Remove ArgoCD certificate and key files; add External Secrets Helm chart with Bitwarden SDK server integration, including configuration files, templates, and monitoring dashboard.
This commit is contained in:
216
manifest/external-secrets/templates/crds/acraccesstoken.yaml
Normal file
216
manifest/external-secrets/templates/crds/acraccesstoken.yaml
Normal file
@@ -0,0 +1,216 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: acraccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: ACRAccessToken
|
||||
listKind: ACRAccessTokenList
|
||||
plural: acraccesstokens
|
||||
singular: acraccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ACRAccessToken returns an Azure Container Registry token
|
||||
that can be used for pushing/pulling images.
|
||||
Note: by default it will return an ACR Refresh Token with full access
|
||||
(depending on the identity).
|
||||
This can be scoped down to the repository level using .spec.scope.
|
||||
In case scope is defined it will return an ACR Access Token.
|
||||
|
||||
See docs: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: |-
|
||||
ACRAccessTokenSpec defines how to generate the access token
|
||||
e.g. how to authenticate and which registry to use.
|
||||
see: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md#overview
|
||||
properties:
|
||||
auth:
|
||||
description: ACRAuth defines the authentication methods for Azure Container Registry.
|
||||
properties:
|
||||
managedIdentity:
|
||||
description: ManagedIdentity uses Azure Managed Identity to authenticate with Azure.
|
||||
properties:
|
||||
identityId:
|
||||
description: If multiple Managed Identity is assigned to the pod, you can select the one to be used
|
||||
type: string
|
||||
type: object
|
||||
servicePrincipal:
|
||||
description: ServicePrincipal uses Azure Service Principal credentials to authenticate with Azure.
|
||||
properties:
|
||||
secretRef:
|
||||
description: |-
|
||||
AzureACRServicePrincipalAuthSecretRef defines the secret references for Azure Service Principal authentication.
|
||||
It uses static credentials stored in a Kind=Secret.
|
||||
properties:
|
||||
clientId:
|
||||
description: The Azure clientId of the service principle used for authentication.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
clientSecret:
|
||||
description: The Azure ClientSecret of the service principle used for authentication.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
required:
|
||||
- secretRef
|
||||
type: object
|
||||
workloadIdentity:
|
||||
description: WorkloadIdentity uses Azure Workload Identity to authenticate with Azure.
|
||||
properties:
|
||||
serviceAccountRef:
|
||||
description: |-
|
||||
ServiceAccountRef specified the service account
|
||||
that should be used when authenticating with WorkloadIdentity.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
environmentType:
|
||||
default: PublicCloud
|
||||
description: |-
|
||||
EnvironmentType specifies the Azure cloud environment endpoints to use for
|
||||
connecting and authenticating with Azure. By default, it points to the public cloud AAD endpoint.
|
||||
The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152
|
||||
PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
|
||||
enum:
|
||||
- PublicCloud
|
||||
- USGovernmentCloud
|
||||
- ChinaCloud
|
||||
- GermanCloud
|
||||
- AzureStackCloud
|
||||
type: string
|
||||
registry:
|
||||
description: |-
|
||||
the domain name of the ACR registry
|
||||
e.g. foobarexample.azurecr.io
|
||||
type: string
|
||||
scope:
|
||||
description: |-
|
||||
Define the scope for the access token, e.g. pull/push access for a repository.
|
||||
if not provided it will return a refresh token that has full scope.
|
||||
Note: you need to pin it down to the repository level, there is no wildcard available.
|
||||
|
||||
examples:
|
||||
repository:my-repository:pull,push
|
||||
repository:my-repository:pull
|
||||
|
||||
see docs for details: https://docs.docker.com/registry/spec/auth/scope/
|
||||
type: string
|
||||
tenantId:
|
||||
description: TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- registry
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,100 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: cloudsmithaccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: CloudsmithAccessToken
|
||||
listKind: CloudsmithAccessTokenList
|
||||
plural: cloudsmithaccesstokens
|
||||
singular: cloudsmithaccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: CloudsmithAccessToken generates Cloudsmith access token using OIDC authentication
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: CloudsmithAccessTokenSpec defines the configuration for generating a Cloudsmith access token using OIDC authentication.
|
||||
properties:
|
||||
apiUrl:
|
||||
description: APIURL configures the Cloudsmith API URL. Defaults to https://api.cloudsmith.io.
|
||||
type: string
|
||||
orgSlug:
|
||||
description: OrgSlug is the organization slug in Cloudsmith
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: Name of the service account you are federating with
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
serviceSlug:
|
||||
description: ServiceSlug is the service slug in Cloudsmith for OIDC authentication
|
||||
type: string
|
||||
required:
|
||||
- orgSlug
|
||||
- serviceAccountRef
|
||||
- serviceSlug
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
1589
manifest/external-secrets/templates/crds/clusterexternalsecret.yaml
Normal file
1589
manifest/external-secrets/templates/crds/clusterexternalsecret.yaml
Normal file
File diff suppressed because it is too large
Load Diff
2251
manifest/external-secrets/templates/crds/clustergenerator.yaml
Normal file
2251
manifest/external-secrets/templates/crds/clustergenerator.yaml
Normal file
File diff suppressed because it is too large
Load Diff
686
manifest/external-secrets/templates/crds/clusterpushsecret.yaml
Normal file
686
manifest/external-secrets/templates/crds/clusterpushsecret.yaml
Normal file
@@ -0,0 +1,686 @@
|
||||
{{- if and (.Values.installCRDs) (.Values.crds.createClusterPushSecret) }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: clusterpushsecrets.external-secrets.io
|
||||
spec:
|
||||
group: external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
kind: ClusterPushSecret
|
||||
listKind: ClusterPushSecretList
|
||||
plural: clusterpushsecrets
|
||||
singular: clusterpushsecret
|
||||
scope: Cluster
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].reason
|
||||
name: Status
|
||||
type: string
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: ClusterPushSecret is the Schema for the ClusterPushSecrets API that enables cluster-wide management of pushing Kubernetes secrets to external providers.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ClusterPushSecretSpec defines the configuration for a ClusterPushSecret resource.
|
||||
properties:
|
||||
namespaceSelectors:
|
||||
description: A list of labels to select by to find the Namespaces to create the ExternalSecrets in. The selectors are ORed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector is a label query over a set of resources. The result of matchLabels and
|
||||
matchExpressions are ANDed. An empty label selector matches all objects. A null
|
||||
label selector matches no objects.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: array
|
||||
pushSecretMetadata:
|
||||
description: The metadata of the external secrets to be created
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
pushSecretName:
|
||||
description: |-
|
||||
The name of the push secrets to be created.
|
||||
Defaults to the name of the ClusterPushSecret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
pushSecretSpec:
|
||||
description: PushSecretSpec defines what to do with the secrets.
|
||||
properties:
|
||||
data:
|
||||
description: Secret Data that should be pushed to providers
|
||||
items:
|
||||
description: PushSecretData defines data to be pushed to the provider and associated metadata.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: Match a given Secret Key to be pushed to the provider.
|
||||
properties:
|
||||
remoteRef:
|
||||
description: Remote Refs to push to providers.
|
||||
properties:
|
||||
property:
|
||||
description: Name of the property in the resulting secret
|
||||
type: string
|
||||
remoteKey:
|
||||
description: Name of the resulting provider secret.
