Skip to content

nogroup.v1alpha1.clusterSecretStore

"ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields."

Index

Fields

fn new

new(name)

new returns an instance of ClusterSecretStore

obj metadata

"ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create."

fn metadata.withAnnotations

withAnnotations(annotations)

"Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations"

fn metadata.withAnnotationsMixin

withAnnotationsMixin(annotations)

"Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations"

Note: This function appends passed data to existing values

fn metadata.withClusterName

withClusterName(clusterName)

"The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request."

fn metadata.withCreationTimestamp

withCreationTimestamp(creationTimestamp)

"Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers."

fn metadata.withDeletionGracePeriodSeconds

withDeletionGracePeriodSeconds(deletionGracePeriodSeconds)

"Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only."

fn metadata.withDeletionTimestamp

withDeletionTimestamp(deletionTimestamp)

"Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers."

fn metadata.withFinalizers

withFinalizers(finalizers)

"Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list."

fn metadata.withFinalizersMixin

withFinalizersMixin(finalizers)

"Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list."

Note: This function appends passed data to existing values

fn metadata.withGenerateName

withGenerateName(generateName)

"GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header).\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency"

fn metadata.withGeneration

withGeneration(generation)

"A sequence number representing a specific generation of the desired state. Populated by the system. Read-only."

fn metadata.withLabels

withLabels(labels)

"Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels"

fn metadata.withLabelsMixin

withLabelsMixin(labels)

"Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels"

Note: This function appends passed data to existing values

fn metadata.withName

withName(name)

"Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names"

fn metadata.withNamespace

withNamespace(namespace)

"Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces"

fn metadata.withOwnerReferences

withOwnerReferences(ownerReferences)

"List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller."

fn metadata.withOwnerReferencesMixin

withOwnerReferencesMixin(ownerReferences)

"List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller."

Note: This function appends passed data to existing values

fn metadata.withResourceVersion

withResourceVersion(resourceVersion)

"An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency"

withSelfLink(selfLink)

"SelfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release."

fn metadata.withUid

withUid(uid)

"UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids"

obj spec

"SecretStoreSpec defines the desired state of SecretStore."

fn spec.withController

withController(controller)

"Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property"

obj spec.provider

"Used to configure the provider. Only one provider may be set"

obj spec.provider.akeyless

"Akeyless configures this store to sync secrets using Akeyless Vault provider"

fn spec.provider.akeyless.withAkeylessGWApiURL

withAkeylessGWApiURL(akeylessGWApiURL)

"Akeyless GW API Url from which the secrets to be fetched from."

obj spec.provider.akeyless.authSecretRef

"Auth configures how the operator authenticates with Akeyless."

obj spec.provider.akeyless.authSecretRef.secretRef

"AkeylessAuthSecretRef AKEYLESS_ACCESS_TYPE_PARAM: AZURE_OBJ_ID OR GCP_AUDIENCE OR ACCESS_KEY OR KUB_CONFIG_NAME."

obj spec.provider.akeyless.authSecretRef.secretRef.accessID

"The SecretAccessID is used for authentication"

fn spec.provider.akeyless.authSecretRef.secretRef.accessID.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.akeyless.authSecretRef.secretRef.accessID.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.akeyless.authSecretRef.secretRef.accessID.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.akeyless.authSecretRef.secretRef.accessType

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.akeyless.authSecretRef.secretRef.accessType.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.akeyless.authSecretRef.secretRef.accessType.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.akeyless.authSecretRef.secretRef.accessType.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.alibaba

"Alibaba configures this store to sync secrets using Alibaba Cloud provider"

fn spec.provider.alibaba.withEndpoint

withEndpoint(endpoint)

fn spec.provider.alibaba.withRegionID

withRegionID(regionID)

"Alibaba Region to be used for the provider"

obj spec.provider.alibaba.auth

"AlibabaAuth contains a secretRef for credentials."

obj spec.provider.alibaba.auth.secretRef

"AlibabaAuthSecretRef holds secret references for Alibaba credentials."

obj spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef

"The AccessKeyID is used for authentication"

fn spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef

"The AccessKeySecret is used for authentication"

fn spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.aws

"AWS configures this store to sync secrets using AWS Secret Manager provider"

fn spec.provider.aws.withRegion

withRegion(region)

"AWS Region to be used for the provider"

fn spec.provider.aws.withRole

withRole(role)

"Role is a Role ARN which the SecretManager provider will assume"

fn spec.provider.aws.withService

withService(service)

"Service defines which service should be used to fetch the secrets"

obj spec.provider.aws.auth

"Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials"

obj spec.provider.aws.auth.jwt

"Authenticate against AWS using service account tokens."

