1
0
Fork 0
mirror of https://github.com/external-secrets/external-secrets.git synced 2024-12-14 11:57:59 +00:00
external-secrets/config/crds/bases/external-secrets.io_externalsecrets.yaml

829 lines
35 KiB
YAML
Raw Normal View History

apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.14.0
name: externalsecrets.external-secrets.io
spec:
group: external-secrets.io
names:
categories:
- externalsecrets
kind: ExternalSecret
listKind: ExternalSecretList
plural: externalsecrets
shortNames:
- es
singular: externalsecret
scope: Namespaced
versions:
- additionalPrinterColumns:
- jsonPath: .spec.secretStoreRef.name
name: Store
type: string
- jsonPath: .spec.refreshInterval
name: Refresh Interval
type: string
- jsonPath: .status.conditions[?(@.type=="Ready")].reason
name: Status
type: string
deprecated: true
name: v1alpha1
schema:
openAPIV3Schema:
2020-12-29 20:50:43 +00:00
description: ExternalSecret is the Schema for the external-secrets API.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
2020-12-21 19:31:28 +00:00
description: ExternalSecretSpec defines the desired state of ExternalSecret.
properties:
data:
description: Data defines the connection between the Kubernetes Secret
keys and the Provider data
items:
description: ExternalSecretData defines the connection between the
2020-12-21 19:31:28 +00:00
Kubernetes Secret key (spec.data.<key>) and the Provider data.
properties:
remoteRef:
description: ExternalSecretDataRemoteRef defines Provider data
2020-12-21 19:31:28 +00:00
location.
properties:
conversionStrategy:
default: Default
description: Used to define a conversion Strategy
enum:
- Default
- Unicode
type: string
2022-01-25 21:01:33 +00:00
key:
description: Key is the key used in the Provider, mandatory
type: string
property:
description: Used to select a specific property of the Provider
value (if a map), if supported
type: string
version:
description: Used to select a specific version of the Provider
value, if supported
type: string
required:
- key
type: object
secretKey:
type: string
required:
- remoteRef
- secretKey
type: object
type: array
dataFrom:
description: |-
DataFrom is used to fetch all properties from a specific Provider data
If multiple entries are specified, the Secret keys are merged in the specified order
items:
description: ExternalSecretDataRemoteRef defines Provider data location.
properties:
conversionStrategy:
default: Default
description: Used to define a conversion Strategy
enum:
- Default
- Unicode
type: string
key:
description: Key is the key used in the Provider, mandatory
type: string
property:
description: Used to select a specific property of the Provider
value (if a map), if supported
type: string
version:
description: Used to select a specific version of the Provider
value, if supported
type: string
required:
- key
type: object
type: array
refreshInterval:
default: 1h
description: |-
RefreshInterval is the amount of time before the values are read again from the SecretStore provider
Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
May be set to zero to fetch and create it once. Defaults to 1h.
type: string
secretStoreRef:
description: SecretStoreRef defines which SecretStore to fetch the
2020-12-21 19:31:28 +00:00
ExternalSecret data.
properties:
kind:
description: |-
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Defaults to `SecretStore`
type: string
name:
description: Name of the SecretStore resource
type: string
required:
- name
type: object
target:
description: |-
ExternalSecretTarget defines the Kubernetes Secret to be created
There can be only one target per ExternalSecret.
properties:
creationPolicy:
default: Owner
description: |-
CreationPolicy defines rules on how to create the resulting Secret
Defaults to 'Owner'
enum:
- Owner
- Merge
- None
type: string
immutable:
description: Immutable defines if the final secret will be immutable
type: boolean
name:
description: |-
Name defines the name of the Secret resource to be managed
This field is immutable
Defaults to the .metadata.name of the ExternalSecret resource
type: string
template:
description: Template defines a blueprint for the created Secret
resource.
properties:
data:
additionalProperties:
type: string
type: object
engineVersion:
default: v1
description: |-
EngineVersion specifies the template engine version
that should be used to compile/execute the
template specified in .data and .templateFrom[].