|
||||
type: string
|
||||
required:
|
||||
- remoteKey
|
||||
type: object
|
||||
secretKey:
|
||||
description: Secret Key to be pushed
|
||||
type: string
|
||||
required:
|
||||
- remoteRef
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: array
|
||||
dataTo:
|
||||
description: DataTo defines bulk push rules that expand source Secret keys into provider entries.
|
||||
items:
|
||||
description: PushSecretDataTo defines how to bulk-push secrets to providers without explicit per-key mappings.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: |-
|
||||
Match pattern for selecting keys from the source Secret.
|
||||
If not specified, all keys are selected.
|
||||
properties:
|
||||
regexp:
|
||||
description: |-
|
||||
Regexp matches keys by regular expression.
|
||||
If not specified, all keys are matched.
|
||||
type: string
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
remoteKey:
|
||||
description: |-
|
||||
RemoteKey is the name of the single provider secret that will receive ALL
|
||||
matched keys bundled as a JSON object (e.g. {"DB_HOST":"...","DB_USER":"..."}).
|
||||
When set, per-key expansion is skipped and a single push is performed.
|
||||
The provider's store prefix (if any) is still prepended to this value.
|
||||
When not set, each matched key is pushed as its own individual provider secret.
|
||||
type: string
|
||||
rewrite:
|
||||
description: |-
|
||||
Rewrite operations to transform keys before pushing to the provider.
|
||||
Operations are applied sequentially.
|
||||
items:
|
||||
description: PushSecretRewrite defines how to transform secret keys before pushing.
|
||||
properties:
|
||||
regexp:
|
||||
description: Used to rewrite with regular expressions.
|
||||
properties:
|
||||
source:
|
||||
description: Used to define the regular expression of a re.Compiler.
|
||||
type: string
|
||||
target:
|
||||
description: Used to define the target pattern of a ReplaceAll operation.
|
||||
type: string
|
||||
required:
|
||||
- source
|
||||
- target
|
||||
type: object
|
||||
transform:
|
||||
description: Used to apply string transformation on the secrets.
|
||||
properties:
|
||||
template:
|
||||
description: |-
|
||||
Used to define the template to apply on the secret name.
|
||||
`.value ` will specify the secret name in the template.
|
||||
type: string
|
||||
required:
|
||||
- template
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: exactly one of regexp or transform must be set
|
||||
rule: (has(self.regexp) && !has(self.transform)) || (!has(self.regexp) && has(self.transform))
|
||||
type: array
|
||||
storeRef:
|
||||
description: StoreRef specifies which SecretStore to push to. Required.
|
||||
properties:
|
||||
kind:
|
||||
default: SecretStore
|
||||
description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
|
||||
enum:
|
||||
- SecretStore
|
||||
- ClusterSecretStore
|
||||
type: string
|
||||
labelSelector:
|
||||
description: Optionally, sync to secret stores with label selector
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
name:
|
||||
description: Optionally, sync to the SecretStore of the given name
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: storeRef must specify either name or labelSelector
|
||||
rule: has(self.storeRef) && (has(self.storeRef.name) || has(self.storeRef.labelSelector))
|
||||
- message: 'remoteKey and rewrite are mutually exclusive: rewrite is only supported in per-key mode (without remoteKey)'
|
||||
rule: '!has(self.remoteKey) || !has(self.rewrite) || size(self.rewrite) == 0'
|
||||
type: array
|
||||
deletionPolicy:
|
||||
default: None
|
||||
description: Deletion Policy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Delete
|
||||
- None
|
||||
type: string
|
||||
refreshInterval:
|
||||
default: 1h0m0s
|
||||
description: The Interval to which External Secrets will try to push a secret definition
|
||||
type: string
|
||||
secretStoreRefs:
|
||||
items:
|
||||
description: PushSecretStoreRef contains a reference on how to sync to a SecretStore.
|
||||
properties:
|
||||
kind:
|
||||
default: SecretStore
|
||||
description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
|
||||
enum:
|
||||
- SecretStore
|
||||
- ClusterSecretStore
|
||||
type: string
|
||||
labelSelector:
|
||||
description: Optionally, sync to secret stores with label selector
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
name:
|
||||
description: Optionally, sync to the SecretStore of the given name
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
selector:
|
||||
description: The Secret Selector (k8s source) for the Push Secret
|
||||
maxProperties: 1
|
||||
minProperties: 1
|
||||
properties:
|
||||
generatorRef:
|
||||
description: Point to a generator to create a Secret.
|
||||
properties:
|
||||
apiVersion:
|
||||
default: generators.external-secrets.io/v1alpha1
|
||||
description: Specify the apiVersion of the generator resource
|
||||
type: string
|
||||
kind:
|
||||
description: Specify the Kind of the generator resource
|
||||
enum:
|
||||
- ACRAccessToken
|
||||
- ClusterGenerator
|
||||
- CloudsmithAccessToken
|
||||
- ECRAuthorizationToken
|
||||
- Fake
|
||||
- GCRAccessToken
|
||||
- GithubAccessToken
|
||||
- QuayAccessToken
|
||||
- Password
|
||||
- SSHKey
|
||||
- STSSessionToken
|
||||
- UUID
|
||||
- VaultDynamicSecret
|
||||
- Webhook
|
||||
- Grafana
|
||||
- MFA
|
||||
type: string
|
||||
name:
|
||||
description: Specify the name of the generator resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
secret:
|
||||
description: Select a Secret to Push.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name of the Secret.
|
||||
The Secret must exist in the same namespace as the PushSecret manifest.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
selector:
|
||||
description: Selector chooses secrets using a labelSelector.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
type: object
|
||||
template:
|
||||
description: Template defines a blueprint for the created Secret resource.
|
||||
properties:
|
||||
data:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
engineVersion:
|
||||
default: v2
|
||||
description: |-
|
||||
EngineVersion specifies the template engine version
|
||||
that should be used to compile/execute the
|
||||
template specified in .data and .templateFrom[].
|
||||
enum:
|
||||
- v2
|
||||
type: string
|
||||
mergePolicy:
|
||||
default: Replace
|
||||
description: TemplateMergePolicy defines how the rendered template should be merged with the existing Secret data.
|
||||
enum:
|
||||
- Replace
|
||||
- Merge
|
||||
type: string
|
||||
metadata:
|
||||
description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
finalizers:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
templateFrom:
|
||||
items:
|
||||
description: |-
|
||||
TemplateFrom specifies a source for templates.
|
||||
Each item in the list can either reference a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
configMap:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
literal:
|
||||
type: string
|
||||
secret:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
target:
|
||||
default: Data
|
||||
description: |-
|
||||
Target specifies where to place the template result.
|
||||
For Secret resources, common values are: "Data", "Annotations", "Labels".
|
||||
For custom resources (when spec.target.manifest is set), this supports
|
||||
nested paths like "spec.database.config" or "data".