obj spec.provider.aws.auth.jwt.serviceAccountRef

"A reference to a ServiceAccount resource."

fn spec.provider.aws.auth.jwt.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.aws.auth.jwt.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.aws.auth.secretRef

"AWSAuthSecretRef holds secret references for AWS credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate."

obj spec.provider.aws.auth.secretRef.accessKeyIDSecretRef

"The AccessKeyID is used for authentication"

fn spec.provider.aws.auth.secretRef.accessKeyIDSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.aws.auth.secretRef.accessKeyIDSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.aws.auth.secretRef.accessKeyIDSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.aws.auth.secretRef.secretAccessKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.aws.auth.secretRef.secretAccessKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.aws.auth.secretRef.secretAccessKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.aws.auth.secretRef.secretAccessKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.azurekv

"AzureKV configures this store to sync secrets using Azure Key Vault provider"

fn spec.provider.azurekv.withAuthType

withAuthType(authType)

"Auth type defines how to authenticate to the keyvault service. Valid values are: - \"ServicePrincipal\" (default): Using a service principal (tenantId, clientId, clientSecret) - \"ManagedIdentity\": Using Managed Identity assigned to the pod (see aad-pod-identity)"

fn spec.provider.azurekv.withIdentityId

withIdentityId(identityId)

"If multiple Managed Identity is assigned to the pod, you can select the one to be used"

fn spec.provider.azurekv.withTenantId

withTenantId(tenantId)

"TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type."

fn spec.provider.azurekv.withVaultUrl

withVaultUrl(vaultUrl)

"Vault Url from which the secrets to be fetched from."

obj spec.provider.azurekv.authSecretRef

"Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type."

obj spec.provider.azurekv.authSecretRef.clientId

"The Azure clientId of the service principle used for authentication."

fn spec.provider.azurekv.authSecretRef.clientId.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.azurekv.authSecretRef.clientId.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.azurekv.authSecretRef.clientId.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.azurekv.authSecretRef.clientSecret

"The Azure ClientSecret of the service principle used for authentication."

fn spec.provider.azurekv.authSecretRef.clientSecret.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.azurekv.authSecretRef.clientSecret.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.azurekv.authSecretRef.clientSecret.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.fake

"Fake configures a store with static key/value pairs"

fn spec.provider.fake.withData

withData(data)

fn spec.provider.fake.withDataMixin

withDataMixin(data)

Note: This function appends passed data to existing values

obj spec.provider.fake.data

fn spec.provider.fake.data.withKey

withKey(key)

fn spec.provider.fake.data.withValue

withValue(value)

fn spec.provider.fake.data.withValueMap

withValueMap(valueMap)

fn spec.provider.fake.data.withValueMapMixin

withValueMapMixin(valueMap)

Note: This function appends passed data to existing values

fn spec.provider.fake.data.withVersion

withVersion(version)

obj spec.provider.gcpsm

"GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider"

fn spec.provider.gcpsm.withProjectID

withProjectID(projectID)

"ProjectID project where secret is located"

obj spec.provider.gcpsm.auth

"Auth defines the information necessary to authenticate against GCP"

obj spec.provider.gcpsm.auth.secretRef

obj spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.gcpsm.auth.workloadIdentity

fn spec.provider.gcpsm.auth.workloadIdentity.withClusterLocation

withClusterLocation(clusterLocation)

fn spec.provider.gcpsm.auth.workloadIdentity.withClusterName

withClusterName(clusterName)

obj spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef

"A reference to a ServiceAccount resource."

fn spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.gitlab

"GItlab configures this store to sync secrets using Gitlab Variables provider"

fn spec.provider.gitlab.withProjectID

withProjectID(projectID)

"ProjectID specifies a project where secrets are located."

fn spec.provider.gitlab.withUrl

withUrl(url)

"URL configures the GitLab instance URL. Defaults to https://gitlab.com/."

obj spec.provider.gitlab.auth

"Auth configures how secret-manager authenticates with a GitLab instance."

obj spec.provider.gitlab.auth.secretRef

obj spec.provider.gitlab.auth.secretRef.accessToken

"AccessToken is used for authentication."

fn spec.provider.gitlab.auth.secretRef.accessToken.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.gitlab.auth.secretRef.accessToken.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.gitlab.auth.secretRef.accessToken.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.ibm

"IBM configures this store to sync secrets using IBM Cloud provider"

fn spec.provider.ibm.withServiceUrl

withServiceUrl(serviceUrl)

"ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance"

obj spec.provider.ibm.auth

"Auth configures how secret-manager authenticates with the IBM secrets manager."

