apiVersion: apiextensions.k8s.io/v1 kind: CustomResourceDefinition metadata: annotations: controller-gen.kubebuilder.io/version: v0.16.5 labels: external-secrets.io/component: controller name: stssessiontokens.generators.external-secrets.io spec: group: generators.external-secrets.io names: categories: - external-secrets - external-secrets-generators kind: STSSessionToken listKind: STSSessionTokenList plural: stssessiontokens singular: stssessiontoken scope: Namespaced versions: - name: v1alpha1 schema: openAPIV3Schema: description: |- STSSessionToken uses the GetSessionToken API to retrieve an authorization token. The authorization token is valid for 12 hours. The authorizationToken returned is a base64 encoded string that can be decoded. For more information, see GetSessionToken (https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html). properties: apiVersion: description: |- APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources type: string kind: description: |- Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds type: string metadata: type: object spec: properties: auth: description: Auth defines how to authenticate with AWS properties: jwt: description: Authenticate against AWS using service account tokens. properties: serviceAccountRef: description: A reference to a ServiceAccount resource. properties: audiences: description: |- Audience specifies the `aud` claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list items: type: string type: array name: description: The name of the ServiceAccount resource being referred to. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string namespace: description: |- Namespace of the resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string required: - name type: object type: object secretRef: description: |- AWSAuthSecretRef holds secret references for AWS credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate. properties: accessKeyIDSecretRef: description: The AccessKeyID is used for authentication properties: key: description: |- A key in the referenced Secret. Some instances of this field may be defaulted, in others it may be required. maxLength: 253 minLength: 1 pattern: ^[-._a-zA-Z0-9]+$ type: string name: description: The name of the Secret resource being referred to. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string namespace: description: |- The namespace of the Secret resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object secretAccessKeySecretRef: description: The SecretAccessKey is used for authentication properties: key: description: |- A key in the referenced Secret. Some instances of this field may be defaulted, in others it may be required. maxLength: 253 minLength: 1 pattern: ^[-._a-zA-Z0-9]+$ type: string name: description: The name of the Secret resource being referred to. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string namespace: description: |- The namespace of the Secret resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object sessionTokenSecretRef: description: |- The SessionToken used for authentication This must be defined if AccessKeyID and SecretAccessKey are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html properties: key: description: |- A key in the referenced Secret. Some instances of this field may be defaulted, in others it may be required. maxLength: 253 minLength: 1 pattern: ^[-._a-zA-Z0-9]+$ type: string name: description: The name of the Secret resource being referred to. maxLength: 253 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$ type: string namespace: description: |- The namespace of the Secret resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. maxLength: 63 minLength: 1 pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$ type: string type: object type: object type: object region: description: Region specifies the region to operate in. type: string requestParameters: description: RequestParameters contains parameters that can be passed to the STS service. properties: serialNumber: description: |- SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making the GetSessionToken call. Possible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device (such as arn:aws:iam::123456789012:mfa/user) type: string sessionDuration: description: |- SessionDuration The duration, in seconds, that the credentials should remain valid. Acceptable durations for IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with 43,200 seconds (12 hours) as the default. format: int64 type: integer tokenCode: description: TokenCode is the value provided by the MFA device, if MFA is required. type: string type: object role: description: |- You can assume a role before making calls to the desired AWS service. type: string required: - region type: object type: object served: true storage: true subresources: status: {}