# Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: BUSL-1.1 --- apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.3 name: vaultauths.secrets.hashicorp.com spec: group: secrets.hashicorp.com names: kind: VaultAuth listKind: VaultAuthList plural: vaultauths singular: vaultauth scope: Namespaced versions: - name: v1beta1 schema: openAPIV3Schema: description: VaultAuth is the Schema for the vaultauths API properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: description: VaultAuthSpec defines the desired state of VaultAuth properties: allowedNamespaces: description: |- AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod. This field allows administrators to customize which Kubernetes namespaces are authorized to use with this AuthMethod. While Vault will still enforce its own rules, this has the added configurability of restricting which VaultAuthMethods can be used by which namespaces. Accepted values: []{"*"} - wildcard, all namespaces. []{"a", "b"} - list of namespaces. unset - disallow all namespaces except the Operator's the VaultAuthMethod's namespace, this is the default behavior. items: type: string type: array appRole: description: AppRole specific auth configuration, requires that the Method be set to `appRole`. properties: roleId: description: RoleID of the AppRole Role to use for authenticating to Vault. type: string secretRef: description: |- SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the AppRole Role's SecretID. The secret must have a key named `id` which holds the AppRole Role's secretID. type: string type: object aws: description: AWS specific auth configuration, requires that Method be set to `aws`. properties: headerValue: description: The Vault header value to include in the STS signing request type: string iamEndpoint: description: The IAM endpoint to use; if not set will use the default type: string irsaServiceAccount: description: |- IRSAServiceAccount name to use with IAM Roles for Service Accounts (IRSA), and should be annotated with "eks.amazonaws.com/role-arn". This ServiceAccount will be checked for other EKS annotations: eks.amazonaws.com/audience and eks.amazonaws.com/token-expiration type: string region: description: AWS Region to use for signing the authentication request type: string role: description: Vault role to use for authenticating type: string secretRef: description: |- SecretRef is the name of a Kubernetes Secret in the consumer's (VDS/VSS/PKI) namespace which holds credentials for AWS. Expected keys include `access_key_id`, `secret_access_key`, `session_token` type: string sessionName: description: The role session name to use when creating a webidentity provider type: string stsEndpoint: description: The STS endpoint to use; if not set will use the default type: string type: object gcp: description: GCP specific auth configuration, requires that Method be set to `gcp`. properties: clusterName: description: |- GKE cluster name. Defaults to the cluster-name returned from the operator pod's local metadata server. type: string projectID: description: |- GCP project ID. Defaults to the project-id returned from the operator pod's local metadata server. type: string region: description: |- GCP Region of the GKE cluster's identity provider. Defaults to the region returned from the operator pod's local metadata server. type: string role: description: Vault role to use for authenticating type: string workloadIdentityServiceAccount: description: |- WorkloadIdentityServiceAccount is the name of a Kubernetes service account (in the same Kubernetes namespace as the Vault*Secret referencing this resource) which has been configured for workload identity in GKE. Should be annotated with "iam.gke.io/gcp-service-account". type: string type: object headers: additionalProperties: type: string description: Headers to be included in all Vault requests. type: object jwt: description: JWT specific auth configuration, requires that the Method be set to `jwt`. properties: audiences: description: TokenAudiences to include in the ServiceAccount token. items: type: string type: array role: description: Role to use for authenticating to Vault. type: string secretRef: description: |- SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the JWT token to authenticate to Vault's JWT authentication backend. The secret must have a key named `jwt` which holds the JWT token. type: string serviceAccount: description: |- ServiceAccount to use when creating a ServiceAccount token to authenticate to Vault's JWT authentication backend. type: string tokenExpirationSeconds: default: 600 description: TokenExpirationSeconds to set the ServiceAccount token. format: int64 minimum: 600 type: integer type: object kubernetes: description: Kubernetes specific auth configuration, requires that the Method be set to `kubernetes`. properties: audiences: description: TokenAudiences to include in the ServiceAccount token. items: type: string type: array role: description: Role to use for authenticating to Vault. type: string serviceAccount: description: |- ServiceAccount to use when authenticating to Vault's authentication backend. This must reside in the consuming secret's (VDS/VSS/PKI) namespace. type: string tokenExpirationSeconds: default: 600 description: TokenExpirationSeconds to set the ServiceAccount