vaultauth_v1beta1.json

{
  "description": "VaultAuth is the Schema for the vaultauths API",
  "properties": {
    "apiVersion": {
      "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources",
      "type": "string"
    },
    "kind": {
      "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds",
      "type": "string"
    },
    "metadata": {
      "type": "object"
    },
    "spec": {
      "description": "VaultAuthSpec defines the desired state of VaultAuth",
      "properties": {
        "allowedNamespaces": {
          "description": "AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod. This field allows administrators to customize which Kubernetes namespaces are authorized to use with this AuthMethod. While Vault will still enforce its own rules, this has the added configurability of restricting which VaultAuthMethods can be used by which namespaces. Accepted values: []{\"*\"} - wildcard, all namespaces. []{\"a\", \"b\"} - list of namespaces. unset - disallow all namespaces except the Operator's the VaultAuthMethod's namespace, this is the default behavior.",
          "items": {
            "type": "string"
          },
          "type": "array"
        },
        "appRole": {
          "description": "AppRole specific auth configuration, requires that the Method be set to `appRole`.",
          "properties": {
            "roleId": {
              "description": "RoleID of the AppRole Role to use for authenticating to Vault.",
              "type": "string"
            },
            "secretRef": {
              "description": "SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the AppRole Role's SecretID. The secret must have a key named `id` which holds the AppRole Role's secretID.",
              "type": "string"
            }
          },
          "required": [
            "roleId",
            "secretRef"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "aws": {
          "description": "AWS specific auth configuration, requires that Method be set to `aws`.",
          "properties": {
            "headerValue": {
              "description": "The Vault header value to include in the STS signing request",
              "type": "string"
            },
            "iamEndpoint": {
              "description": "The IAM endpoint to use; if not set will use the default",
              "type": "string"
            },
            "irsaServiceAccount": {
              "description": "IRSAServiceAccount name to use with IAM Roles for Service Accounts (IRSA), and should be annotated with \"eks.amazonaws.com/role-arn\". This ServiceAccount will be checked for other EKS annotations: eks.amazonaws.com/audience and eks.amazonaws.com/token-expiration",
              "type": "string"
            },
            "region": {
              "description": "AWS Region to use for signing the authentication request",
              "type": "string"
            },
            "role": {
              "description": "Vault role to use for authenticating",
              "type": "string"
            },
            "secretRef": {
              "description": "SecretRef is the name of a Kubernetes Secret in the consumer's (VDS/VSS/PKI) namespace which holds credentials for AWS. Expected keys include `access_key_id`, `secret_access_key`, `session_token`",
              "type": "string"
            },
            "sessionName": {
              "description": "The role session name to use when creating a webidentity provider",
              "type": "string"
            },
            "stsEndpoint": {
              "description": "The STS endpoint to use; if not set will use the default",
              "type": "string"
            }
          },
          "required": [
            "role"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "gcp": {
          "description": "GCP specific auth configuration, requires that Method be set to `gcp`.",
          "properties": {
            "clusterName": {
              "description": "GKE cluster name. Defaults to the cluster-name returned from the operator pod's local metadata server.",
              "type": "string"
            },
            "projectID": {
              "description": "GCP project ID. Defaults to the project-id returned from the operator pod's local metadata server.",
              "type": "string"
            },
            "region": {
              "description": "GCP Region of the GKE cluster's identity provider. Defaults to the region returned from the operator pod's local metadata server.",
              "type": "string"
            },
            "role": {
              "description": "Vault role to use for authenticating",
              "type": "string"
            },
            "workloadIdentityServiceAccount": {
              "description": "WorkloadIdentityServiceAccount is the name of a Kubernetes service account (in the same Kubernetes namespace as the Vault*Secret referencing this resource) which has been configured for workload identity in GKE. Should be annotated with \"iam.gke.io/gcp-service-account\".",
              "type": "string"
            }
          },
          "required": [
            "role",