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type:
|
||||
type: string
|
||||
type: object
|
||||
updatePolicy:
|
||||
default: Replace
|
||||
description: UpdatePolicy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Replace
|
||||
- IfNotExists
|
||||
type: string
|
||||
required:
|
||||
- secretStoreRefs
|
||||
- selector
|
||||
type: object
|
||||
refreshTime:
|
||||
description: The time in which the controller should reconcile its objects and recheck namespaces for labels.
|
||||
type: string
|
||||
required:
|
||||
- pushSecretSpec
|
||||
type: object
|
||||
status:
|
||||
description: ClusterPushSecretStatus contains the status information for the ClusterPushSecret resource.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: PushSecretStatusCondition indicates the status of the PushSecret.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
description: PushSecretConditionType indicates the condition of the PushSecret.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
failedNamespaces:
|
||||
description: Failed namespaces are the namespaces that failed to apply an PushSecret
|
||||
items:
|
||||
description: ClusterPushSecretNamespaceFailure represents a failed namespace deployment and it's reason.
|
||||
properties:
|
||||
namespace:
|
||||
description: Namespace is the namespace that failed when trying to apply an PushSecret
|
||||
type: string
|
||||
reason:
|
||||
description: Reason is why the PushSecret failed to apply to the namespace
|
||||
type: string
|
||||
required:
|
||||
- namespace
|
||||
type: object
|
||||
type: array
|
||||
provisionedNamespaces:
|
||||
description: ProvisionedNamespaces are the namespaces where the ClusterPushSecret has secrets
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
pushSecretName:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
10121
manifest/external-secrets/templates/crds/clustersecretstore.yaml
Normal file
10121
manifest/external-secrets/templates/crds/clustersecretstore.yaml
Normal file
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,202 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: ecrauthorizationtokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: ECRAuthorizationToken
|
||||
listKind: ECRAuthorizationTokenList
|
||||
plural: ecrauthorizationtokens
|
||||
singular: ecrauthorizationtoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
ECRAuthorizationToken uses the GetAuthorizationToken API to retrieve an authorization token.
|
||||
The authorization token is valid for 12 hours.
|
||||
The authorizationToken returned is a base64 encoded string that can be decoded
|
||||
and used in a docker login command to authenticate to a registry.
|
||||
For more information, see Registry authentication (https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html#registry_auth) in the Amazon Elastic Container Registry User Guide.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: ECRAuthorizationTokenSpec defines the desired state to generate an AWS ECR authorization token.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth defines how to authenticate with AWS
|
||||
properties:
|
||||
jwt:
|
||||
description: AWSJWTAuth provides configuration to authenticate against AWS using service account tokens.
|
||||
properties:
|
||||
serviceAccountRef:
|
||||
description: ServiceAccountSelector is a reference to a ServiceAccount resource.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
secretRef:
|
||||
description: |-
|
||||
AWSAuthSecretRef holds secret references for AWS credentials
|
||||
both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
|
||||
properties:
|
||||
accessKeyIDSecretRef:
|
||||
description: The AccessKeyID is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
secretAccessKeySecretRef:
|
||||
description: The SecretAccessKey is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
sessionTokenSecretRef:
|
||||
description: |-
|
||||
The SessionToken used for authentication
|
||||
This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
|
||||
see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
region:
|
||||
description: Region specifies the region to operate in.
|
||||
type: string
|
||||
role:
|
||||
description: |-
|
||||
You can assume a role before making calls to the
|
||||
desired AWS service.
|
||||
type: string
|
||||
scope:
|
||||
description: |-
|
||||
Scope specifies the ECR service scope.
|
||||
Valid options are private and public.
|
||||
type: string
|
||||
required:
|
||||
- region
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
1358
manifest/external-secrets/templates/crds/externalsecret.yaml
Normal file
1358
manifest/external-secrets/templates/crds/externalsecret.yaml
Normal file
File diff suppressed because it is too large
Load Diff
73
manifest/external-secrets/templates/crds/fake.yaml
Normal file
73
manifest/external-secrets/templates/crds/fake.yaml
Normal file
@@ -0,0 +1,73 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: fakes.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Fake
|
||||
listKind: FakeList
|
||||
plural: fakes
|
||||
singular: fake
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Fake generator is used for testing. It lets you define
|
||||
a static set of credentials that is always returned.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: FakeSpec contains the static data.
|
||||
properties:
|
||||
controller:
|
||||
description: |-
|
||||
Used to select the correct ESO controller (think: ingress.ingressClassName)
|
||||
The ESO controller is instantiated with a specific controller name and filters VDS based on this property
|
||||
type: string
|
||||
data:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
Data defines the static data returned
|
||||
by this generator.
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
256
manifest/external-secrets/templates/crds/gcraccesstoken.yaml
Normal file
256
manifest/external-secrets/templates/crds/gcraccesstoken.yaml
Normal file
@@ -0,0 +1,256 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: gcraccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: GCRAccessToken
|
||||
listKind: GCRAccessTokenList
|
||||
plural: gcraccesstokens
|
||||
singular: gcraccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
GCRAccessToken generates an GCP access token
|
||||
that can be used to authenticate with GCR.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GCRAccessTokenSpec defines the desired state to generate a Google Container Registry access token.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth defines the means for authenticating with GCP
|
||||
properties:
|
||||
secretRef:
|
||||
description: GCPSMAuthSecretRef defines the reference to a secret containing Google Cloud Platform credentials.
|
||||
properties:
|
||||
secretAccessKeySecretRef:
|
||||
description: The SecretAccessKey is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
workloadIdentity:
|
||||
description: GCPWorkloadIdentity defines the configuration for using GCP Workload Identity authentication.
|
||||
properties:
|
||||
clusterLocation:
|
||||
type: string
|
||||
clusterName:
|
||||
type: string
|
||||
clusterProjectID:
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: ServiceAccountSelector is a reference to a ServiceAccount resource.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
required:
|
||||
- clusterLocation
|
||||
- clusterName
|
||||
- serviceAccountRef
|
||||
type: object
|
||||
workloadIdentityFederation:
|
||||
description: GCPWorkloadIdentityFederation holds the configurations required for generating federated access tokens.
|
||||
properties:
|
||||
audience:
|
||||
description: |-
|
||||
audience is the Secure Token Service (STS) audience which contains the resource name for the workload identity pool and the provider identifier in that pool.
|
||||
If specified, Audience found in the external account credential config will be overridden with the configured value.
|
||||
audience must be provided when serviceAccountRef or awsSecurityCredentials is configured.
|
||||
type: string
|
||||
awsSecurityCredentials:
|
||||
description: |-
|
||||
awsSecurityCredentials is for configuring AWS region and credentials to use for obtaining the access token,
|
||||
when using the AWS metadata server is not an option.
|
||||
properties:
|
||||
awsCredentialsSecretRef:
|
||||
description: |-
|
||||
awsCredentialsSecretRef is the reference to the secret which holds the AWS credentials.
|
||||
Secret should be created with below names for keys
|
||||
- aws_access_key_id: Access Key ID, which is the unique identifier for the AWS account or the IAM user.
|
||||
- aws_secret_access_key: Secret Access Key, which is used to authenticate requests made to AWS services.
|
||||
- aws_session_token: Session Token, is the short-lived token to authenticate requests made to AWS services.
|
||||
properties:
|
||||
name:
|
||||
description: name of the secret.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: namespace in which the secret exists. If empty, secret will looked up in local namespace.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
region:
|
||||
description: region is for configuring the AWS region to be used.
|
||||
example: ap-south-1
|
||||
maxLength: 50
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9-]+$
|
||||
type: string
|
||||
required:
|
||||
- awsCredentialsSecretRef
|
||||
- region
|
||||
type: object
|
||||
credConfig:
|
||||
description: |-
|
||||
credConfig holds the configmap reference containing the GCP external account credential configuration in JSON format and the key name containing the json data.
|
||||
For using Kubernetes cluster as the identity provider, use serviceAccountRef instead. Operators mounted serviceaccount token cannot be used as the token source, instead
|
||||
serviceAccountRef must be used by providing operators service account details.
|
||||
properties:
|
||||
key:
|
||||
description: key name holding the external account credential config.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: name of the configmap.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: namespace in which the configmap exists. If empty, configmap will looked up in local namespace.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
- name
|
||||
type: object
|
||||
externalTokenEndpoint:
|
||||
description: |-
|
||||
externalTokenEndpoint is the endpoint explicitly set up to provide tokens, which will be matched against the
|
||||
credential_source.url in the provided credConfig. This field is merely to double-check the external token source
|
||||
URL is having the expected value.
