+installCRDs: true
+
+webhook:
+ enabled: true
+
+certController:
+ enabled: true
+
+serviceAccount:
+ create: true
diff --git a/manifests/vault/values.yaml b/manifests/vault/values.yaml
new file mode 100644
index 0000000..37b7b5d
--- /dev/null
+++ b/manifests/vault/values.yaml
@@ -0,0 +1,26 @@
+server:
+ dataStorage:
+ enabled: true
+ size: 1Gi
+ storageClass: nfs-client
+
+ ingress:
+ enabled: true
+ ingressClassName: traefik
+ annotations:
+ traefik.ingress.kubernetes.io/router.entrypoints: websecure
+ traefik.ingress.kubernetes.io/router.tls: "true"
+ hosts:
+ - host: vault.dvirlabs.com
+ paths:
+ - path: /
+ pathType: Prefix
+ tls:
+ - hosts:
+ - vault.dvirlabs.com
+
+ standalone:
+ enabled: true
+
+ui:
+ enabled: true