enum:
- v1
- v2
type: string
metadata:
description: ExternalSecretTemplateMetadata defines metadata
fields for the Secret blueprint.
properties:
annotations:
additionalProperties:
type: string
type: object
labels:
additionalProperties:
type: string
type: object
type: object
templateFrom:
items:
maxProperties: 1
minProperties: 1
properties:
configMap:
properties:
items:
items:
properties:
key:
type: string
required:
- key
type: object
type: array
name:
type: string
required:
- items
- name
type: object
secret:
properties:
items:
items:
properties:
key:
type: string
required:
- key
type: object
type: array
name:
type: string
required:
- items
- name
type: object
type: object
type: array
type:
type: string
type: object
type: object
required:
- secretStoreRef
- target
type: object
status:
properties:
binding:
description: Binding represents a servicebinding.io Provisioned Service
reference to the secret
properties:
name:
description: |-
Name of the referent.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
conditions:
items:
properties:
lastTransitionTime:
format: date-time
type: string
message:
type: string
reason:
type: string
status:
type: string
type:
type: string
required:
- status
- type
type: object
type: array
refreshTime:
description: |-
refreshTime is the time and date the external secret was fetched and
the target secret updated
format: date-time
nullable: true
type: string
syncedResourceVersion:
description: SyncedResourceVersion keeps track of the last synced
version
type: string
type: object
type: object
served: true
storage: false
subresources:
status: {}
- additionalPrinterColumns:
- jsonPath: .spec.secretStoreRef.name
name: Store
type: string
- jsonPath: .spec.refreshInterval
name: Refresh Interval
type: string
- jsonPath: .status.conditions[?(@.type=="Ready")].reason
name: Status
type: string
- jsonPath: .status.conditions[?(@.type=="Ready")].status
name: Ready
type: string
name: v1beta1
schema:
openAPIV3Schema:
description: ExternalSecret is the Schema for the external-secrets API.
properties:
apiVersion:
description: |-
APIVersion defines the versioned schema of this representation of an object.
Servers should convert recognized schemas to the latest internal value, and
may reject unrecognized values.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
type: string
kind:
description: |-
Kind is a string value representing the REST resource this object represents.
Servers may infer this from the endpoint the client submits requests to.
Cannot be updated.
In CamelCase.
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
type: string
metadata:
type: object
spec:
description: ExternalSecretSpec defines the desired state of ExternalSecret.
properties:
data:
description: Data defines the connection between the Kubernetes Secret
keys and the Provider data
items:
description: ExternalSecretData defines the connection between the
Kubernetes Secret key (spec.data.<key>) and the Provider data.
properties:
remoteRef:
description: |-
RemoteRef points to the remote secret and defines
which secret (version/property/..) to fetch.
properties:
conversionStrategy:
default: Default
description: Used to define a conversion Strategy
enum:
- Default
- Unicode
type: string
decodingStrategy:
default: None
description: Used to define a decoding Strategy
enum:
- Auto
- Base64
- Base64URL
- None
type: string
key:
description: Key is the key used in the Provider, mandatory
type: string
2022-04-28 08:29:34 +00:00
metadataPolicy:
default: None
2022-04-28 08:29:34 +00:00
description: Policy for fetching tags/labels from provider
secrets, possible options are Fetch, None. Defaults to
None
enum:
- None
- Fetch
2022-04-28 08:29:34 +00:00
type: string
property:
description: Used to select a specific property of the Provider
value (if a map), if supported
type: string
version:
description: Used to select a specific version of the Provider
value, if supported
type: string
required:
- key
type: object
secretKey:
description: |-
SecretKey defines the key in which the controller stores
the value. This is the key in the Kind=Secret
type: string
sourceRef:
description: |-
SourceRef allows you to override the source
from which the value will pulled from.
maxProperties: 1
properties:
generatorRef:
description: |-
GeneratorRef points to a generator custom resource.