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: |-
|
||||
serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
|
||||
when Kubernetes is configured as provider in workload identity pool.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
projectID:
|
||||
description: ProjectID defines which project to use to authenticate with
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- projectID
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
115
manifest/external-secrets/templates/crds/generatorstate.yaml
Normal file
115
manifest/external-secrets/templates/crds/generatorstate.yaml
Normal file
@@ -0,0 +1,115 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: generatorstates.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: GeneratorState
|
||||
listKind: GeneratorStateList
|
||||
plural: generatorstates
|
||||
shortNames:
|
||||
- gs
|
||||
singular: generatorstate
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .spec.garbageCollectionDeadline
|
||||
name: GC Deadline
|
||||
type: string
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: Age
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GeneratorState represents the state created and managed by a generator resource.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GeneratorStateSpec defines the desired state of a generator state resource.
|
||||
properties:
|
||||
garbageCollectionDeadline:
|
||||
description: |-
|
||||
GarbageCollectionDeadline is the time after which the generator state
|
||||
will be deleted.
|
||||
It is set by the controller which creates the generator state and
|
||||
can be set configured by the user.
|
||||
If the garbage collection deadline is not set the generator state will not be deleted.
|
||||
format: date-time
|
||||
type: string
|
||||
resource:
|
||||
description: |-
|
||||
Resource is the generator manifest that produced the state.
|
||||
It is a snapshot of the generator manifest at the time the state was produced.
|
||||
This manifest will be used to delete the resource. Any configuration that is referenced
|
||||
in the manifest should be available at the time of garbage collection. If that is not the case deletion will
|
||||
be blocked by a finalizer.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
state:
|
||||
description: State is the state that was produced by the generator implementation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- resource
|
||||
- state
|
||||
type: object
|
||||
status:
|
||||
description: GeneratorStateStatus defines the observed state of a generator state resource.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: GeneratorStateStatusCondition represents the observed condition of a generator state.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
description: GeneratorStateConditionType represents the type of condition for a generator state.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources: {}
|
||||
{{- end }}
|
||||
122
manifest/external-secrets/templates/crds/githubaccesstoken.yaml
Normal file
122
manifest/external-secrets/templates/crds/githubaccesstoken.yaml
Normal file
@@ -0,0 +1,122 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: githubaccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: GithubAccessToken
|
||||
listKind: GithubAccessTokenList
|
||||
plural: githubaccesstokens
|
||||
singular: githubaccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: GithubAccessToken generates ghs_ accessToken
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GithubAccessTokenSpec defines the desired state to generate a GitHub access token.
|
||||
properties:
|
||||
appID:
|
||||
type: string
|
||||
auth:
|
||||
description: Auth configures how ESO authenticates with a Github instance.
|
||||
properties:
|
||||
privateKey:
|
||||
description: GithubSecretRef references a secret containing GitHub credentials.
|
||||
properties:
|
||||
secretRef:
|
||||
description: |-
|
||||
SecretKeySelector is a reference to a specific 'key' within a Secret resource.
|
||||
In some instances, `key` is a required field.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- secretRef
|
||||
type: object
|
||||
required:
|
||||
- privateKey
|
||||
type: object
|
||||
installID:
|
||||
type: string
|
||||
permissions:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Map of permissions the token will have. If omitted, defaults to all permissions the GitHub App has.
|
||||
type: object
|
||||
repositories:
|
||||
description: |-
|
||||
List of repositories the token will have access to. If omitted, defaults to all repositories the GitHub App
|
||||
is installed to.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
url:
|
||||
description: URL configures the GitHub instance URL. Defaults to https://github.com/.
|
||||
type: string
|
||||
required:
|
||||
- appID
|
||||
- auth
|
||||
- installID
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
140
manifest/external-secrets/templates/crds/grafana.yaml
Normal file
140
manifest/external-secrets/templates/crds/grafana.yaml
Normal file
@@ -0,0 +1,140 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: grafanas.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Grafana
|
||||
listKind: GrafanaList
|
||||
plural: grafanas
|
||||
singular: grafana
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: Grafana represents a generator for Grafana service account tokens.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: GrafanaSpec controls the behavior of the grafana generator.
|
||||
properties:
|
||||
auth:
|
||||
description: |-
|
||||
Auth is the authentication configuration to authenticate
|
||||
against the Grafana instance.
|
||||
properties:
|
||||
basic:
|
||||
description: |-
|
||||
Basic auth credentials used to authenticate against the Grafana instance.
|
||||
Note: you need a token which has elevated permissions to create service accounts.
|
||||
See here for the documentation on basic roles offered by Grafana:
|
||||
https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
|
||||
properties:
|
||||
password:
|
||||
description: A basic auth password used to authenticate against the Grafana instance.
|
||||
properties:
|
||||
key:
|
||||
description: The key where the token is found.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
username:
|
||||
description: A basic auth username used to authenticate against the Grafana instance.
|
||||
type: string
|
||||
required:
|
||||
- password
|
||||
- username
|
||||
type: object
|
||||
token:
|
||||
description: |-
|
||||
A service account token used to authenticate against the Grafana instance.
|
||||
Note: you need a token which has elevated permissions to create service accounts.
|
||||
See here for the documentation on basic roles offered by Grafana:
|
||||
https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
|
||||
properties:
|
||||
key:
|
||||
description: The key where the token is found.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
serviceAccount:
|
||||
description: |-
|
||||
ServiceAccount is the configuration for the service account that
|
||||
is supposed to be generated by the generator.
|
||||
properties:
|
||||
name:
|
||||
description: Name is the name of the service account that will be created by ESO.
|
||||
type: string
|
||||
role:
|
||||
description: |-
|
||||
Role is the role of the service account.
|
||||
See here for the documentation on basic roles offered by Grafana:
|
||||
https://grafana.com/docs/grafana/latest/administration/roles-and-permissions/access-control/rbac-fixed-basic-role-definitions/
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- role
|
||||
type: object
|
||||
url:
|
||||
description: URL is the URL of the Grafana instance.
|
||||
type: string
|
||||
required:
|
||||
- auth
|
||||
- serviceAccount
|
||||
- url
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
100
manifest/external-secrets/templates/crds/mfa.yaml
Normal file
100
manifest/external-secrets/templates/crds/mfa.yaml
Normal file
@@ -0,0 +1,100 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: mfas.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: MFA
|
||||
listKind: MFAList
|
||||
plural: mfas
|
||||
singular: mfa
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: MFA generates a new TOTP token that is compliant with RFC 6238.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: MFASpec controls the behavior of the mfa generator.
|
||||
properties:
|
||||
algorithm:
|
||||
description: Algorithm to use for encoding. Defaults to SHA1 as per the RFC.
|
||||
type: string
|
||||
length:
|
||||
description: Length defines the token length. Defaults to 6 characters.
