chore: Update manifests after change
This commit is contained in:
@@ -0,0 +1,83 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/cert-controller-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: external-secrets-cert-controller
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-cert-controller
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "apiextensions.k8s.io"
|
||||
resources:
|
||||
- "customresourcedefinitions"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- "update"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "admissionregistration.k8s.io"
|
||||
resources:
|
||||
- "validatingwebhookconfigurations"
|
||||
verbs:
|
||||
- "list"
|
||||
- "watch"
|
||||
- "get"
|
||||
- apiGroups:
|
||||
- "admissionregistration.k8s.io"
|
||||
resources:
|
||||
- "validatingwebhookconfigurations"
|
||||
resourceNames:
|
||||
- "secretstore-validate"
|
||||
- "externalsecret-validate"
|
||||
verbs:
|
||||
- "update"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "endpoints"
|
||||
verbs:
|
||||
- "list"
|
||||
- "get"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- "discovery.k8s.io"
|
||||
resources:
|
||||
- "endpointslices"
|
||||
verbs:
|
||||
- "list"
|
||||
- "get"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "events"
|
||||
verbs:
|
||||
- "create"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- "update"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "coordination.k8s.io"
|
||||
resources:
|
||||
- "leases"
|
||||
verbs:
|
||||
- "get"
|
||||
- "create"
|
||||
- "update"
|
||||
- "patch"
|
||||
@@ -0,0 +1,152 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: external-secrets-controller
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "external-secrets.io"
|
||||
resources:
|
||||
- "secretstores"
|
||||
- "clustersecretstores"
|
||||
- "externalsecrets"
|
||||
- "clusterexternalsecrets"
|
||||
- "pushsecrets"
|
||||
- "clusterpushsecrets"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- "external-secrets.io"
|
||||
resources:
|
||||
- "externalsecrets"
|
||||
- "externalsecrets/status"
|
||||
- "externalsecrets/finalizers"
|
||||
- "secretstores"
|
||||
- "secretstores/status"
|
||||
- "secretstores/finalizers"
|
||||
- "clustersecretstores"
|
||||
- "clustersecretstores/status"
|
||||
- "clustersecretstores/finalizers"
|
||||
- "clusterexternalsecrets"
|
||||
- "clusterexternalsecrets/status"
|
||||
- "clusterexternalsecrets/finalizers"
|
||||
- "pushsecrets"
|
||||
- "pushsecrets/status"
|
||||
- "pushsecrets/finalizers"
|
||||
- "clusterpushsecrets"
|
||||
- "clusterpushsecrets/status"
|
||||
- "clusterpushsecrets/finalizers"
|
||||
verbs:
|
||||
- "get"
|
||||
- "update"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "generators.external-secrets.io"
|
||||
resources:
|
||||
- "generatorstates"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- "create"
|
||||
- "update"
|
||||
- "patch"
|
||||
- "delete"
|
||||
- "deletecollection"
|
||||
- apiGroups:
|
||||
- "generators.external-secrets.io"
|
||||
resources:
|
||||
- "acraccesstokens"
|
||||
- "cloudsmithaccesstokens"
|
||||
- "clustergenerators"
|
||||
- "ecrauthorizationtokens"
|
||||
- "fakes"
|
||||
- "gcraccesstokens"
|
||||
- "githubaccesstokens"
|
||||
- "quayaccesstokens"
|
||||
- "passwords"
|
||||
- "sshkeys"
|
||||
- "stssessiontokens"
|
||||
- "uuids"
|
||||
- "vaultdynamicsecrets"
|
||||
- "webhooks"
|
||||
- "grafanas"
|
||||
- "mfas"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "serviceaccounts"
|
||||
- "namespaces"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "namespaces"
|
||||
verbs:
|
||||
- "update"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "secrets"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
- "create"
|
||||
- "update"
|
||||
- "delete"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "serviceaccounts/token"
|
||||
verbs:
|
||||
- "create"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "events"
|
||||
verbs:
|
||||
- "create"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- "external-secrets.io"
|
||||
resources:
|
||||
- "externalsecrets"
|
||||
verbs:
|
||||
- "create"
|
||||
- "update"
|
||||
- "delete"
|
||||
- apiGroups:
|
||||
- "external-secrets.io"
|
||||
resources:
|
||||
- "pushsecrets"
|
||||
verbs:
|
||||
- "create"
|
||||
- "update"
|
||||
- "delete"
|
||||
@@ -0,0 +1,54 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: external-secrets-edit
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "external-secrets.io"
|
||||
resources:
|
||||
- "externalsecrets"
|
||||
- "secretstores"
|
||||
- "clustersecretstores"
|
||||
- "pushsecrets"
|
||||
- "clusterpushsecrets"
|
||||
verbs:
|
||||
- "create"
|
||||
- "delete"
|
||||
- "deletecollection"
|
||||
- "patch"
|
||||
- "update"
|
||||
- apiGroups:
|
||||
- "generators.external-secrets.io"
|
||||
resources:
|
||||
- "acraccesstokens"
|
||||
- "cloudsmithaccesstokens"
|
||||
- "clustergenerators"
|
||||
- "ecrauthorizationtokens"
|
||||
- "fakes"
|
||||
- "gcraccesstokens"
|
||||
- "githubaccesstokens"
|
||||
- "quayaccesstokens"
|
||||
- "passwords"
|
||||
- "sshkeys"
|
||||
- "vaultdynamicsecrets"
|
||||
- "webhooks"
|
||||
- "grafanas"
|
||||
- "generatorstates"
|
||||
- "mfas"
|
||||
- "uuids"
|
||||
verbs:
|
||||
- "create"
|
||||
- "delete"
|
||||
- "deletecollection"
|
||||
- "patch"
|
||||
- "update"
|
||||
@@ -0,0 +1,23 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: external-secrets-servicebindings
|
||||
labels:
|
||||
servicebinding.io/controller: "true"
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "external-secrets.io"
|
||||
resources:
|
||||
- "externalsecrets"
|
||||
- "pushsecrets"
|
||||
verbs:
|
||||
- "get"
|
||||
- "list"
|
||||
- "watch"
|
||||
@@ -0,0 +1,51 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRole
|
||||
metadata:
|
||||
name: external-secrets-view
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rbac.authorization.k8s.io/aggregate-to-view: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-edit: "true"
|
||||
rbac.authorization.k8s.io/aggregate-to-admin: "true"
|
||||
rules:
|
||||
- apiGroups:
|
||||
- "external-secrets.io"
|
||||
resources:
|
||||
- "externalsecrets"
|
||||
- "secretstores"
|
||||
- "clustersecretstores"
|
||||
- "pushsecrets"
|
||||
- "clusterpushsecrets"
|
||||
verbs:
|
||||
- "get"
|
||||
- "watch"
|
||||
- "list"
|
||||
- apiGroups:
|
||||
- "generators.external-secrets.io"
|
||||
resources:
|
||||
- "acraccesstokens"
|
||||
- "cloudsmithaccesstokens"
|
||||
- "clustergenerators"
|
||||
- "ecrauthorizationtokens"
|
||||
- "fakes"
|
||||
- "gcraccesstokens"
|
||||
- "githubaccesstokens"
|
||||
- "quayaccesstokens"
|
||||
- "passwords"
|
||||
- "sshkeys"
|
||||
- "vaultdynamicsecrets"
|
||||
- "webhooks"
|
||||
- "grafanas"
|
||||
- "generatorstates"
|
||||
- "mfas"
|
||||
- "uuids"
|
||||
verbs:
|
||||
- "get"
|
||||
- "watch"
|
||||
- "list"
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/cert-controller-rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: external-secrets-cert-controller
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-cert-controller
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: external-secrets-cert-controller
|
||||
subjects:
|
||||
- name: external-secrets-cert-controller
|
||||
namespace: external-secrets
|
||||
kind: ServiceAccount
|
||||
@@ -0,0 +1,20 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: ClusterRoleBinding
|
||||
metadata:
|
||||
name: external-secrets-controller
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: ClusterRole
|
||||
name: external-secrets-controller
|
||||
subjects:
|
||||
- name: external-secrets
|
||||
namespace: external-secrets
|
||||
kind: ServiceAccount
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
# Source: external-secrets/templates/cluster-secret-store.yaml
|
||||
apiVersion: external-secrets.io/v1
|
||||
kind: ClusterSecretStore
|
||||
metadata:
|
||||
name: vault
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
app.kubernetes.io/name: vault
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/part-of: external-secrets
|
||||
spec:
|
||||
provider:
|
||||
vault:
|
||||
server: http://vault-internal.vault:8200
|
||||
path: secret
|
||||
auth:
|
||||
tokenSecretRef:
|
||||
namespace: vault
|
||||
name: vault-token
|
||||
key: token
|
||||
@@ -0,0 +1,210 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/acraccesstoken.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: acraccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: ACRAccessToken
|
||||
listKind: ACRAccessTokenList
|
||||
plural: acraccesstokens
|
||||
singular: acraccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ACRAccessToken returns an Azure Container Registry token
|
||||
that can be used for pushing/pulling images.