Deprecated: The generatorRef is not implemented in .data[].
this will be removed with v1.
properties:
apiVersion:
default: generators.external-secrets.io/v1alpha1
description: Specify the apiVersion of the generator
resource
type: string
kind:
description: Specify the Kind of the resource, e.g.
Password, ACRAccessToken etc.
type: string
name:
description: Specify the name of the generator resource
type: string
required:
- kind
- name
type: object
storeRef:
description: SecretStoreRef defines which SecretStore to
fetch the ExternalSecret data.
properties:
kind:
description: |-
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Defaults to `SecretStore`
type: string
name:
description: Name of the SecretStore resource
type: string
required:
- name
type: object
type: object
required:
- remoteRef
- secretKey
type: object
type: array
dataFrom:
description: |-
DataFrom is used to fetch all properties from a specific Provider data
If multiple entries are specified, the Secret keys are merged in the specified order
items:
properties:
extract:
description: |-
Used to extract multiple key/value pairs from one secret
Note: Extract does not support sourceRef.Generator or sourceRef.GeneratorRef.
properties:
conversionStrategy:
default: Default
description: Used to define a conversion Strategy
enum:
- Default
- Unicode
type: string
decodingStrategy:
default: None
description: Used to define a decoding Strategy
enum:
- Auto
- Base64
- Base64URL
- None
type: string
key:
description: Key is the key used in the Provider, mandatory
type: string
2022-04-28 08:29:34 +00:00
metadataPolicy:
default: None
2022-04-28 08:29:34 +00:00
description: Policy for fetching tags/labels from provider
secrets, possible options are Fetch, None. Defaults to
None
enum:
- None
- Fetch
2022-04-28 08:29:34 +00:00
type: string
property:
description: Used to select a specific property of the Provider
value (if a map), if supported
type: string
version:
description: Used to select a specific version of the Provider
value, if supported
type: string
required:
- key
type: object
find:
description: |-
Used to find secrets based on tags or regular expressions
Note: Find does not support sourceRef.Generator or sourceRef.GeneratorRef.
properties:
conversionStrategy:
default: Default
description: Used to define a conversion Strategy
enum:
- Default
- Unicode
type: string
decodingStrategy:
default: None
description: Used to define a decoding Strategy
enum:
- Auto
- Base64
- Base64URL
- None
type: string
name:
description: Finds secrets based on the name.
properties:
regexp:
description: Finds secrets base
type: string
type: object
path:
description: A root path to start the find operations.
type: string
tags:
additionalProperties:
type: string
description: Find secrets based on tags.
type: object
type: object
rewrite:
description: |-
Used to rewrite secret Keys after getting them from the secret Provider
Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)
items:
properties:
regexp:
description: |-
Used to rewrite with regular expressions.
The resulting key will be the output of a regexp.ReplaceAll operation.
properties:
source:
description: Used to define the regular expression
of a re.Compiler.
type: string
target:
description: Used to define the target pattern of
a ReplaceAll operation.
type: string
required:
- source
- target
type: object
transform:
description: |-
Used to apply string transformation on the secrets.
The resulting key will be the output of the template applied by the operation.
properties:
template:
description: |-
Used to define the template to apply on the secret name.
`.value ` will specify the secret name in the template.
type: string
required:
- template
type: object
type: object
type: array
sourceRef:
description: |-
SourceRef points to a store or generator
which contains secret values ready to use.
Use this in combination with Extract or Find pull values out of
a specific SecretStore.
When sourceRef points to a generator Extract or Find is not supported.
The generator returns a static map of values
maxProperties: 1
properties:
generatorRef:
description: GeneratorRef points to a generator custom resource.
properties:
apiVersion:
default: generators.external-secrets.io/v1alpha1
description: Specify the apiVersion of the generator
resource
type: string
kind:
description: Specify the Kind of the resource, e.g.