|
||||
type: integer
|
||||
secret:
|
||||
description: Secret is a secret selector to a secret containing the seed secret to generate the TOTP value from.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
timePeriod:
|
||||
description: TimePeriod defines how long the token can be active. Defaults to 30 seconds.
|
||||
type: integer
|
||||
when:
|
||||
description: When defines a time parameter that can be used to pin the origin time of the generated token.
|
||||
format: date-time
|
||||
type: string
|
||||
required:
|
||||
- secret
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
120
manifest/external-secrets/templates/crds/password.yaml
Normal file
120
manifest/external-secrets/templates/crds/password.yaml
Normal file
@@ -0,0 +1,120 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: passwords.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Password
|
||||
listKind: PasswordList
|
||||
plural: passwords
|
||||
singular: password
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Password generates a random password based on the
|
||||
configuration parameters in spec.
|
||||
You can specify the length, characterset and other attributes.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: PasswordSpec controls the behavior of the password generator.
|
||||
properties:
|
||||
allowRepeat:
|
||||
default: false
|
||||
description: set AllowRepeat to true to allow repeating characters.
|
||||
type: boolean
|
||||
digits:
|
||||
description: |-
|
||||
Digits specifies the number of digits in the generated
|
||||
password. If omitted it defaults to 25% of the length of the password
|
||||
type: integer
|
||||
encoding:
|
||||
default: raw
|
||||
description: |-
|
||||
Encoding specifies the encoding of the generated password.
|
||||
Valid values are:
|
||||
- "raw" (default): no encoding
|
||||
- "base64": standard base64 encoding
|
||||
- "base64url": base64url encoding
|
||||
- "base32": base32 encoding
|
||||
- "hex": hexadecimal encoding
|
||||
enum:
|
||||
- base64
|
||||
- base64url
|
||||
- base32
|
||||
- hex
|
||||
- raw
|
||||
type: string
|
||||
length:
|
||||
default: 24
|
||||
description: |-
|
||||
Length of the password to be generated.
|
||||
Defaults to 24
|
||||
type: integer
|
||||
noUpper:
|
||||
default: false
|
||||
description: Set NoUpper to disable uppercase characters
|
||||
type: boolean
|
||||
secretKeys:
|
||||
description: |-
|
||||
SecretKeys defines the keys that will be populated with generated passwords.
|
||||
Defaults to "password" when not set.
|
||||
items:
|
||||
type: string
|
||||
minItems: 1
|
||||
type: array
|
||||
symbolCharacters:
|
||||
description: |-
|
||||
SymbolCharacters specifies the special characters that should be used
|
||||
in the generated password.
|
||||
type: string
|
||||
symbols:
|
||||
description: |-
|
||||
Symbols specifies the number of symbol characters in the generated
|
||||
password. If omitted it defaults to 25% of the length of the password
|
||||
type: integer
|
||||
required:
|
||||
- allowRepeat
|
||||
- length
|
||||
- noUpper
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
646
manifest/external-secrets/templates/crds/pushsecret.yaml
Normal file
646
manifest/external-secrets/templates/crds/pushsecret.yaml
Normal file
@@ -0,0 +1,646 @@
|
||||
{{- if and (.Values.installCRDs) (.Values.crds.createPushSecret) }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: pushsecrets.external-secrets.io
|
||||
spec:
|
||||
group: external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
kind: PushSecret
|
||||
listKind: PushSecretList
|
||||
plural: pushsecrets
|
||||
shortNames:
|
||||
- ps
|
||||
singular: pushsecret
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- additionalPrinterColumns:
|
||||
- jsonPath: .metadata.creationTimestamp
|
||||
name: AGE
|
||||
type: date
|
||||
- jsonPath: .status.conditions[?(@.type=="Ready")].reason
|
||||
name: Status
|
||||
type: string
|
||||
- jsonPath: .status.refreshTime
|
||||
name: Last Sync
|
||||
type: date
|
||||
name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: PushSecret is the Schema for the PushSecrets API that enables pushing Kubernetes secrets to external secret providers.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: PushSecretSpec configures the behavior of the PushSecret.
|
||||
properties:
|
||||
data:
|
||||
description: Secret Data that should be pushed to providers
|
||||
items:
|
||||
description: PushSecretData defines data to be pushed to the provider and associated metadata.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: Match a given Secret Key to be pushed to the provider.
|
||||
properties:
|
||||
remoteRef:
|
||||
description: Remote Refs to push to providers.
|
||||
properties:
|
||||
property:
|
||||
description: Name of the property in the resulting secret
|
||||
type: string
|
||||
remoteKey:
|
||||
description: Name of the resulting provider secret.
|
||||
type: string
|
||||
required:
|
||||
- remoteKey
|
||||
type: object
|
||||
secretKey:
|
||||
description: Secret Key to be pushed
|
||||
type: string
|
||||
required:
|
||||
- remoteRef
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: array
|
||||
dataTo:
|
||||
description: DataTo defines bulk push rules that expand source Secret keys into provider entries.
|
||||
items:
|
||||
description: PushSecretDataTo defines how to bulk-push secrets to providers without explicit per-key mappings.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: |-
|
||||
Match pattern for selecting keys from the source Secret.
|
||||
If not specified, all keys are selected.
|
||||
properties:
|
||||
regexp:
|
||||
description: |-
|
||||
Regexp matches keys by regular expression.
|
||||
If not specified, all keys are matched.
|
||||
type: string
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
remoteKey:
|
||||
description: |-
|
||||
RemoteKey is the name of the single provider secret that will receive ALL
|
||||
matched keys bundled as a JSON object (e.g. {"DB_HOST":"...","DB_USER":"..."}).
|
||||
When set, per-key expansion is skipped and a single push is performed.
|
||||
The provider's store prefix (if any) is still prepended to this value.
|
||||
When not set, each matched key is pushed as its own individual provider secret.
|
||||
type: string
|
||||
rewrite:
|
||||
description: |-
|
||||
Rewrite operations to transform keys before pushing to the provider.
|
||||
Operations are applied sequentially.
|
||||
items:
|
||||
description: PushSecretRewrite defines how to transform secret keys before pushing.
|
||||
properties:
|
||||
regexp:
|
||||
description: Used to rewrite with regular expressions.
|
||||
properties:
|
||||
source:
|
||||
description: Used to define the regular expression of a re.Compiler.
|
||||
type: string
|
||||
target:
|
||||
description: Used to define the target pattern of a ReplaceAll operation.
|
||||
type: string
|
||||
required:
|
||||
- source
|
||||
- target
|
||||
type: object
|
||||
transform:
|
||||
description: Used to apply string transformation on the secrets.
|
||||
properties:
|
||||
template:
|
||||
description: |-
|
||||
Used to define the template to apply on the secret name.
|
||||
`.value ` will specify the secret name in the template.
|
||||
type: string
|
||||
required:
|
||||
- template
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: exactly one of regexp or transform must be set
|
||||
rule: (has(self.regexp) && !has(self.transform)) || (!has(self.regexp) && has(self.transform))
|
||||
type: array
|
||||
storeRef:
|
||||
description: StoreRef specifies which SecretStore to push to. Required.