|
||||
Note: by default it will return an ACR Refresh Token with full access
|
||||
(depending on the identity).
|
||||
This can be scoped down to the repository level using .spec.scope.
|
||||
In case scope is defined it will return an ACR Access Token.
|
||||
|
||||
See docs: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: |-
|
||||
ACRAccessTokenSpec defines how to generate the access token
|
||||
e.g. how to authenticate and which registry to use.
|
||||
see: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md#overview
|
||||
properties:
|
||||
auth:
|
||||
description: ACRAuth defines the authentication methods for Azure Container Registry.
|
||||
properties:
|
||||
managedIdentity:
|
||||
description: ManagedIdentity uses Azure Managed Identity to authenticate with Azure.
|
||||
properties:
|
||||
identityId:
|
||||
description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
|
||||
type: string
|
||||
type: object
|
||||
servicePrincipal:
|
||||
description: ServicePrincipal uses Azure Service Principal credentials to authenticate with Azure.
|
||||
properties:
|
||||
secretRef:
|
||||
description: |-
|
||||
AzureACRServicePrincipalAuthSecretRef defines the secret references for Azure Service Principal authentication.
|
||||
It uses static credentials stored in a Kind=Secret.
|
||||
properties:
|
||||
clientId:
|
||||
description: The Azure clientId of the service principle used for authentication.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
clientSecret:
|
||||
description: The Azure ClientSecret of the service principle used for authentication.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- secretRef
|
||||
type: object
|
||||
workloadIdentity:
|
||||
description: WorkloadIdentity uses Azure Workload Identity to authenticate with Azure.
|
||||
properties:
|
||||
serviceAccountRef:
|
||||
description: |-
|
||||
ServiceAccountRef specified the service account
|
||||
that should be used when authenticating with WorkloadIdentity.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
environmentType:
|
||||
default: PublicCloud
|
||||
description: |-
|
||||
EnvironmentType specifies the Azure cloud environment endpoints to use for
|
||||
connecting and authenticating with Azure. By default, it points to the public cloud AAD endpoint.
|
||||
The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
|
||||
PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
|
||||
enum:
|
||||
- PublicCloud
|
||||
- USGovernmentCloud
|
||||
- ChinaCloud
|
||||
- GermanCloud
|
||||
- AzureStackCloud
|
||||
type: string
|
||||
registry:
|
||||
description: |-
|
||||
the domain name of the ACR registry
|
||||
e.g. foobarexample.azurecr.io
|
||||
type: string
|
||||
scope:
|
||||
description: |-
|
||||
Define the scope for the access token, e.g. pull/push access for a repository.
|
||||
if not provided it will return a refresh token that has full scope.
|
||||
Note: you need to pin it down to the repository level, there is no wildcard available.
|
||||
|
||||
examples:
|
||||
repository:my-repository:pull,push
|
||||
repository:my-repository:pull
|
||||
|
||||
see docs for details: https://docs.docker.com/registry/spec/auth/scope/
|
||||
type: string
|
||||
tenantId:
|
||||
description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- registry
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/cloudsmithaccesstoken.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: cloudsmithaccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: CloudsmithAccessToken
|
||||
listKind: CloudsmithAccessTokenList
|
||||
plural: cloudsmithaccesstokens
|
||||
singular: cloudsmithaccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: CloudsmithAccessToken generates Cloudsmith access token using OIDC authentication
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CloudsmithAccessTokenSpec defines the configuration for generating a Cloudsmith access token using OIDC authentication.
|
||||
properties:
|
||||
apiUrl:
|
||||
description: APIURL configures the Cloudsmith API URL. Defaults to https://api.cloudsmith.io.
|
||||
type: string
|
||||
orgSlug:
|
||||
description: OrgSlug is the organization slug in Cloudsmith
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: Name of the service account you are federating with
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
serviceSlug:
|
||||
description: ServiceSlug is the service slug in Cloudsmith for OIDC authentication
|
||||
type: string
|
||||
required:
|
||||
- orgSlug
|
||||
- serviceAccountRef
|
||||
- serviceSlug
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,540 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/clusterpushsecret.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: clusterpushsecrets.external-secrets.io
|
||||
spec:
|
||||
group: external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
kind: ClusterPushSecret
|
||||
listKind: ClusterPushSecretList
|
||||
plural: clusterpushsecrets
|
||||
singular: clusterpushsecret
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].reason
|
||||
name: Status
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterPushSecret is the Schema for the ClusterPushSecrets API that enables cluster-wide management of pushing Kubernetes secrets to external providers.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterPushSecretSpec defines the configuration for a ClusterPushSecret resource.
|
||||
properties:
|
||||
namespaceSelectors:
|
||||
description: A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector is a label query over a set of resources. The result of matchLabels and
|
||||
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
||||
label selector matches no objects.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
pushSecretMetadata:
|
||||
description: The metadata of the external secrets to be created
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
pushSecretName:
|
||||
description: |-
|
||||
The name of the push secrets to be created.
|
||||
Defaults to the name of the ClusterPushSecret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
pushSecretSpec:
|
||||
description: PushSecretSpec defines what to do with the secrets.