token. format: int64 minimum: 600 type: integer type: object method: description: Method to use when authenticating to Vault. enum: - kubernetes - jwt - appRole - aws - gcp type: string mount: description: Mount to use when authenticating to auth method. type: string namespace: description: Namespace to auth to in Vault type: string params: additionalProperties: type: string description: Params to use when authenticating to Vault type: object storageEncryption: description: |- StorageEncryption provides the necessary configuration to encrypt the client storage cache. This should only be configured when client cache persistence with encryption is enabled. This is done by passing setting the manager's commandline argument --client-cache-persistence-model=direct-encrypted. Typically, there should only ever be one VaultAuth configured with StorageEncryption in the Cluster, and it should have the label: cacheStorageEncryption=true properties: keyName: description: KeyName to use for encrypt/decrypt operations via Vault Transit. type: string mount: description: Mount path of the Transit engine in Vault. type: string required: - keyName - mount type: object vaultAuthGlobalRef: description: VaultAuthGlobalRef. properties: allowDefault: description: |- AllowDefault when set to true will use the default VaultAuthGlobal resource as the default if Name is not set. The 'allow-default-globals' option must be set on the operator's '-global-vault-auth-options' flag The default VaultAuthGlobal search is conditional. When a ref Namespace is set, the search for the default VaultAuthGlobal resource is constrained to that namespace. Otherwise, the search order is: 1. The default VaultAuthGlobal resource in the referring VaultAuth resource's namespace. 2. The default VaultAuthGlobal resource in the Operator's namespace. type: boolean mergeStrategy: description: |- MergeStrategy configures the merge strategy for HTTP headers and parameters that are included in all Vault authentication requests. properties: headers: description: |- Headers configures the merge strategy for HTTP headers that are included in all Vault requests. Choices are `union`, `replace`, or `none`. If `union` is set, the headers from the VaultAuthGlobal and VaultAuth resources are merged. The headers from the VaultAuth always take precedence. If `replace` is set, the first set of non-empty headers taken in order from: VaultAuth, VaultAuthGlobal auth method, VaultGlobal default headers. If `none` is set, the headers from the VaultAuthGlobal resource are ignored and only the headers from the VaultAuth resource are used. The default is `none`. enum: - union - replace - none type: string params: description: |- Params configures the merge strategy for HTTP parameters that are included in all Vault requests. Choices are `union`, `replace`, or `none`. If `union` is set, the parameters from the VaultAuthGlobal and VaultAuth resources are merged. The parameters from the VaultAuth always take precedence. If `replace` is set, the first set of non-empty parameters taken in order from: VaultAuth, VaultAuthGlobal auth method, VaultGlobal default parameters. If `none` is set, the parameters from the VaultAuthGlobal resource are ignored and only the parameters from the VaultAuth resource are used. The default is `none`. enum: - union - replace - none type: string type: object name: description: Name of the VaultAuthGlobal resource. pattern: ^([a-z0-9.-]{1,253})$ type: string namespace: description: |- Namespace of the VaultAuthGlobal resource. If not provided, the namespace of the referring VaultAuth resource is used. pattern: ^([a-z0-9.-]{1,253})$ type: string type: object vaultConnectionRef: description: |- VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace, eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the Operator will default to the `default` VaultConnection, configured in the operator's namespace. type: string type: object status: description: VaultAuthStatus defines the observed state of VaultAuth properties: conditions: items: description: Condition contains details for one aspect of the current state of this API Resource. properties: lastTransitionTime: description: |- lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable. format: date-time type: string message: description: |- message is a human readable message indicating details about the transition. This may be an empty string. maxLength: 32768 type: string observedGeneration: description: |- observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance. format: int64 minimum: 0 type: integer reason: description: |- reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty. maxLength: 1024 minLength: 1 pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$ type: string status: description: status of the condition, one of True, False, Unknown. enum: - "True" - "False" - Unknown type: string type: description: type of condition in CamelCase or in foo.example.com/CamelCase. maxLength: 316 pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$ type: string required: - lastTransitionTime - message - reason - status - type type: object type: array error: type: string specHash: type: string valid: description: Valid auth mechanism. type: boolean type: object type: object served: true storage: true subresources: status: {}