|
||||
properties:
|
||||
kind:
|
||||
default: SecretStore
|
||||
description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
|
||||
enum:
|
||||
- SecretStore
|
||||
- ClusterSecretStore
|
||||
type: string
|
||||
labelSelector:
|
||||
description: Optionally, sync to secret stores with label selector
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
name:
|
||||
description: Optionally, sync to the SecretStore of the given name
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-validations:
|
||||
- message: storeRef must specify either name or labelSelector
|
||||
rule: has(self.storeRef) && (has(self.storeRef.name) || has(self.storeRef.labelSelector))
|
||||
- message: 'remoteKey and rewrite are mutually exclusive: rewrite is only supported in per-key mode (without remoteKey)'
|
||||
rule: '!has(self.remoteKey) || !has(self.rewrite) || size(self.rewrite) == 0'
|
||||
type: array
|
||||
deletionPolicy:
|
||||
default: None
|
||||
description: Deletion Policy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Delete
|
||||
- None
|
||||
type: string
|
||||
refreshInterval:
|
||||
default: 1h0m0s
|
||||
description: The Interval to which External Secrets will try to push a secret definition
|
||||
type: string
|
||||
secretStoreRefs:
|
||||
items:
|
||||
description: PushSecretStoreRef contains a reference on how to sync to a SecretStore.
|
||||
properties:
|
||||
kind:
|
||||
default: SecretStore
|
||||
description: Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
|
||||
enum:
|
||||
- SecretStore
|
||||
- ClusterSecretStore
|
||||
type: string
|
||||
labelSelector:
|
||||
description: Optionally, sync to secret stores with label selector
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
name:
|
||||
description: Optionally, sync to the SecretStore of the given name
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
selector:
|
||||
description: The Secret Selector (k8s source) for the Push Secret
|
||||
maxProperties: 1
|
||||
minProperties: 1
|
||||
properties:
|
||||
generatorRef:
|
||||
description: Point to a generator to create a Secret.
|
||||
properties:
|
||||
apiVersion:
|
||||
default: generators.external-secrets.io/v1alpha1
|
||||
description: Specify the apiVersion of the generator resource
|
||||
type: string
|
||||
kind:
|
||||
description: Specify the Kind of the generator resource
|
||||
enum:
|
||||
- ACRAccessToken
|
||||
- ClusterGenerator
|
||||
- CloudsmithAccessToken
|
||||
- ECRAuthorizationToken
|
||||
- Fake
|
||||
- GCRAccessToken
|
||||
- GithubAccessToken
|
||||
- QuayAccessToken
|
||||
- Password
|
||||
- SSHKey
|
||||
- STSSessionToken
|
||||
- UUID
|
||||
- VaultDynamicSecret
|
||||
- Webhook
|
||||
- Grafana
|
||||
- MFA
|
||||
type: string
|
||||
name:
|
||||
description: Specify the name of the generator resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- kind
|
||||
- name
|
||||
type: object
|
||||
secret:
|
||||
description: Select a Secret to Push.
|
||||
properties:
|
||||
name:
|
||||
description: |-
|
||||
Name of the Secret.
|
||||
The Secret must exist in the same namespace as the PushSecret manifest.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
selector:
|
||||
description: Selector chooses secrets using a labelSelector.
|
||||
properties:
|
||||
matchExpressions:
|
||||
description: matchExpressions is a list of label selector requirements. The requirements are ANDed.
|
||||
items:
|
||||
description: |-
|
||||
A label selector requirement is a selector that contains values, a key, and an operator that
|
||||
relates the key and values.
|
||||
properties:
|
||||
key:
|
||||
description: key is the label key that the selector applies to.
|
||||
type: string
|
||||
operator:
|
||||
description: |-
|
||||
operator represents a key's relationship to a set of values.
|
||||
Valid operators are In, NotIn, Exists and DoesNotExist.
|
||||
type: string
|
||||
values:
|
||||
description: |-
|
||||
values is an array of string values. If the operator is In or NotIn,
|
||||
the values array must be non-empty. If the operator is Exists or DoesNotExist,
|
||||
the values array must be empty. This array is replaced during a strategic
|
||||
merge patch.
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
required:
|
||||
- key
|
||||
- operator
|
||||
type: object
|
||||
type: array
|
||||
x-kubernetes-list-type: atomic
|
||||
matchLabels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: |-
|
||||
matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
|
||||
map is equivalent to an element of matchExpressions, whose key field is "key", the
|
||||
operator is "In", and the values array contains only "value". The requirements are ANDed.
|
||||
type: object
|
||||
type: object
|
||||
x-kubernetes-map-type: atomic
|
||||
type: object
|
||||
type: object
|
||||
template:
|
||||
description: Template defines a blueprint for the created Secret resource.
|
||||
properties:
|
||||
data:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
engineVersion:
|
||||
default: v2
|
||||
description: |-
|
||||
EngineVersion specifies the template engine version
|
||||
that should be used to compile/execute the
|
||||
template specified in .data and .templateFrom[].
|
||||
enum:
|
||||
- v2
|
||||
type: string
|
||||
mergePolicy:
|
||||
default: Replace
|
||||
description: TemplateMergePolicy defines how the rendered template should be merged with the existing Secret data.
|
||||
enum:
|
||||
- Replace
|
||||
- Merge
|
||||
type: string
|
||||
metadata:
|
||||
description: ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
|
||||
properties:
|
||||
annotations:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
finalizers:
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
labels:
|
||||
additionalProperties:
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
templateFrom:
|
||||
items:
|
||||
description: |-
|
||||
TemplateFrom specifies a source for templates.
|
||||
Each item in the list can either reference a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
configMap:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
literal:
|
||||
type: string
|
||||
secret:
|
||||
description: TemplateRef specifies a reference to either a ConfigMap or a Secret resource.
|
||||
properties:
|
||||
items:
|
||||
description: A list of keys in the ConfigMap/Secret to use as templates for Secret data
|
||||
items:
|
||||
description: TemplateRefItem specifies a key in the ConfigMap/Secret to use as a template for Secret data.
|
||||
properties:
|
||||
key:
|
||||
description: A key in the ConfigMap/Secret
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
templateAs:
|
||||
default: Values
|
||||
description: TemplateScope specifies how the template keys should be interpreted.
|
||||
enum:
|
||||
- Values
|
||||
- KeysAndValues
|
||||
type: string
|
||||
required:
|
||||
- key
|
||||
type: object
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ConfigMap/Secret resource
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
required:
|
||||
- items
|
||||
- name
|
||||
type: object
|
||||
target:
|
||||
default: Data
|
||||
description: |-
|
||||
Target specifies where to place the template result.
|
||||
For Secret resources, common values are: "Data", "Annotations", "Labels".
|
||||
For custom resources (when spec.target.manifest is set), this supports
|
||||
nested paths like "spec.database.config" or "data".
|
||||
type: string
|
||||
type: object
|
||||
type: array
|
||||
type:
|
||||
type: string
|
||||
type: object
|
||||
updatePolicy:
|
||||
default: Replace
|
||||
description: UpdatePolicy to handle Secrets in the provider.
|
||||
enum:
|
||||
- Replace
|
||||
- IfNotExists
|
||||
type: string
|
||||
required:
|
||||
- secretStoreRefs
|
||||
- selector
|
||||
type: object
|
||||
status:
|
||||
description: PushSecretStatus indicates the history of the status of PushSecret.
|
||||
properties:
|
||||
conditions:
|
||||
items:
|
||||
description: PushSecretStatusCondition indicates the status of the PushSecret.