|
||||
properties:
|
||||
data:
|
||||
description: Secret Data that should be pushed to providers
|
||||
items:
|
||||
description: PushSecretData defines data to be pushed to the provider and associated metadata.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: Match a given Secret Key to be pushed to the provider.
|
||||
properties:
|
||||
remoteRef:
|
||||
description: Remote Refs to push to providers.
|
||||
properties:
|
||||
property:
|
||||
description: Name of the property in the resulting secret
|
||||
type: string
|
||||
remoteKey:
|
||||
description: Name of the resulting provider secret.
|
||||
type: string
|
||||
required:
|
||||
- remoteKey
|
||||
type: object
|
||||
secretKey:
|
||||
description: Secret Key to be pushed
|
||||
type: string
|
||||
required:
|
||||
- remoteRef
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: array
|
||||
deletionPolicy:
|
||||
default: None
|
||||
description: Deletion Policy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Delete
|
||||
- None
|
||||
type: string
|
||||
refreshInterval:
|
||||
default: 1h
|
||||
description: The Interval to which External Secrets will try to push a secret definition
|
||||
type: string
|
||||
secretStoreRefs:
|
||||
items:
|
||||
description: PushSecretStoreRef contains a reference on how to sync to a SecretStore.
|
||||
properties:
|
||||
kind:
|
||||
default: SecretStore
|
||||
description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
|
||||
enum:
|
||||
- SecretStore
|
||||
- ClusterSecretStore
|
||||
type: string
|
||||
labelSelector:
|
||||
description: Optionally, sync to secret stores with label selector
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
name:
|
||||
description: Optionally, sync to the SecretStore of the given name
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
selector:
|
||||
description: The Secret Selector (k8s source) for the Push Secret
|
||||
maxProperties: 1
|
||||
minProperties: 1
|
||||
properties:
|
||||
generatorRef:
|
||||
description: Point to a generator to create a Secret.
|
||||
properties:
|
||||
apiVersion:
|
||||
default: generators.external-secrets.io/v1alpha1
|
||||
description: Specify the apiVersion of the generator resource
|
||||
type: string
|
||||
kind:
|
||||
description: Specify the Kind of the generator resource
|
||||
enum:
|
||||
- ACRAccessToken
|
||||
- ClusterGenerator
|
||||
- CloudsmithAccessToken
|
||||
- ECRAuthorizationToken
|
||||
- Fake
|
||||
- GCRAccessToken
|
||||
- GithubAccessToken
|
||||
- QuayAccessToken
|
||||
- Password
|
||||
- SSHKey
|
||||
- STSSessionToken
|
||||
- UUID
|
||||
- VaultDynamicSecret
|
||||
- Webhook
|
||||
- Grafana
|
||||
- MFA
|
||||
type: string
|
||||
name:
|
||||
description: Specify the name of the generator resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
secret:
|
||||
description: Select a Secret to Push.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name of the Secret.
|
||||
The Secret must exist in the same namespace as the PushSecret manifest.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
selector:
|
||||
description: Selector chooses secrets using a labelSelector.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
type: object
|
||||
template:
|
||||
description: Template defines a blueprint for the created Secret resource.
|
||||
properties:
|
||||
data:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
engineVersion:
|
||||
default: v2
|
||||
description: |-
|
||||
EngineVersion specifies the template engine version
|
||||
that should be used to compile/execute the
|
||||
template specified in .data and .templateFrom[].
|
||||
enum:
|
||||
- v2
|
||||
type: string
|
||||
mergePolicy:
|
||||
default: Replace
|
||||
description: TemplateMergePolicy defines how the rendered template should be merged with the existing Secret data.
|
||||
enum:
|
||||
- Replace
|
||||
- Merge
|
||||
type: string
|
||||
metadata:
|
||||
description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
finalizers:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
templateFrom:
|
||||
items:
|
||||
description: |-
|
||||
TemplateFrom specifies a source for templates.
|
||||
Each item in the list can either reference a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
configMap:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
literal:
|
||||
type: string
|
||||
secret:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
target:
|
||||
default: Data
|
||||
description: |-
|
||||
Target specifies where to place the template result.
|
||||
For Secret resources, common values are: "Data", "Annotations", "Labels".
|
||||
For custom resources (when spec.target.manifest is set), this supports
|
||||
nested paths like "spec.database.config" or "data".
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type:
|
||||
type: string
|
||||
type: object
|
||||
updatePolicy:
|
||||
default: Replace
|
||||
description: UpdatePolicy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Replace
|
||||
- IfNotExists
|
||||
type: string
|
||||
required:
|
||||
- secretStoreRefs
|
||||
- selector
|
||||
type: object
|
||||
refreshTime:
|
||||
description: The time in which the controller should reconcile its objects and recheck namespaces for labels.
|
||||
type: string
|
||||
required:
|
||||
- pushSecretSpec
|
||||
type: object
|
||||
status:
|
||||
description: ClusterPushSecretStatus contains the status information for the ClusterPushSecret resource.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: PushSecretStatusCondition indicates the status of the PushSecret.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
description: PushSecretConditionType indicates the condition of the PushSecret.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
failedNamespaces:
|
||||
description: Failed namespaces are the namespaces that failed to apply an PushSecret
|
||||
items:
|
||||
description: ClusterPushSecretNamespaceFailure represents a failed namespace deployment and it's reason.
|
||||
properties:
|
||||
namespace:
|
||||
description: Namespace is the namespace that failed when trying to apply an PushSecret
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is why the PushSecret failed to apply to the namespace
|
||||
type: string
|
||||
required:
|
||||
- namespace
|
||||
type: object
|
||||
type: array
|
||||
provisionedNamespaces:
|
||||
description: ProvisionedNamespaces are the namespaces where the ClusterPushSecret has secrets
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
pushSecretName:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,196 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/ecrauthorizationtoken.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: ecrauthorizationtokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: ECRAuthorizationToken
|
||||
listKind: ECRAuthorizationTokenList
|
||||
plural: ecrauthorizationtokens
|
||||
singular: ecrauthorizationtoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ECRAuthorizationToken uses the GetAuthorizationToken API to retrieve an authorization token.
|
||||
The authorization token is valid for 12 hours.
|
||||
The authorizationToken returned is a base64 encoded string that can be decoded
|
||||
and used in a docker login command to authenticate to a registry.
|
||||
For more information, see Registry authentication (https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html#registry_auth) in the Amazon Elastic Container Registry User Guide.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ECRAuthorizationTokenSpec defines the desired state to generate an AWS ECR authorization token.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth defines how to authenticate with AWS
|
||||
properties:
|
||||
jwt:
|
||||
description: AWSJWTAuth provides configuration to authenticate against AWS using service account tokens.
|
||||
properties:
|
||||
serviceAccountRef:
|
||||
description: ServiceAccountSelector is a reference to a ServiceAccount resource.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
secretRef:
|
||||
description: |-
|
||||
AWSAuthSecretRef holds secret references for AWS credentials
|
||||
both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
|
||||
properties:
|
||||
accessKeyIDSecretRef:
|
||||
description: The AccessKeyID is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
secretAccessKeySecretRef:
|
||||
description: The SecretAccessKey is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
sessionTokenSecretRef:
|
||||
description: |-
|
||||
The SessionToken used for authentication
|
||||
This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
|
||||
see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
region:
|
||||
description: Region specifies the region to operate in.
