# Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: BUSL-1.1 --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.3 name: vaultauthglobals.secrets.hashicorp.com spec: group: secrets.hashicorp.com names: kind: VaultAuthGlobal listKind: VaultAuthGlobalList plural: vaultauthglobals singular: vaultauthglobal scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: VaultAuthGlobal is the Schema for the vaultauthglobals API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: VaultAuthGlobalSpec defines the desired state of VaultAuthGlobal properties: allowedNamespaces: description: |- AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this VaultAuthGlobal. This field allows administrators to customize which Kubernetes namespaces are authorized to reference this resource. While Vault will still enforce its own rules, this has the added configurability of restricting which VaultAuthMethods can be used by which namespaces. Accepted values: []{"*"} - wildcard, all namespaces. []{"a", "b"} - list of namespaces. unset - disallow all namespaces except the Operator's and the referring VaultAuthMethod's namespace, this is the default behavior. items: type: string type: array appRole: description: AppRole specific auth configuration, requires that the Method be set to `appRole`. properties: headers: additionalProperties: type: string description: Headers to be included in all Vault requests. type: object mount: description: Mount to use when authenticating to auth method. type: string namespace: description: Namespace to auth to in Vault type: string params: additionalProperties: type: string description: Params to use when authenticating to Vault type: object roleId: description: RoleID of the AppRole Role to use for authenticating to Vault. type: string secretRef: description: |- SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the AppRole Role's SecretID. The secret must have a key named `id` which holds the AppRole Role's secretID. type: string type: object aws: description: AWS specific auth configuration, requires that Method be set to `aws`. properties: headerValue: description: The Vault header value to include in the STS signing request type: string headers: additionalProperties: type: string description: Headers to be included in all Vault requests. type: object iamEndpoint: description: The IAM endpoint to use; if not set will use the default type: string irsaServiceAccount: description: |- IRSAServiceAccount name to use with IAM Roles for Service Accounts (IRSA), and should be annotated with "eks.amazonaws.com/role-arn". This ServiceAccount will be checked for other EKS annotations: eks.amazonaws.com/audience and eks.amazonaws.com/token-expiration type: string mount: description: Mount to use when authenticating to auth method. type: string namespace: description: Namespace to auth to in Vault type: string params: additionalProperties: type: string description: Params to use when authenticating to Vault type: object region: description: AWS Region to use for signing the authentication request type: string role: description: Vault role to use for authenticating type: string secretRef: description: |- SecretRef is the name of a Kubernetes Secret in the consumer's (VDS/VSS/PKI) namespace which holds credentials for AWS. Expected keys include `access_key_id`, `secret_access_key`, `session_token` type: string sessionName: description: The role session name to use when creating a webidentity provider type: string stsEndpoint: description: The STS endpoint to use; if not set will use the default type: string type: object defaultAuthMethod: description: DefaultAuthMethod to use when authenticating to Vault. enum: - kubernetes - jwt - appRole - aws - gcp type: string defaultMount: description: |- DefaultMount to use when authenticating to auth method. If not specified the mount of the auth method configured in Vault will be used. type: string defaultVaultNamespace: description: |- DefaultVaultNamespace to auth to in Vault, if not specified the namespace of the auth method will be used. This can be used as a default Vault namespace for all auth methods. type: string gcp: description: GCP specific auth configuration, requires that Method be set to `gcp`. properties: clusterName: description: |- GKE cluster name. Defaults to the cluster-name returned from the operator pod's local metadata server. type: string headers: additionalProperties: type: string description: Headers to be included in all Vault requests. type: object mount: description: Mount to use when authenticating to auth method. type: string namespace: description: Namespace to auth to in Vault type: string params: additionalProperties: type: string description: Params to use when authenticating to Vault type: object projectID: description: |- GCP project ID. Defaults to the project-id returned from the operator pod's local metadata server. type: string region: description: |- GCP Region of the GKE cluster's identity provider. Defaults to the region returned from the operator pod's local metadata server. type: string role: description: Vault role to use for authenticating type: string workloadIdentityServiceAccount: description: |- WorkloadIdentityServiceAccount is the name of a Kubernetes service account (in the same Kubernetes namespace as the Vault*Secret referencing this resource) which has been configured for workload identity in GKE. Should be annotated with "iam.gke.io/gcp-service-account". type: string type: object headers: additionalProperties: type: string description: DefaultHeaders to be included in all Vault requests. type: object jwt: description: JWT specific auth configuration, requires that the Method be set to `jwt`. properties: audiences: description: TokenAudiences to include in the ServiceAccount token. items: type: string type: array headers: additionalProperties: type: string description: Headers to be included in all Vault requests. type: object mount: description: Mount to use when authenticating to auth method. type: string namespace: description: Namespace to auth to in Vault type: string params: additionalProperties: type: string description: Params to use when authenticating to Vault type: object role: description: Role to use for authenticating to Vault. type: string secretRef: description: |- SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the JWT token to authenticate to Vault's JWT authentication backend. The secret must have a key named `jwt` which holds the JWT token. type: string serviceAccount: description: |- ServiceAccount to use when creating a ServiceAccount token to authenticate to Vault's JWT authentication backend. type: string tokenExpirationSeconds: default: 600 description: TokenExpirationSeconds to set the ServiceAccount token. format: int64 minimum: 600 type: integer type: object kubernetes: description: Kubernetes specific auth configuration, requires that the Method be set to `kubernetes`. properties: audiences: description: TokenAudiences to include in the ServiceAccount token. items: type: string type: array headers: additionalProperties: type: string description: Headers to be included in all Vault requests. type: object mount: description: Mount to use when authenticating to auth method. type: string namespace: description: Namespace to auth to in Vault type: string params: additionalProperties: type: string description: Params to use when authenticating to Vault type: object role: description: Role to use for authenticating to Vault. type: string serviceAccount: description: |- ServiceAccount to use when authenticating to Vault's authentication backend. This must reside in the consuming secret's (VDS/VSS/PKI) namespace. type: string tokenExpirationSeconds: default: 600 description: TokenExpirationSeconds to set the ServiceAccount token. format: int64 minimum: 600 type: integer type: object params: additionalProperties: type: string description: DefaultParams to use when authenticating to Vault type: object vaultConnectionRef: description: |- VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace, eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the Operator will default to the `default` VaultConnection, configured in the operator's namespace. type: string type: object status: description: VaultAuthGlobalStatus defines the observed state of VaultAuthGlobal properties: error: type: string valid: description: Valid auth mechanism. type: boolean required: - error - valid type: object type: object served: true storage: true subresources: status: {}