|
||||
properties:
|
||||
lastTransitionTime:
|
||||
format: date-time
|
||||
type: string
|
||||
message:
|
||||
type: string
|
||||
reason:
|
||||
type: string
|
||||
status:
|
||||
type: string
|
||||
type:
|
||||
description: PushSecretConditionType indicates the condition of the PushSecret.
|
||||
type: string
|
||||
required:
|
||||
- status
|
||||
- type
|
||||
type: object
|
||||
type: array
|
||||
refreshTime:
|
||||
description: |-
|
||||
refreshTime is the time and date the external secret was fetched and
|
||||
the target secret updated
|
||||
format: date-time
|
||||
nullable: true
|
||||
type: string
|
||||
syncedPushSecrets:
|
||||
additionalProperties:
|
||||
additionalProperties:
|
||||
description: PushSecretData defines data to be pushed to the provider and associated metadata.
|
||||
properties:
|
||||
conversionStrategy:
|
||||
default: None
|
||||
description: Used to define a conversion Strategy for the secret keys
|
||||
enum:
|
||||
- None
|
||||
- ReverseUnicode
|
||||
type: string
|
||||
match:
|
||||
description: Match a given Secret Key to be pushed to the provider.
|
||||
properties:
|
||||
remoteRef:
|
||||
description: Remote Refs to push to providers.
|
||||
properties:
|
||||
property:
|
||||
description: Name of the property in the resulting secret
|
||||
type: string
|
||||
remoteKey:
|
||||
description: Name of the resulting provider secret.
|
||||
type: string
|
||||
required:
|
||||
- remoteKey
|
||||
type: object
|
||||
secretKey:
|
||||
description: Secret Key to be pushed
|
||||
type: string
|
||||
required:
|
||||
- remoteRef
|
||||
type: object
|
||||
metadata:
|
||||
description: |-
|
||||
Metadata is metadata attached to the secret.
|
||||
The structure of metadata is provider specific, please look it up in the provider documentation.
|
||||
x-kubernetes-preserve-unknown-fields: true
|
||||
required:
|
||||
- match
|
||||
type: object
|
||||
type: object
|
||||
description: |-
|
||||
Synced PushSecrets, including secrets that already exist in provider.
|
||||
Matches secret stores to PushSecretData that was stored to that secret store.
|
||||
type: object
|
||||
syncedResourceVersion:
|
||||
description: SyncedResourceVersion keeps track of the last synced version.
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
@@ -0,0 +1,96 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: quayaccesstokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: QuayAccessToken
|
||||
listKind: QuayAccessTokenList
|
||||
plural: quayaccesstokens
|
||||
singular: quayaccesstoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: QuayAccessToken generates Quay oauth token for pulling/pushing images
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: QuayAccessTokenSpec defines the desired state to generate a Quay access token.
|
||||
properties:
|
||||
robotAccount:
|
||||
description: Name of the robot account you are federating with
|
||||
type: string
|
||||
serviceAccountRef:
|
||||
description: Name of the service account you are federating with
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
url:
|
||||
description: URL configures the Quay instance URL. Defaults to quay.io.
|
||||
type: string
|
||||
required:
|
||||
- robotAccount
|
||||
- serviceAccountRef
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
10121
manifest/external-secrets/templates/crds/secretstore.yaml
Normal file
10121
manifest/external-secrets/templates/crds/secretstore.yaml
Normal file
File diff suppressed because it is too large
Load Diff
79
manifest/external-secrets/templates/crds/sshkey.yaml
Normal file
79
manifest/external-secrets/templates/crds/sshkey.yaml
Normal file
@@ -0,0 +1,79 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: sshkeys.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: SSHKey
|
||||
listKind: SSHKeyList
|
||||
plural: sshkeys
|
||||
singular: sshkey
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: SSHKey generates SSH key pairs.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: SSHKeySpec controls the behavior of the ssh key generator.
|
||||
properties:
|
||||
comment:
|
||||
description: Comment specifies an optional comment for the SSH key
|
||||
type: string
|
||||
keySize:
|
||||
description: |-
|
||||
KeySize specifies the key size for RSA keys (default: 2048) and ECDSA keys (default: 256).
|
||||
For RSA keys: 2048, 3072, 4096
|
||||
For ECDSA keys: 256, 384, 521
|
||||
Ignored for ed25519 keys
|
||||
maximum: 8192
|
||||
minimum: 256
|
||||
type: integer
|
||||
keyType:
|
||||
default: rsa
|
||||
description: KeyType specifies the SSH key type (rsa, ecdsa, ed25519)
|
||||
enum:
|
||||
- rsa
|
||||
- ecdsa
|
||||
- ed25519
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
213
manifest/external-secrets/templates/crds/stssessiontoken.yaml
Normal file
213
manifest/external-secrets/templates/crds/stssessiontoken.yaml
Normal file
@@ -0,0 +1,213 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: stssessiontokens.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: STSSessionToken
|
||||
listKind: STSSessionTokenList
|
||||
plural: stssessiontokens
|
||||
singular: stssessiontoken
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
STSSessionToken uses the GetSessionToken API to retrieve an authorization token.
|
||||
The authorization token is valid for 12 hours.
|
||||
The authorizationToken returned is a base64 encoded string that can be decoded.
|
||||
For more information, see GetSessionToken (https://docs.aws.amazon.com/STS/latest/APIReference/API_GetSessionToken.html).
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: STSSessionTokenSpec defines the desired state to generate an AWS STS session token.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth defines how to authenticate with AWS
|
||||
properties:
|
||||
jwt:
|
||||
description: AWSJWTAuth provides configuration to authenticate against AWS using service account tokens.
|
||||
properties:
|
||||
serviceAccountRef:
|
||||
description: ServiceAccountSelector is a reference to a ServiceAccount resource.
|
||||
properties:
|
||||
audiences:
|
||||
description: |-
|
||||
Audience specifies the `aud` claim for the service account token
|
||||
If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
|
||||
then this audiences will be appended to the list
|
||||
items:
|
||||
type: string
|
||||
type: array
|
||||
name:
|
||||
description: The name of the ServiceAccount resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
Namespace of the resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
type: object
|
||||
type: object
|
||||
secretRef:
|
||||
description: |-
|
||||
AWSAuthSecretRef holds secret references for AWS credentials
|
||||
both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
|
||||
properties:
|
||||
accessKeyIDSecretRef:
|
||||
description: The AccessKeyID is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
secretAccessKeySecretRef:
|
||||
description: The SecretAccessKey is used for authentication
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
sessionTokenSecretRef:
|
||||
description: |-
|
||||
The SessionToken used for authentication
|
||||
This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
|
||||
see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
type: object
|
||||
type: object
|
||||
region:
|
||||
description: Region specifies the region to operate in.
|
||||
type: string
|
||||
requestParameters:
|
||||
description: RequestParameters contains parameters that can be passed to the STS service.
|
||||
properties:
|
||||
serialNumber:
|
||||
description: |-
|
||||
SerialNumber is the identification number of the MFA device that is associated with the IAM user who is making
|
||||
the GetSessionToken call.
|
||||
Possible values: hardware device (such as GAHT12345678) or an Amazon Resource Name (ARN) for a virtual device
|
||||
(such as arn:aws:iam::123456789012:mfa/user)
|
||||
type: string
|
||||
sessionDuration:
|
||||
format: int32
|
||||
type: integer
|
||||
tokenCode:
|
||||
description: TokenCode is the value provided by the MFA device, if MFA is required.
|
||||
type: string
|
||||
type: object
|
||||
role:
|
||||
description: |-
|
||||
You can assume a role before making calls to the
|
||||
desired AWS service.
|
||||
type: string
|
||||
required:
|
||||
- region
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
58
manifest/external-secrets/templates/crds/uuid.yaml
Normal file
58
manifest/external-secrets/templates/crds/uuid.yaml
Normal file
@@ -0,0 +1,58 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: uuids.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: UUID
|
||||
listKind: UUIDList
|
||||
plural: uuids
|
||||
singular: uuid
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: UUID generates a version 1 UUID (e56657e3-764f-11ef-a397-65231a88c216).