|
||||
type: string
|
||||
role:
|
||||
description: |-
|
||||
You can assume a role before making calls to the
|
||||
desired AWS service.
|
||||
type: string
|
||||
scope:
|
||||
description: |-
|
||||
Scope specifies the ECR service scope.
|
||||
Valid options are private and public.
|
||||
type: string
|
||||
required:
|
||||
- region
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,67 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/fake.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: fakes.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Fake
|
||||
listKind: FakeList
|
||||
plural: fakes
|
||||
singular: fake
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Fake generator is used for testing. It lets you define
|
||||
a static set of credentials that is always returned.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: FakeSpec contains the static data.
|
||||
properties:
|
||||
controller:
|
||||
description: |-
|
||||
Used to select the correct ESO controller (think: ingress.ingressClassName)
|
||||
The ESO controller is instantiated with a specific controller name and filters VDS based on this property
|
||||
type: string
|
||||
data:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Data defines the static data returned
|
||||
by this generator.
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,250 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/gcraccesstoken.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: gcraccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: GCRAccessToken
|
||||
listKind: GCRAccessTokenList
|
||||
plural: gcraccesstokens
|
||||
singular: gcraccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
GCRAccessToken generates an GCP access token
|
||||
that can be used to authenticate with GCR.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GCRAccessTokenSpec defines the desired state to generate a Google Container Registry access token.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth defines the means for authenticating with GCP
|
||||
properties:
|
||||
secretRef:
|
||||
description: GCPSMAuthSecretRef defines the reference to a secret containing Google Cloud Platform credentials.
|
||||
properties:
|
||||
secretAccessKeySecretRef:
|
||||
description: The SecretAccessKey is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
workloadIdentity:
|
||||
description: GCPWorkloadIdentity defines the configuration for using GCP Workload Identity authentication.
|
||||
properties:
|
||||
clusterLocation:
|
||||
type: string
|
||||
clusterName:
|
||||
type: string
|
||||
clusterProjectID:
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: ServiceAccountSelector is a reference to a ServiceAccount resource.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- clusterLocation
|
||||
- clusterName
|
||||
- serviceAccountRef
|
||||
type: object
|
||||
workloadIdentityFederation:
|
||||
description: GCPWorkloadIdentityFederation holds the configurations required for generating federated access tokens.
|
||||
properties:
|
||||
audience:
|
||||
description: |-
|
||||
audience is the Secure Token Service (STS) audience which contains the resource name for the workload identity pool and the provider identifier in that pool.
|
||||
If specified, Audience found in the external account credential config will be overridden with the configured value.
|
||||
audience must be provided when serviceAccountRef or awsSecurityCredentials is configured.
|
||||
type: string
|
||||
awsSecurityCredentials:
|
||||
description: |-
|
||||
awsSecurityCredentials is for configuring AWS region and credentials to use for obtaining the access token,
|
||||
when using the AWS metadata server is not an option.
|
||||
properties:
|
||||
awsCredentialsSecretRef:
|
||||
description: |-
|
||||
awsCredentialsSecretRef is the reference to the secret which holds the AWS credentials.
|
||||
Secret should be created with below names for keys
|
||||
- aws_access_key_id: Access Key ID, which is the unique identifier for the AWS account or the IAM user.
|
||||
- aws_secret_access_key: Secret Access Key, which is used to authenticate requests made to AWS services.
|
||||
- aws_session_token: Session Token, is the short-lived token to authenticate requests made to AWS services.
|
||||
properties:
|
||||
name:
|
||||
description: name of the secret.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: namespace in which the secret exists. If empty, secret will looked up in local namespace.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
region:
|
||||
description: region is for configuring the AWS region to be used.
|
||||
example: ap-south-1
|
||||
maxLength: 50
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9-]+$
|
||||
type: string
|
||||
required:
|
||||
- awsCredentialsSecretRef
|
||||
- region
|
||||
type: object
|
||||
credConfig:
|
||||
description: |-
|
||||
credConfig holds the configmap reference containing the GCP external account credential configuration in JSON format and the key name containing the json data.
|
||||
For using Kubernetes cluster as the identity provider, use serviceAccountRef instead. Operators mounted serviceaccount token cannot be used as the token source, instead
|
||||
serviceAccountRef must be used by providing operators service account details.
|
||||
properties:
|
||||
key:
|
||||
description: key name holding the external account credential config.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: name of the configmap.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: namespace in which the configmap exists. If empty, configmap will looked up in local namespace.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
externalTokenEndpoint:
|
||||
description: |-
|
||||
externalTokenEndpoint is the endpoint explicitly set up to provide tokens, which will be matched against the
|
||||
credential_source.url in the provided credConfig. This field is merely to double-check the external token source
|
||||
URL is having the expected value.
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: |-
|
||||
serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
|
||||
when Kubernetes is configured as provider in workload identity pool.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
projectID:
|
||||
description: ProjectID defines which project to use to authenticate with
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- projectID
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,109 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/generatorstate.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: generatorstates.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: GeneratorState
|
||||
listKind: GeneratorStateList
|
||||
plural: generatorstates
|
||||
shortNames:
|
||||
- gs
|
||||
singular: generatorstate
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.garbageCollectionDeadline
|
||||
name: GC Deadline
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GeneratorState represents the state created and managed by a generator resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GeneratorStateSpec defines the desired state of a generator state resource.
|
||||
properties:
|
||||
garbageCollectionDeadline:
|
||||
description: |-
|
||||
GarbageCollectionDeadline is the time after which the generator state
|
||||
will be deleted.
|
||||
It is set by the controller which creates the generator state and
|
||||
can be set configured by the user.
|
||||
If the garbage collection deadline is not set the generator state will not be deleted.
|
||||
format: date-time
|
||||
type: string
|
||||
resource:
|
||||
description: |-
|
||||
Resource is the generator manifest that produced the state.
|
||||
It is a snapshot of the generator manifest at the time the state was produced.
|
||||
This manifest will be used to delete the resource. Any configuration that is referenced
|
||||
in the manifest should be available at the time of garbage collection. If that is not the case deletion will
|
||||
be blocked by a finalizer.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
state:
|
||||
description: State is the state that was produced by the generator implementation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- resource
|
||||
- state
|
||||
type: object
|
||||
status:
|
||||
description: GeneratorStateStatus defines the observed state of a generator state resource.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: GeneratorStateStatusCondition represents the observed condition of a generator state.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
description: GeneratorStateConditionType represents the type of condition for a generator state.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
@@ -0,0 +1,116 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/githubaccesstoken.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: githubaccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: GithubAccessToken
|
||||
listKind: GithubAccessTokenList
|
||||
plural: githubaccesstokens
|
||||
singular: githubaccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GithubAccessToken generates ghs_ accessToken
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GithubAccessTokenSpec defines the desired state to generate a GitHub access token.
|
||||
properties:
|
||||
appID:
|
||||
type: string
|
||||
auth:
|
||||
description: Auth configures how ESO authenticates with a Github instance.
