cdktf-crd
Version:
420 lines (419 loc) • 30.1 kB
TypeScript
import { Manifest, type ManifestConfig } from "@cdktf/provider-kubernetes/lib/manifest";
import { Construct } from "constructs";
export declare class KubernetesVaultDynamicSecretV1alpha1Manifest extends Manifest {
constructor(scope: Construct, id: string, config: KubernetesVaultDynamicSecretV1alpha1ManifestConfig);
}
export interface KubernetesVaultDynamicSecretV1alpha1ManifestConfig extends ManifestConfig {
manifest: {
apiVersion?: "generators.external-secrets.io/v1alpha1";
kind?: "VaultDynamicSecret";
metadata: {
annotations?: {
[key: string]: string;
};
labels?: {
[key: string]: string;
};
name: string;
namespace?: string;
};
spec?: {
/** @description Used to select the correct ESO controller (think: ingress.ingressClassName)
* The ESO controller is instantiated with a specific controller name and filters VDS based on this property */
controller?: string;
/** @description Vault API method to use (GET/POST/other) */
method?: string;
/** @description Parameters to pass to Vault write (for non-GET methods) */
parameters?: unknown;
/** @description Vault path to obtain the dynamic secret from */
path: string;
/** @description Vault provider common spec */
provider: {
/** @description Auth configures how secret-manager authenticates with the Vault server. */
auth: {
/** @description AppRole authenticates with Vault using the App Role auth mechanism,
* with the role and secret stored in a Kubernetes Secret resource. */
appRole?: {
/** @description Path where the App Role authentication backend is mounted
* in Vault, e.g: "approle" */
path: string;
/** @description RoleID configured in the App Role authentication backend when setting
* up the authentication backend in Vault. */
roleId?: string;
/** @description Reference to a key in a Secret that contains the App Role ID used
* to authenticate with Vault.
* The `key` field must be specified and denotes which entry within the Secret
* resource is used as the app role id. */
roleRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description Reference to a key in a Secret that contains the App Role secret used
* to authenticate with Vault.
* The `key` field must be specified and denotes which entry within the Secret
* resource is used as the app role secret. */
secretRef: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
* Cert authentication method */
cert?: {
/** @description ClientCert is a certificate to authenticate using the Cert Vault
* authentication method */
clientCert?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description SecretRef to a key in a Secret resource containing client private key to
* authenticate with Vault using the Cert authentication method */
secretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
* AWS IAM authentication method */
iam?: {
/** @description AWS External ID set on assumed IAM roles */
externalID?: string;
/** @description Specify a service account with IRSA enabled */
jwt?: {
/** @description A reference to a ServiceAccount resource. */
serviceAccountRef?: {
/** @description Audience specifies the `aud` claim for the service account token
* If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
* then this audiences will be appended to the list */
audiences?: string[];
/** @description The name of the ServiceAccount resource being referred to. */
name: string;
/** @description Namespace of the resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description Path where the AWS auth method is enabled in Vault, e.g: "aws" */
path?: string;
/** @description AWS region */
region?: string;
/** @description This is the AWS role to be assumed before talking to vault */
role?: string;
/** @description Specify credentials in a Secret object */
secretRef?: {
/** @description The AccessKeyID is used for authentication */
accessKeyIDSecretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description The SecretAccessKey is used for authentication */
secretAccessKeySecretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description The SessionToken used for authentication
* This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
* see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html */
sessionTokenSecretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws */
vaultAwsIamServerID?: string;
/** @description Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine */
vaultRole: string;
};
/** @description Jwt authenticates with Vault by passing role and JWT token using the
* JWT/OIDC authentication method */
jwt?: {
/** @description Optional ServiceAccountToken specifies the Kubernetes service account for which to request
* a token for with the `TokenRequest` API. */
kubernetesServiceAccountToken?: {
/** @description Optional audiences field that will be used to request a temporary Kubernetes service
* account token for the service account referenced by `serviceAccountRef`.
* Defaults to a single audience `vault` it not specified.
* Deprecated: use serviceAccountRef.Audiences instead */
audiences?: string[];
/**
* Format: int64
* @description Optional expiration time in seconds that will be used to request a temporary
* Kubernetes service account token for the service account referenced by
* `serviceAccountRef`.
* Deprecated: this will be removed in the future.
* Defaults to 10 minutes.
*/
expirationSeconds?: number;
/** @description Service account field containing the name of a kubernetes ServiceAccount. */
serviceAccountRef: {
/** @description Audience specifies the `aud` claim for the service account token
* If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
* then this audiences will be appended to the list */
audiences?: string[];
/** @description The name of the ServiceAccount resource being referred to. */
name: string;
/** @description Namespace of the resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description Path where the JWT authentication backend is mounted
* in Vault, e.g: "jwt" */
path: string;
/** @description Role is a JWT role to authenticate using the JWT/OIDC Vault
* authentication method */
role?: string;
/** @description Optional SecretRef that refers to a key in a Secret resource containing JWT token to
* authenticate with Vault using the JWT/OIDC authentication method. */
secretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description Kubernetes authenticates with Vault by passing the ServiceAccount
* token stored in the named Secret resource to the Vault server. */
kubernetes?: {
/** @description Path where the Kubernetes authentication backend is mounted in Vault, e.g:
* "kubernetes" */
mountPath: string;
/** @description A required field containing the Vault Role to assume. A Role binds a
* Kubernetes ServiceAccount with a set of Vault policies. */
role: string;
/** @description Optional secret field containing a Kubernetes ServiceAccount JWT used
* for authenticating with Vault. If a name is specified without a key,
* `token` is the default. If one is not specified, the one bound to
* the controller will be used. */
secretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description Optional service account field containing the name of a kubernetes ServiceAccount.