Password, ACRAccessToken etc.
type: string
name:
description: Specify the name of the generator resource
type: string
required:
- kind
- name
type: object
storeRef:
description: SecretStoreRef defines which SecretStore to
fetch the ExternalSecret data.
properties:
kind:
description: |-
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Defaults to `SecretStore`
type: string
name:
description: Name of the SecretStore resource
type: string
required:
- name
type: object
type: object
type: object
type: array
refreshInterval:
default: 1h
description: |-
RefreshInterval is the amount of time before the values are read again from the SecretStore provider
Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h"
May be set to zero to fetch and create it once. Defaults to 1h.
type: string
secretStoreRef:
description: SecretStoreRef defines which SecretStore to fetch the
ExternalSecret data.
properties:
kind:
description: |-
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Defaults to `SecretStore`
type: string
name:
description: Name of the SecretStore resource
type: string
required:
- name
type: object
target:
default:
creationPolicy: Owner
deletionPolicy: Retain
description: |-
ExternalSecretTarget defines the Kubernetes Secret to be created
There can be only one target per ExternalSecret.
properties:
creationPolicy:
default: Owner
description: |-
CreationPolicy defines rules on how to create the resulting Secret
Defaults to 'Owner'
enum:
- Owner
- Orphan
- Merge
- None
type: string
deletionPolicy:
default: Retain
description: |-
DeletionPolicy defines rules on how to delete the resulting Secret
Defaults to 'Retain'
enum:
- Delete
- Merge
- Retain
type: string
immutable:
description: Immutable defines if the final secret will be immutable
type: boolean
name:
description: |-
Name defines the name of the Secret resource to be managed
This field is immutable
Defaults to the .metadata.name of the ExternalSecret resource
type: string
template:
description: Template defines a blueprint for the created Secret
resource.
properties:
data:
additionalProperties:
type: string
type: object
engineVersion:
default: v2
description: |-
EngineVersion specifies the template engine version
that should be used to compile/execute the
template specified in .data and .templateFrom[].
enum:
- v1
- v2
type: string
mergePolicy:
default: Replace
enum:
- Replace
- Merge
type: string
metadata:
description: ExternalSecretTemplateMetadata defines metadata
fields for the Secret blueprint.
properties:
annotations:
additionalProperties:
type: string
type: object
labels:
additionalProperties:
type: string
type: object
type: object
2021-06-25 23:56:42 +00:00
templateFrom:
items:
properties:
configMap:
properties:
items:
items:
properties:
key:
type: string
templateAs:
default: Values
enum:
- Values
- KeysAndValues
type: string
2021-06-25 23:56:42 +00:00
required:
- key
type: object
type: array
name:
type: string
required:
- items
- name
type: object
literal:
type: string
2021-06-25 23:56:42 +00:00
secret:
properties:
items:
items:
properties:
key:
type: string
templateAs:
default: Values
enum:
- Values
- KeysAndValues
type: string
2021-06-25 23:56:42 +00:00
required:
- key
type: object
type: array
name:
type: string
required:
- items
- name
type: object
target:
default: Data
enum:
- Data
- Annotations
- Labels
type: string
2021-06-25 23:56:42 +00:00
type: object
type: array
type:
type: string
type: object
type: object
type: object
status:
properties:
binding:
description: Binding represents a servicebinding.io Provisioned Service
reference to the secret
properties:
name:
description: |-
Name of the referent.
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
TODO: Add other useful fields. apiVersion, kind, uid?
type: string
type: object
x-kubernetes-map-type: atomic
conditions:
items:
properties:
lastTransitionTime:
format: date-time
type: string
message:
type: string
reason:
type: string
status:
type: string
type:
type: string
required:
- status
- type
type: object
type: array
refreshTime:
description: |-
refreshTime is the time and date the external secret was fetched and
the target secret updated
format: date-time
nullable: true
type: string
syncedResourceVersion:
description: SyncedResourceVersion keeps track of the last synced
version
type: string
type: object
type: object
served: true
storage: true
subresources:
status: {}