|
||||
properties:
|
||||
privateKey:
|
||||
description: GithubSecretRef references a secret containing GitHub credentials.
|
||||
properties:
|
||||
secretRef:
|
||||
description: |-
|
||||
SecretKeySelector is a reference to a specific 'key' within a Secret resource.
|
||||
In some instances, `key` is a required field.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- secretRef
|
||||
type: object
|
||||
required:
|
||||
- privateKey
|
||||
type: object
|
||||
installID:
|
||||
type: string
|
||||
permissions:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Map of permissions the token will have. If omitted, defaults to all permissions the GitHub App has.
|
||||
type: object
|
||||
repositories:
|
||||
description: |-
|
||||
List of repositories the token will have access to. If omitted, defaults to all repositories the GitHub App
|
||||
is installed to.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
url:
|
||||
description: URL configures the GitHub instance URL. Defaults to https://github.com/.
|
||||
type: string
|
||||
required:
|
||||
- appID
|
||||
- auth
|
||||
- installID
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,134 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/grafana.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: grafanas.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Grafana
|
||||
listKind: GrafanaList
|
||||
plural: grafanas
|
||||
singular: grafana
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Grafana represents a generator for Grafana service account tokens.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GrafanaSpec controls the behavior of the grafana generator.
|
||||
properties:
|
||||
auth:
|
||||
description: |-
|
||||
Auth is the authentication configuration to authenticate
|
||||
against the Grafana instance.
|
||||
properties:
|
||||
basic:
|
||||
description: |-
|
||||
Basic auth credentials used to authenticate against the Grafana instance.
|
||||
Note: you need a token which has elevated permissions to create service accounts.
|
||||
See here for the documentation on basic roles offered by Grafana:
|
||||
https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
|
||||
properties:
|
||||
password:
|
||||
description: A basic auth password used to authenticate against the Grafana instance.
|
||||
properties:
|
||||
key:
|
||||
description: The key where the token is found.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
username:
|
||||
description: A basic auth username used to authenticate against the Grafana instance.
|
||||
type: string
|
||||
required:
|
||||
- password
|
||||
- username
|
||||
type: object
|
||||
token:
|
||||
description: |-
|
||||
A service account token used to authenticate against the Grafana instance.
|
||||
Note: you need a token which has elevated permissions to create service accounts.
|
||||
See here for the documentation on basic roles offered by Grafana:
|
||||
https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
|
||||
properties:
|
||||
key:
|
||||
description: The key where the token is found.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
serviceAccount:
|
||||
description: |-
|
||||
ServiceAccount is the configuration for the service account that
|
||||
is supposed to be generated by the generator.
|
||||
properties:
|
||||
name:
|
||||
description: Name is the name of the service account that will be created by ESO.
|
||||
type: string
|
||||
role:
|
||||
description: |-
|
||||
Role is the role of the service account.
|
||||
See here for the documentation on basic roles offered by Grafana:
|
||||
https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- role
|
||||
type: object
|
||||
url:
|
||||
description: URL is the URL of the Grafana instance.
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- serviceAccount
|
||||
- url
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,94 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/mfa.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: mfas.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: MFA
|
||||
listKind: MFAList
|
||||
plural: mfas
|
||||
singular: mfa
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: MFA generates a new TOTP token that is compliant with RFC 6238.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: MFASpec controls the behavior of the mfa generator.
|
||||
properties:
|
||||
algorithm:
|
||||
description: Algorithm to use for encoding. Defaults to SHA1 as per the RFC.
|
||||
type: string
|
||||
length:
|
||||
description: Length defines the token length. Defaults to 6 characters.
|
||||
type: integer
|
||||
secret:
|
||||
description: Secret is a secret selector to a secret containing the seed secret to generate the TOTP value from.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
timePeriod:
|
||||
description: TimePeriod defines how long the token can be active. Defaults to 30 seconds.
|
||||
type: integer
|
||||
when:
|
||||
description: When defines a time parameter that can be used to pin the origin time of the generated token.
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- secret
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,106 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/password.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: passwords.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Password
|
||||
listKind: PasswordList
|
||||
plural: passwords
|
||||
singular: password
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Password generates a random password based on the
|
||||
configuration parameters in spec.
|
||||
You can specify the length, characterset and other attributes.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: PasswordSpec controls the behavior of the password generator.
|
||||
properties:
|
||||
allowRepeat:
|
||||
default: false
|
||||
description: set AllowRepeat to true to allow repeating characters.
|
||||
type: boolean
|
||||
digits:
|
||||
description: |-
|
||||
Digits specifies the number of digits in the generated
|
||||
password. If omitted it defaults to 25% of the length of the password
|
||||
type: integer
|
||||
encoding:
|
||||
default: raw
|
||||
description: |-
|
||||
Encoding specifies the encoding of the generated password.
|
||||
Valid values are:
|
||||
- "raw" (default): no encoding
|
||||
- "base64": standard base64 encoding
|
||||
- "base64url": base64url encoding
|
||||
- "base32": base32 encoding
|
||||
- "hex": hexadecimal encoding
|
||||
enum:
|
||||
- base64
|
||||
- base64url
|
||||
- base32
|
||||
- hex
|
||||
- raw
|
||||
type: string
|
||||
length:
|
||||
default: 24
|
||||
description: |-
|
||||
Length of the password to be generated.
|
||||
Defaults to 24
|
||||
type: integer
|
||||
noUpper:
|
||||
default: false
|
||||
description: Set NoUpper to disable uppercase characters
|
||||
type: boolean
|
||||
symbolCharacters:
|
||||
description: |-
|
||||
SymbolCharacters specifies the special characters that should be used
|
||||
in the generated password.
|
||||
type: string
|
||||
symbols:
|
||||
description: |-
|
||||
Symbols specifies the number of symbol characters in the generated
|
||||
password. If omitted it defaults to 25% of the length of the password
|
||||
type: integer
|
||||
required:
|
||||
- allowRepeat
|
||||
- length
|
||||
- noUpper
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,497 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/pushsecret.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: pushsecrets.external-secrets.io
|
||||
spec:
|
||||
group: external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
kind: PushSecret
|
||||
listKind: PushSecretList
|
||||
plural: pushsecrets
|
||||
shortNames:
|
||||
- ps
|
||||
singular: pushsecret
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].reason
|
||||
name: Status
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PushSecret is the Schema for the PushSecrets API that enables pushing Kubernetes secrets to external secret providers.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: PushSecretSpec configures the behavior of the PushSecret.
|
||||
properties:
|
||||
data:
|
||||
description: Secret Data that should be pushed to providers
|
||||
items:
|
||||
description: PushSecretData defines data to be pushed to the provider and associated metadata.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: Match a given Secret Key to be pushed to the provider.
|
||||
properties:
|
||||
remoteRef:
|
||||
description: Remote Refs to push to providers.
|
||||
properties:
|
||||
property:
|
||||
description: Name of the property in the resulting secret
|
||||
type: string
|
||||
remoteKey:
|
||||
description: Name of the resulting provider secret.