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: UUIDSpec controls the behavior of the uuid generator.
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
1014
manifest/external-secrets/templates/crds/vaultdynamicsecret.yaml
Normal file
1014
manifest/external-secrets/templates/crds/vaultdynamicsecret.yaml
Normal file
File diff suppressed because it is too large
Load Diff
229
manifest/external-secrets/templates/crds/webhook.yaml
Normal file
229
manifest/external-secrets/templates/crds/webhook.yaml
Normal file
@@ -0,0 +1,229 @@
|
||||
{{- if .Values.installCRDs }}
|
||||
apiVersion: apiextensions.k8s.io/v1
|
||||
kind: CustomResourceDefinition
|
||||
metadata:
|
||||
annotations:
|
||||
{{- with .Values.crds.annotations }}
|
||||
{{- toYaml . | nindent 4}}
|
||||
{{- end }}
|
||||
{{- if and .Values.crds.conversion.enabled .Values.webhook.certManager.enabled .Values.webhook.certManager.addInjectorAnnotations }}
|
||||
cert-manager.io/inject-ca-from: {{ .Release.Namespace }}/{{ include "external-secrets.fullname" . }}-webhook
|
||||
{{- end }}
|
||||
controller-gen.kubebuilder.io/version: v0.19.0
|
||||
labels:
|
||||
external-secrets.io/component: controller
|
||||
name: webhooks.generators.external-secrets.io
|
||||
spec:
|
||||
group: generators.external-secrets.io
|
||||
names:
|
||||
categories:
|
||||
- external-secrets
|
||||
- external-secrets-generators
|
||||
kind: Webhook
|
||||
listKind: WebhookList
|
||||
plural: webhooks
|
||||
singular: webhook
|
||||
scope: Namespaced
|
||||
versions:
|
||||
- name: v1alpha1
|
||||
schema:
|
||||
openAPIV3Schema:
|
||||
description: |-
|
||||
Webhook connects to a third party API server to handle the secrets generation
|
||||
configuration parameters in spec.
|
||||
You can specify the server, the token, and additional body parameters.
|
||||
See documentation for the full API specification for requests and responses.
|
||||
properties:
|
||||
apiVersion:
|
||||
description: |-
|
||||
APIVersion defines the versioned schema of this representation of an object.
|
||||
Servers should convert recognized schemas to the latest internal value, and
|
||||
may reject unrecognized values.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
|
||||
type: string
|
||||
kind:
|
||||
description: |-
|
||||
Kind is a string value representing the REST resource this object represents.
|
||||
Servers may infer this from the endpoint the client submits requests to.
|
||||
Cannot be updated.
|
||||
In CamelCase.
|
||||
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
|
||||
type: string
|
||||
metadata:
|
||||
type: object
|
||||
spec:
|
||||
description: WebhookSpec controls the behavior of the external generator. Any body parameters should be passed to the server through the parameters field.
|
||||
properties:
|
||||
auth:
|
||||
description: Auth specifies a authorization protocol. Only one protocol may be set.
|
||||
maxProperties: 1
|
||||
minProperties: 1
|
||||
properties:
|
||||
ntlm:
|
||||
description: NTLMProtocol configures the store to use NTLM for auth
|
||||
properties:
|
||||
passwordSecret:
|
||||
description: |-
|
||||
SecretKeySelector is a reference to a specific 'key' within a Secret resource.
|
||||
In some instances, `key` is a required field.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
usernameSecret:
|
||||
description: |-
|
||||
SecretKeySelector is a reference to a specific 'key' within a Secret resource.
|
||||
In some instances, `key` is a required field.
|
||||
properties:
|
||||
key:
|
||||
description: |-
|
||||
A key in the referenced Secret.
|
||||
Some instances of this field may be defaulted, in others it may be required.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: |-
|
||||
The namespace of the Secret resource being referred to.
|
||||
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- passwordSecret
|
||||
- usernameSecret
|
||||
type: object
|
||||
type: object
|
||||
body:
|
||||
description: Body
|
||||
type: string
|
||||
caBundle:
|
||||
description: |-
|
||||
PEM encoded CA bundle used to validate webhook server certificate. Only used
|
||||
if the Server URL is using HTTPS protocol. This parameter is ignored for
|
||||
plain HTTP protocol connection. If not set the system root certificates
|
||||
are used to validate the TLS connection.
|
||||
format: byte
|
||||
type: string
|
||||
caProvider:
|
||||
description: The provider for the CA bundle to use to validate webhook server certificate.
|
||||
properties:
|
||||
key:
|
||||
description: The key where the CA certificate can be found in the Secret or ConfigMap.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the object located at the provider type.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
namespace:
|
||||
description: The namespace the Provider type is in.
|
||||
maxLength: 63
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
|
||||
type: string
|
||||
type:
|
||||
description: The type of provider to use such as "Secret", or "ConfigMap".
|
||||
enum:
|
||||
- Secret
|
||||
- ConfigMap
|
||||
type: string
|
||||
required:
|
||||
- name
|
||||
- type
|
||||
type: object
|
||||
headers:
|
||||
additionalProperties:
|
||||
type: string
|
||||
description: Headers
|
||||
type: object
|
||||
method:
|
||||
description: Webhook Method
|
||||
type: string
|
||||
result:
|
||||
description: Result formatting
|
||||
properties:
|
||||
jsonPath:
|
||||
description: Json path of return value
|
||||
type: string
|
||||
type: object
|
||||
secrets:
|
||||
description: |-
|
||||
Secrets to fill in templates
|
||||
These secrets will be passed to the templating function as key value pairs under the given name
|
||||
items:
|
||||
description: WebhookSecret defines a secret reference that will be used in webhook templates.
|
||||
properties:
|
||||
name:
|
||||
description: Name of this secret in templates
|
||||
type: string
|
||||
secretRef:
|
||||
description: Secret ref to fill in credentials
|
||||
properties:
|
||||
key:
|
||||
description: The key where the token is found.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[-._a-zA-Z0-9]+$
|
||||
type: string
|
||||
name:
|
||||
description: The name of the Secret resource being referred to.
|
||||
maxLength: 253
|
||||
minLength: 1
|
||||
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
|
||||
type: string
|
||||
type: object
|
||||
required:
|
||||
- name
|
||||
- secretRef
|
||||
type: object
|
||||
type: array
|
||||
timeout:
|
||||
description: Timeout
|
||||
type: string
|
||||
url:
|
||||
description: Webhook url to call
|
||||
type: string
|
||||
required:
|
||||
- result
|
||||
- url
|
||||
type: object
|
||||
type: object
|
||||
served: true
|
||||
storage: true
|
||||
subresources:
|
||||
status: {}
|
||||
{{- end }}
|
||||
Reference in New Issue
Block a user