            "workloadIdentityServiceAccount"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "headers": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Headers to be included in all Vault requests.",
          "type": "object"
        },
        "jwt": {
          "description": "JWT specific auth configuration, requires that the Method be set to `jwt`.",
          "properties": {
            "audiences": {
              "description": "TokenAudiences to include in the ServiceAccount token.",
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "role": {
              "description": "Role to use for authenticating to Vault.",
              "type": "string"
            },
            "secretRef": {
              "description": "SecretRef is the name of a Kubernetes secret in the consumer's (VDS/VSS/PKI) namespace which provides the JWT token to authenticate to Vault's JWT authentication backend. The secret must have a key named `jwt` which holds the JWT token.",
              "type": "string"
            },
            "serviceAccount": {
              "description": "ServiceAccount to use when creating a ServiceAccount token to authenticate to Vault's JWT authentication backend.",
              "type": "string"
            },
            "tokenExpirationSeconds": {
              "default": 600,
              "description": "TokenExpirationSeconds to set the ServiceAccount token.",
              "format": "int64",
              "minimum": 600,
              "type": "integer"
            }
          },
          "required": [
            "role"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "kubernetes": {
          "description": "Kubernetes specific auth configuration, requires that the Method be set to `kubernetes`.",
          "properties": {
            "audiences": {
              "description": "TokenAudiences to include in the ServiceAccount token.",
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "role": {
              "description": "Role to use for authenticating to Vault.",
              "type": "string"
            },
            "serviceAccount": {
              "description": "ServiceAccount to use when authenticating to Vault's authentication backend. This must reside in the consuming secret's (VDS/VSS/PKI) namespace.",
              "type": "string"
            },
            "tokenExpirationSeconds": {
              "default": 600,
              "description": "TokenExpirationSeconds to set the ServiceAccount token.",
              "format": "int64",
              "minimum": 600,
              "type": "integer"
            }
          },
          "required": [
            "role",
            "serviceAccount"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "method": {
          "description": "Method to use when authenticating to Vault.",
          "enum": [
            "kubernetes",
            "jwt",
            "appRole",
            "aws",
            "gcp"
          ],
          "type": "string"
        },
        "mount": {
          "description": "Mount to use when authenticating to auth method.",
          "type": "string"
        },
        "namespace": {
          "description": "Namespace to auth to in Vault",
          "type": "string"
        },
        "params": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Params to use when authenticating to Vault",
          "type": "object"
        },
        "storageEncryption": {
          "description": "StorageEncryption provides the necessary configuration to encrypt the client storage cache. This should only be configured when client cache persistence with encryption is enabled. This is done by passing setting the manager's commandline argument --client-cache-persistence-model=direct-encrypted. Typically, there should only ever be one VaultAuth configured with StorageEncryption in the Cluster, and it should have the label: cacheStorageEncryption=true",
          "properties": {
            "keyName": {
              "description": "KeyName to use for encrypt/decrypt operations via Vault Transit.",
              "type": "string"
            },
            "mount": {
              "description": "Mount path of the Transit engine in Vault.",
              "type": "string"
            }
          },
          "required": [
            "keyName",
            "mount"
          ],
          "type": "object",
          "additionalProperties": false
        },
        "vaultConnectionRef": {
          "description": "VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace, eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the Operator will default to the `default` VaultConnection, configured in the operator's namespace.",
          "type": "string"
        }
      },
      "required": [
        "method",
        "mount"
      ],
      "type": "object",
      "additionalProperties": false
    },
    "status": {
      "description": "VaultAuthStatus defines the observed state of VaultAuth",
      "properties": {
        "error": {
          "type": "string"
        },
        "valid": {
          "description": "Valid auth mechanism.",
          "type": "boolean"
        }
      },
      "required": [
        "error",
        "valid"
      ],
      "type": "object",
      "additionalProperties": false
    }
  },
  "type": "object"
}