|
||||
type: string
|
||||
required:
|
||||
- remoteKey
|
||||
type: object
|
||||
secretKey:
|
||||
description: Secret Key to be pushed
|
||||
type: string
|
||||
required:
|
||||
- remoteRef
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: array
|
||||
deletionPolicy:
|
||||
default: None
|
||||
description: Deletion Policy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Delete
|
||||
- None
|
||||
type: string
|
||||
refreshInterval:
|
||||
default: 1h
|
||||
description: The Interval to which External Secrets will try to push a secret definition
|
||||
type: string
|
||||
secretStoreRefs:
|
||||
items:
|
||||
description: PushSecretStoreRef contains a reference on how to sync to a SecretStore.
|
||||
properties:
|
||||
kind:
|
||||
default: SecretStore
|
||||
description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
|
||||
enum:
|
||||
- SecretStore
|
||||
- ClusterSecretStore
|
||||
type: string
|
||||
labelSelector:
|
||||
description: Optionally, sync to secret stores with label selector
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
name:
|
||||
description: Optionally, sync to the SecretStore of the given name
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
selector:
|
||||
description: The Secret Selector (k8s source) for the Push Secret
|
||||
maxProperties: 1
|
||||
minProperties: 1
|
||||
properties:
|
||||
generatorRef:
|
||||
description: Point to a generator to create a Secret.
|
||||
properties:
|
||||
apiVersion:
|
||||
default: generators.external-secrets.io/v1alpha1
|
||||
description: Specify the apiVersion of the generator resource
|
||||
type: string
|
||||
kind:
|
||||
description: Specify the Kind of the generator resource
|
||||
enum:
|
||||
- ACRAccessToken
|
||||
- ClusterGenerator
|
||||
- CloudsmithAccessToken
|
||||
- ECRAuthorizationToken
|
||||
- Fake
|
||||
- GCRAccessToken
|
||||
- GithubAccessToken
|
||||
- QuayAccessToken
|
||||
- Password
|
||||
- SSHKey
|
||||
- STSSessionToken
|
||||
- UUID
|
||||
- VaultDynamicSecret
|
||||
- Webhook
|
||||
- Grafana
|
||||
- MFA
|
||||
type: string
|
||||
name:
|
||||
description: Specify the name of the generator resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
secret:
|
||||
description: Select a Secret to Push.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name of the Secret.
|
||||
The Secret must exist in the same namespace as the PushSecret manifest.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
selector:
|
||||
description: Selector chooses secrets using a labelSelector.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
type: object
|
||||
template:
|
||||
description: Template defines a blueprint for the created Secret resource.
|
||||
properties:
|
||||
data:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
engineVersion:
|
||||
default: v2
|
||||
description: |-
|
||||
EngineVersion specifies the template engine version
|
||||
that should be used to compile/execute the
|
||||
template specified in .data and .templateFrom[].
|
||||
enum:
|
||||
- v2
|
||||
type: string
|
||||
mergePolicy:
|
||||
default: Replace
|
||||
description: TemplateMergePolicy defines how the rendered template should be merged with the existing Secret data.
|
||||
enum:
|
||||
- Replace
|
||||
- Merge
|
||||
type: string
|
||||
metadata:
|
||||
description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
finalizers:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
templateFrom:
|
||||
items:
|
||||
description: |-
|
||||
TemplateFrom specifies a source for templates.
|
||||
Each item in the list can either reference a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
configMap:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
literal:
|
||||
type: string
|
||||
secret:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
target:
|
||||
default: Data
|
||||
description: |-
|
||||
Target specifies where to place the template result.
|
||||
For Secret resources, common values are: "Data", "Annotations", "Labels".
|
||||
For custom resources (when spec.target.manifest is set), this supports
|
||||
nested paths like "spec.database.config" or "data".
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type:
|
||||
type: string
|
||||
type: object
|
||||
updatePolicy:
|
||||
default: Replace
|
||||
description: UpdatePolicy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Replace
|
||||
- IfNotExists
|
||||
type: string
|
||||
required:
|
||||
- secretStoreRefs
|
||||
- selector
|
||||
type: object
|
||||
status:
|
||||
description: PushSecretStatus indicates the history of the status of PushSecret.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: PushSecretStatusCondition indicates the status of the PushSecret.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
description: PushSecretConditionType indicates the condition of the PushSecret.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
refreshTime:
|
||||
description: |-
|
||||
refreshTime is the time and date the external secret was fetched and
|
||||
the target secret updated
|
||||
format: date-time
|
||||
nullable: true
|
||||
type: string
|
||||
syncedPushSecrets:
|
||||
additionalProperties:
|
||||
additionalProperties:
|
||||
description: PushSecretData defines data to be pushed to the provider and associated metadata.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: Match a given Secret Key to be pushed to the provider.
|
||||
properties:
|
||||
remoteRef:
|
||||
description: Remote Refs to push to providers.
|
||||
properties:
|
||||
property:
|
||||
description: Name of the property in the resulting secret
|
||||
type: string
|
||||
remoteKey:
|
||||
description: Name of the resulting provider secret.
|
||||
type: string
|
||||
required:
|
||||
- remoteKey
|
||||
type: object
|
||||
secretKey:
|
||||
description: Secret Key to be pushed
|
||||
type: string
|
||||
required:
|
||||
- remoteRef
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: object
|
||||
description: |-
|
||||
Synced PushSecrets, including secrets that already exist in provider.
|
||||
Matches secret stores to PushSecretData that was stored to that secret store.
|
||||
type: object
|
||||
syncedResourceVersion:
|
||||
description: SyncedResourceVersion keeps track of the last synced version.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,90 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/quayaccesstoken.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: quayaccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: QuayAccessToken
|
||||
listKind: QuayAccessTokenList
|
||||
plural: quayaccesstokens
|
||||
singular: quayaccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: QuayAccessToken generates Quay oauth token for pulling/pushing images
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: QuayAccessTokenSpec defines the desired state to generate a Quay access token.
|
||||
properties:
|
||||
robotAccount:
|
||||
description: Name of the robot account you are federating with
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: Name of the service account you are federating with
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
url:
|
||||
description: URL configures the Quay instance URL. Defaults to quay.io.
|
||||
type: string
|
||||
required:
|
||||
- robotAccount
|
||||
- serviceAccountRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,73 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/sshkey.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: sshkeys.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: SSHKey
|
||||
listKind: SSHKeyList
|
||||
plural: sshkeys
|
||||
singular: sshkey
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: SSHKey generates SSH key pairs.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: SSHKeySpec controls the behavior of the ssh key generator.
|
||||
properties:
|
||||
comment:
|
||||
description: Comment specifies an optional comment for the SSH key
|
||||
type: string
|
||||
keySize:
|
||||
description: |-
|
||||
KeySize specifies the key size for RSA keys (default: 2048) and ECDSA keys (default: 256).
|
||||
For RSA keys: 2048, 3072, 4096
|
||||
For ECDSA keys: 256, 384, 521
|
||||
Ignored for ed25519 keys
|
||||
maximum: 8192
|
||||
minimum: 256
|
||||
type: integer
|
||||
keyType:
|
||||
default: rsa
|
||||
description: KeyType specifies the SSH key type (rsa, ecdsa, ed25519)
|
||||
enum:
|
||||
- rsa
|
||||
- ecdsa
|
||||
- ed25519
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,207 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/stssessiontoken.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: stssessiontokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: STSSessionToken
|
||||
listKind: STSSessionTokenList
|
||||
plural: stssessiontokens
|
||||
singular: stssessiontoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
STSSessionToken uses the GetSessionToken API to retrieve an authorization token.
|
||||
The authorization token is valid for 12 hours.
|
||||
The authorizationToken returned is a base64 encoded string that can be decoded.
|
||||
For more information, see GetSessionToken (https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html).