* If the service account is specified, the service account secret token JWT will be used
* for authenticating with Vault. If the service account selector is not supplied,
* the secretRef will be used instead. */
serviceAccountRef?: {
/** @description Audience specifies the `aud` claim for the service account token
* If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
* then this audiences will be appended to the list */
audiences?: string[];
/** @description The name of the ServiceAccount resource being referred to. */
name: string;
/** @description Namespace of the resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description Ldap authenticates with Vault by passing username/password pair using
* the LDAP authentication method */
ldap?: {
/** @description Path where the LDAP authentication backend is mounted
* in Vault, e.g: "ldap" */
path: string;
/** @description SecretRef to a key in a Secret resource containing password for the LDAP
* user used to authenticate with Vault using the LDAP authentication
* method */
secretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description Username is a LDAP user name used to authenticate using the LDAP Vault
* authentication method */
username: string;
};
/** @description Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
* Namespaces is a set of features within Vault Enterprise that allows
* Vault environments to support Secure Multi-tenancy. e.g: "ns1".
* More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
* This will default to Vault.Namespace field if set, or empty otherwise */
namespace?: string;
/** @description TokenSecretRef authenticates with Vault by presenting a token. */
tokenSecretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description UserPass authenticates with Vault by passing username/password pair */
userPass?: {
/** @description Path where the UserPassword authentication backend is mounted
* in Vault, e.g: "user" */
path: string;
/** @description SecretRef to a key in a Secret resource containing password for the
* user used to authenticate with Vault using the UserPass authentication
* method */
secretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description Username is a user name used to authenticate using the UserPass Vault
* authentication method */
username: string;
};
};
/**
* Format: byte
* @description PEM encoded CA bundle used to validate Vault server certificate. Only used
* if the Server URL is using HTTPS protocol. This parameter is ignored for
* plain HTTP protocol connection. If not set the system root certificates
* are used to validate the TLS connection.
*/
caBundle?: string;
/** @description The provider for the CA bundle to use to validate Vault server certificate. */
caProvider?: {
/** @description The key where the CA certificate can be found in the Secret or ConfigMap. */
key?: string;
/** @description The name of the object located at the provider type. */
name: string;
/** @description The namespace the Provider type is in.
* Can only be defined when used in a ClusterSecretStore. */
namespace?: string;
/** @description The type of provider to use such as "Secret", or "ConfigMap". */
type: string;
};
/** @description ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
* leader instead of simply retrying within a loop. This can increase performance if
* the option is enabled serverside.
* https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header */
forwardInconsistent?: boolean;
/** @description Headers to be added in Vault request */
headers?: {
[key: string]: string;
};
/** @description Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
* Vault environments to support Secure Multi-tenancy. e.g: "ns1".
* More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces */
namespace?: string;
/** @description Path is the mount path of the Vault KV backend endpoint, e.g:
* "secret". The v2 KV secret engine version specific "/data" path suffix
* for fetching secrets from Vault is optional and will be appended
* if not present in specified path. */
path?: string;
/** @description ReadYourWrites ensures isolated read-after-write semantics by
* providing discovered cluster replication states in each request.
* More information about eventual consistency in Vault can be found here
* https://www.vaultproject.io/docs/enterprise/consistency */
readYourWrites?: boolean;
/** @description Server is the connection address for the Vault server, e.g: "https://vault.example.com:8200". */
server: string;
/** @description The configuration used for client side related TLS communication, when the Vault server
* requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
* This parameter is ignored for plain HTTP protocol connection.
* It's worth noting this configuration is different from the "TLS certificates auth method",
* which is available under the `auth.cert` section. */
tls?: {
/** @description CertSecretRef is a certificate added to the transport layer
* when communicating with the Vault server.
* If no key for the Secret is specified, external-secret will default to 'tls.crt'. */
certSecretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
/** @description KeySecretRef to a key in a Secret resource containing client private key
* added to the transport layer when communicating with the Vault server.
* If no key for the Secret is specified, external-secret will default to 'tls.key'. */
keySecretRef?: {
/** @description A key in the referenced Secret.
* Some instances of this field may be defaulted, in others it may be required. */
key?: string;
/** @description The name of the Secret resource being referred to. */
name?: string;
/** @description The namespace of the Secret resource being referred to.
* Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent. */
namespace?: string;
};
};
/** @description Version is the Vault KV secret engine version. This can be either "v1" or
* "v2". Version defaults to "v2". */
version?: string;
};
/** @description Result type defines which data is returned from the generator.
* By default it is the "data" section of the Vault API response.
* When using e.g. /auth/token/create the "data" section is empty but
* the "auth" section contains the generated token.
* Please refer to the vault docs regarding the result data structure. */
resultType?: string;
/** @description Used to configure http retries if failed */
retrySettings?: {
/** Format: int32 */
maxRetries?: number;
retryInterval?: string;
};
};
};
}