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: STSSessionTokenSpec defines the desired state to generate an AWS STS session token.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth defines how to authenticate with AWS
|
||||
properties:
|
||||
jwt:
|
||||
description: AWSJWTAuth provides configuration to authenticate against AWS using service account tokens.
|
||||
properties:
|
||||
serviceAccountRef:
|
||||
description: ServiceAccountSelector is a reference to a ServiceAccount resource.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
secretRef:
|
||||
description: |-
|
||||
AWSAuthSecretRef holds secret references for AWS credentials
|
||||
both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
|
||||
properties:
|
||||
accessKeyIDSecretRef:
|
||||
description: The AccessKeyID is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
secretAccessKeySecretRef:
|
||||
description: The SecretAccessKey is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
sessionTokenSecretRef:
|
||||
description: |-
|
||||
The SessionToken used for authentication
|
||||
This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
|
||||
see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
region:
|
||||
description: Region specifies the region to operate in.
|
||||
type: string
|
||||
requestParameters:
|
||||
description: RequestParameters contains parameters that can be passed to the STS service.
|
||||
properties:
|
||||
serialNumber:
|
||||
description: |-
|
||||
SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making
|
||||
the GetSessionToken call.
|
||||
Possible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device
|
||||
(such as arn:aws:iam::123456789012:mfa/user)
|
||||
type: string
|
||||
sessionDuration:
|
||||
format: int32
|
||||
type: integer
|
||||
tokenCode:
|
||||
description: TokenCode is the value provided by the MFA device, if MFA is required.
|
||||
type: string
|
||||
type: object
|
||||
role:
|
||||
description: |-
|
||||
You can assume a role before making calls to the
|
||||
desired AWS service.
|
||||
type: string
|
||||
required:
|
||||
- region
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,52 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/uuid.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: uuids.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: UUID
|
||||
listKind: UUIDList
|
||||
plural: uuids
|
||||
singular: uuid
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UUID generates a version 1 UUID (e56657e3-764f-11ef-a397-65231a88c216).
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: UUIDSpec controls the behavior of the uuid generator.
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,223 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/crds/webhook.yaml
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: webhooks.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Webhook
|
||||
listKind: WebhookList
|
||||
plural: webhooks
|
||||
singular: webhook
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Webhook connects to a third party API server to handle the secrets generation
|
||||
configuration parameters in spec.
|
||||
You can specify the server, the token, and additional body parameters.
|
||||
See documentation for the full API specification for requests and responses.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: WebhookSpec controls the behavior of the external generator. Any body parameters should be passed to the server through the parameters field.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth specifies a authorization protocol. Only one protocol may be set.
|
||||
maxProperties: 1
|
||||
minProperties: 1
|
||||
properties:
|
||||
ntlm:
|
||||
description: NTLMProtocol configures the store to use NTLM for auth
|
||||
properties:
|
||||
passwordSecret:
|
||||
description: |-
|
||||
SecretKeySelector is a reference to a specific 'key' within a Secret resource.
|
||||
In some instances, `key` is a required field.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
usernameSecret:
|
||||
description: |-
|
||||
SecretKeySelector is a reference to a specific 'key' within a Secret resource.
|
||||
In some instances, `key` is a required field.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- passwordSecret
|
||||
- usernameSecret
|
||||
type: object
|
||||
type: object
|
||||
body:
|
||||
description: Body
|
||||
type: string
|
||||
caBundle:
|
||||
description: |-
|
||||
PEM encoded CA bundle used to validate webhook server certificate. Only used
|
||||
if the Server URL is using HTTPS protocol. This parameter is ignored for
|
||||
plain HTTP protocol connection. If not set the system root certificates
|
||||
are used to validate the TLS connection.
|
||||
format: byte
|
||||
type: string
|
||||
caProvider:
|
||||
description: The provider for the CA bundle to use to validate webhook server certificate.
|
||||
properties:
|
||||
key:
|
||||
description: The key where the CA certificate can be found in the Secret or ConfigMap.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the object located at the provider type.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: The namespace the Provider type is in.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type:
|
||||
description: The type of provider to use such as "Secret", or "ConfigMap".
|
||||
enum:
|
||||
- Secret
|
||||
- ConfigMap
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- type
|
||||
type: object
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers
|
||||
type: object
|
||||
method:
|
||||
description: Webhook Method
|
||||
type: string
|
||||
result:
|
||||
description: Result formatting
|
||||
properties:
|
||||
jsonPath:
|
||||
description: Json path of return value
|
||||
type: string
|
||||
type: object
|
||||
secrets:
|
||||
description: |-
|
||||
Secrets to fill in templates
|
||||
These secrets will be passed to the templating function as key value pairs under the given name
|
||||
items:
|
||||
description: WebhookSecret defines a secret reference that will be used in webhook templates.
|
||||
properties:
|
||||
name:
|
||||
description: Name of this secret in templates
|
||||
type: string
|
||||
secretRef:
|
||||
description: Secret ref to fill in credentials
|
||||
properties:
|
||||
key:
|
||||
description: The key where the token is found.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
- secretRef
|
||||
type: object
|
||||
type: array
|
||||
timeout:
|
||||
description: Timeout
|
||||
type: string
|
||||
url:
|
||||
description: Webhook url to call
|
||||
type: string
|
||||
required:
|
||||
- result
|
||||
- url
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
@@ -0,0 +1,68 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/cert-controller-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: external-secrets-cert-controller
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-cert-controller
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: external-secrets-cert-controller
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-cert-controller
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
serviceAccountName: external-secrets-cert-controller
|
||||
automountServiceAccountToken: true
|
||||
hostNetwork: false
|
||||
containers:
|
||||
- name: cert-controller
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
image: ghcr.io/external-secrets/external-secrets:v1.1.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- certcontroller
|
||||
- --crd-requeue-interval=5m
|
||||
- --service-name=external-secrets-webhook
|
||||
- --service-namespace=external-secrets
|
||||
- --secret-name=external-secrets-webhook
|
||||
- --secret-namespace=external-secrets
|
||||
- --metrics-addr=:8080
|
||||
- --healthz-addr=:8081
|
||||
- --loglevel=info
|
||||
- --zap-time-encoding=epoch
|
||||
- --enable-partial-cache=true
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
name: metrics
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
port: 8081
|
||||
path: /readyz
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
@@ -0,0 +1,77 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/webhook-deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: external-secrets-webhook
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
hostNetwork: false
|
||||
serviceAccountName: external-secrets-webhook
|
||||
automountServiceAccountToken: true
|
||||
containers:
|
||||
- name: webhook
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
image: ghcr.io/external-secrets/external-secrets:v1.1.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- webhook
|
||||
- --port=10250
|
||||
- --dns-name=external-secrets-webhook.external-secrets.svc
|
||||
- --cert-dir=/tmp/certs
|
||||
- --check-interval=5m
|
||||
- --metrics-addr=:8080
|
||||
- --healthz-addr=:8081
|
||||
- --loglevel=info
|
||||
- --zap-time-encoding=epoch
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
name: metrics
|
||||
- containerPort: 10250
|
||||
protocol: TCP
|
||||
name: webhook
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
port: 8081
|
||||
path: /readyz
|
||||
initialDelaySeconds: 20
|
||||
periodSeconds: 5
|
||||
volumeMounts:
|
||||
- name: certs
|
||||
mountPath: /tmp/certs
|
||||
readOnly: true
|
||||
volumes:
|
||||
- name: certs
|
||||
secret:
|
||||
secretName: external-secrets-webhook
|
||||
@@ -0,0 +1,56 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
replicas: 1
|
||||
revisionHistoryLimit: 10
|
||||
selector:
|
||||
matchLabels:
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
spec:
|
||||
serviceAccountName: external-secrets
|
||||
automountServiceAccountToken: true
|
||||
hostNetwork: false
|
||||
containers:
|
||||
- name: external-secrets
|
||||
securityContext:
|
||||
allowPrivilegeEscalation: false
|
||||
capabilities:
|
||||
drop:
|
||||
- ALL
|
||||
readOnlyRootFilesystem: true
|
||||
runAsNonRoot: true
|
||||
runAsUser: 1000
|
||||
seccompProfile:
|
||||
type: RuntimeDefault
|
||||
image: ghcr.io/external-secrets/external-secrets:v1.1.0
|
||||
imagePullPolicy: IfNotPresent
|
||||
args:
|
||||
- --concurrent=1
|
||||
- --metrics-addr=:8080
|
||||
- --loglevel=info
|
||||
- --zap-time-encoding=epoch
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
protocol: TCP
|
||||
name: metrics
|
||||
dnsPolicy: ClusterFirst
|
||||
@@ -0,0 +1,39 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: Role
|
||||
metadata:
|
||||
name: external-secrets-leaderelection
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
rules:
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
resourceNames:
|
||||
- "external-secrets-controller"
|
||||
verbs:
|
||||
- "get"
|
||||
- "update"
|
||||
- "patch"
|
||||
- apiGroups:
|
||||
- ""
|
||||
resources:
|
||||
- "configmaps"
|
||||
verbs:
|
||||
- "create"
|
||||
- apiGroups:
|
||||
- "coordination.k8s.io"
|
||||
resources:
|
||||
- "leases"
|
||||
verbs:
|
||||
- "get"
|
||||
- "create"
|
||||
- "update"
|
||||
- "patch"
|
||||
@@ -0,0 +1,21 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/rbac.yaml
|
||||
apiVersion: rbac.authorization.k8s.io/v1
|
||||
kind: RoleBinding
|
||||
metadata:
|
||||
name: external-secrets-leaderelection
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
roleRef:
|
||||
apiGroup: rbac.authorization.k8s.io
|
||||
kind: Role
|
||||
name: external-secrets-leaderelection
|
||||
subjects:
|
||||
- kind: ServiceAccount
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
@@ -0,0 +1,14 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/webhook-secret.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: external-secrets-webhook
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
external-secrets.io/component: webhook
|
||||
@@ -0,0 +1,24 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/webhook-service.yaml
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: external-secrets-webhook
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
external-secrets.io/component: webhook
|
||||
spec:
|
||||
type: ClusterIP
|
||||
ports:
|
||||
- port: 443
|
||||
targetPort: webhook
|
||||
protocol: TCP
|
||||
name: webhook
|
||||
selector:
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/cert-controller-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: external-secrets-cert-controller
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-cert-controller
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/webhook-serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: external-secrets-webhook
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
@@ -0,0 +1,13 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/serviceaccount.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: external-secrets
|
||||
namespace: external-secrets
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
@@ -0,0 +1,30 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/validatingwebhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: externalsecret-validate
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
external-secrets.io/component: webhook
|
||||
webhooks:
|
||||
- name: "validate.externalsecret.external-secrets.io"
|
||||
rules:
|
||||
- apiGroups: ["external-secrets.io"]
|
||||
apiVersions: ["v1"]
|
||||
operations: ["CREATE", "UPDATE", "DELETE"]
|
||||
resources: ["externalsecrets"]
|
||||
scope: "Namespaced"
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: external-secrets
|
||||
name: external-secrets-webhook
|
||||
path: /validate-external-secrets-io-v1-externalsecret
|
||||
admissionReviewVersions: ["v1", "v1beta1"]
|
||||
sideEffects: None
|
||||
timeoutSeconds: 5
|
||||
failurePolicy: Fail
|
||||
@@ -0,0 +1,44 @@
|
||||
---
|
||||
# Source: external-secrets/charts/external-secrets/templates/validatingwebhook.yaml
|
||||
apiVersion: admissionregistration.k8s.io/v1
|
||||
kind: ValidatingWebhookConfiguration
|
||||
metadata:
|
||||
name: secretstore-validate
|
||||
labels:
|
||||
helm.sh/chart: external-secrets-1.1.0
|
||||
app.kubernetes.io/name: external-secrets-webhook
|
||||
app.kubernetes.io/instance: external-secrets
|
||||
app.kubernetes.io/version: "v1.1.0"
|
||||
app.kubernetes.io/managed-by: Helm
|
||||
external-secrets.io/component: webhook
|
||||
webhooks:
|
||||
- name: "validate.secretstore.external-secrets.io"
|
||||
rules:
|
||||
- apiGroups: ["external-secrets.io"]
|
||||
apiVersions: ["v1"]
|
||||
operations: ["CREATE", "UPDATE", "DELETE"]
|
||||
resources: ["secretstores"]
|
||||
scope: "Namespaced"
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: external-secrets
|
||||
name: external-secrets-webhook
|
||||
path: /validate-external-secrets-io-v1-secretstore
|
||||
admissionReviewVersions: ["v1", "v1beta1"]
|
||||
sideEffects: None
|
||||
timeoutSeconds: 5
|
||||
- name: "validate.clustersecretstore.external-secrets.io"
|
||||
rules:
|
||||
- apiGroups: ["external-secrets.io"]
|
||||
apiVersions: ["v1"]
|
||||
operations: ["CREATE", "UPDATE", "DELETE"]
|
||||
resources: ["clustersecretstores"]
|
||||
scope: "Cluster"
|
||||
clientConfig:
|
||||
service:
|
||||
namespace: external-secrets
|
||||
name: external-secrets-webhook
|
||||
path: /validate-external-secrets-io-v1-clustersecretstore
|
||||
admissionReviewVersions: ["v1", "v1beta1"]
|
||||
sideEffects: None
|
||||
timeoutSeconds: 5
|
||||
Reference in New Issue
Block a user