obj spec.provider.ibm.auth.secretRef

obj spec.provider.ibm.auth.secretRef.secretApiKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.ibm.auth.secretRef.secretApiKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.ibm.auth.secretRef.secretApiKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.ibm.auth.secretRef.secretApiKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.oracle

"Oracle configures this store to sync secrets using Oracle Vault provider"

fn spec.provider.oracle.withRegion

withRegion(region)

"Region is the region where vault is located."

fn spec.provider.oracle.withVault

withVault(vault)

"Vault is the vault's OCID of the specific vault where secret is located."

obj spec.provider.oracle.auth

"Auth configures how secret-manager authenticates with the Oracle Vault. If empty, use the instance principal, otherwise the user credentials specified in Auth."

fn spec.provider.oracle.auth.withTenancy

withTenancy(tenancy)

"Tenancy is the tenancy OCID where user is located."

fn spec.provider.oracle.auth.withUser

withUser(user)

"User is an access OCID specific to the account."

obj spec.provider.oracle.auth.secretRef

"SecretRef to pass through sensitive information."

obj spec.provider.oracle.auth.secretRef.fingerprint

"Fingerprint is the fingerprint of the API private key."

fn spec.provider.oracle.auth.secretRef.fingerprint.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.oracle.auth.secretRef.fingerprint.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.oracle.auth.secretRef.fingerprint.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.oracle.auth.secretRef.privatekey

"PrivateKey is the user's API Signing Key in PEM format, used for authentication."

fn spec.provider.oracle.auth.secretRef.privatekey.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.oracle.auth.secretRef.privatekey.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.oracle.auth.secretRef.privatekey.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault

"Vault configures this store to sync secrets using Hashi provider"

fn spec.provider.vault.withCaBundle

withCaBundle(caBundle)

"PEM encoded CA bundle used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection."

fn spec.provider.vault.withForwardInconsistent

withForwardInconsistent(forwardInconsistent)

"ForwardInconsistent tells Vault to forward read-after-write requests to the Vault leader instead of simply retrying within a loop. This can increase performance if the option is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header"

fn spec.provider.vault.withNamespace

withNamespace(namespace)

"Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: \"ns1\". More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces"

fn spec.provider.vault.withPath

withPath(path)

"Path is the mount path of the Vault KV backend endpoint, e.g: \"secret\". The v2 KV secret engine version specific \"/data\" path suffix for fetching secrets from Vault is optional and will be appended if not present in specified path."

fn spec.provider.vault.withReadYourWrites

withReadYourWrites(readYourWrites)

"ReadYourWrites ensures isolated read-after-write semantics by providing discovered cluster replication states in each request. More information about eventual consistency in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency"

fn spec.provider.vault.withServer

withServer(server)

"Server is the connection address for the Vault server, e.g: \"https://vault.example.com:8200\"."

fn spec.provider.vault.withVersion

withVersion(version)

"Version is the Vault KV secret engine version. This can be either \"v1\" or \"v2\". Version defaults to \"v2\"."

obj spec.provider.vault.auth

"Auth configures how secret-manager authenticates with the Vault server."

obj spec.provider.vault.auth.appRole

"AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource."

fn spec.provider.vault.auth.appRole.withPath

withPath(path)

"Path where the App Role authentication backend is mounted in Vault, e.g: \"approle\

fn spec.provider.vault.auth.appRole.withRoleId

withRoleId(roleId)

"RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault."

obj spec.provider.vault.auth.appRole.secretRef

"Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The key field must be specified and denotes which entry within the Secret resource is used as the app role secret."

fn spec.provider.vault.auth.appRole.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.appRole.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.appRole.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.cert

"Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate Cert authentication method"

obj spec.provider.vault.auth.cert.clientCert

"ClientCert is a certificate to authenticate using the Cert Vault authentication method"

fn spec.provider.vault.auth.cert.clientCert.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.cert.clientCert.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.cert.clientCert.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.cert.secretRef

"SecretRef to a key in a Secret resource containing client private key to authenticate with Vault using the Cert authentication method"

fn spec.provider.vault.auth.cert.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.cert.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.cert.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.jwt

"Jwt authenticates with Vault by passing role and JWT token using the JWT/OIDC authentication method"

fn spec.provider.vault.auth.jwt.withPath

withPath(path)

"Path where the JWT authentication backend is mounted in Vault, e.g: \"jwt\

fn spec.provider.vault.auth.jwt.withRole

withRole(role)

"Role is a JWT role to authenticate using the JWT/OIDC Vault authentication method"

obj spec.provider.vault.auth.jwt.secretRef

"SecretRef to a key in a Secret resource containing JWT token to authenticate with Vault using the JWT/OIDC authentication method"

fn spec.provider.vault.auth.jwt.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.jwt.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.jwt.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.kubernetes

"Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server."

fn spec.provider.vault.auth.kubernetes.withMountPath

withMountPath(mountPath)

"Path where the Kubernetes authentication backend is mounted in Vault, e.g: \"kubernetes\

fn spec.provider.vault.auth.kubernetes.withRole

withRole(role)

"A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies."

obj spec.provider.vault.auth.kubernetes.secretRef

"Optional secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. If a name is specified without a key, token is the default. If one is not specified, the one bound to the controller will be used."

fn spec.provider.vault.auth.kubernetes.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.kubernetes.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.kubernetes.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.kubernetes.serviceAccountRef

"Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Vault. If the service account selector is not supplied, the secretRef will be used instead."

fn spec.provider.vault.auth.kubernetes.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.vault.auth.kubernetes.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.ldap

"Ldap authenticates with Vault by passing username/password pair using the LDAP authentication method"

fn spec.provider.vault.auth.ldap.withPath

withPath(path)

"Path where the LDAP authentication backend is mounted in Vault, e.g: \"ldap\

fn spec.provider.vault.auth.ldap.withUsername

withUsername(username)

"Username is a LDAP user name used to authenticate using the LDAP Vault authentication method"

obj spec.provider.vault.auth.ldap.secretRef

"SecretRef to a key in a Secret resource containing password for the LDAP user used to authenticate with Vault using the LDAP authentication method"

fn spec.provider.vault.auth.ldap.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.ldap.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.ldap.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.tokenSecretRef

"TokenSecretRef authenticates with Vault by presenting a token."

fn spec.provider.vault.auth.tokenSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.tokenSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.tokenSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.caProvider

"The provider for the CA bundle to use to validate Vault server certificate."

fn spec.provider.vault.caProvider.withKey

withKey(key)

"The key the value inside of the provider type to use, only used with \"Secret\" type"

fn spec.provider.vault.caProvider.withName

withName(name)

"The name of the object located at the provider type."

fn spec.provider.vault.caProvider.withNamespace

withNamespace(namespace)

"The namespace the Provider type is in."

fn spec.provider.vault.caProvider.withType

withType(type)

"The type of provider to use such as \"Secret\", or \"ConfigMap\"."

obj spec.provider.webhook

"Webhook configures this store to sync secrets using a generic templated webhook"

fn spec.provider.webhook.withBody

withBody(body)

"Body"

fn spec.provider.webhook.withCaBundle

withCaBundle(caBundle)

"PEM encoded CA bundle used to validate webhook server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection."

fn spec.provider.webhook.withHeaders

withHeaders(headers)

"Headers"

fn spec.provider.webhook.withHeadersMixin

withHeadersMixin(headers)

"Headers"

Note: This function appends passed data to existing values

fn spec.provider.webhook.withMethod

withMethod(method)

"Webhook Method"

fn spec.provider.webhook.withSecrets

withSecrets(secrets)

"Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name"

fn spec.provider.webhook.withSecretsMixin

withSecretsMixin(secrets)

"Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name"

Note: This function appends passed data to existing values

fn spec.provider.webhook.withTimeout

withTimeout(timeout)

"Timeout"

fn spec.provider.webhook.withUrl

withUrl(url)

"Webhook url to call"

obj spec.provider.webhook.caProvider

"The provider for the CA bundle to use to validate webhook server certificate."

fn spec.provider.webhook.caProvider.withKey

withKey(key)

"The key the value inside of the provider type to use, only used with \"Secret\" type"

fn spec.provider.webhook.caProvider.withName

withName(name)

"The name of the object located at the provider type."

fn spec.provider.webhook.caProvider.withNamespace

withNamespace(namespace)

"The namespace the Provider type is in."

fn spec.provider.webhook.caProvider.withType

withType(type)

"The type of provider to use such as \"Secret\", or \"ConfigMap\"."

obj spec.provider.webhook.result

"Result formatting"

fn spec.provider.webhook.result.withJsonPath

withJsonPath(jsonPath)

"Json path of return value"

obj spec.provider.webhook.secrets

"Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name"

fn spec.provider.webhook.secrets.withName

withName(name)

"Name of this secret in templates"

obj spec.provider.webhook.secrets.secretRef

"Secret ref to fill in credentials"

fn spec.provider.webhook.secrets.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.webhook.secrets.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.webhook.secrets.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.yandexlockbox

"YandexLockbox configures this store to sync secrets using Yandex Lockbox provider"

fn spec.provider.yandexlockbox.withApiEndpoint

withApiEndpoint(apiEndpoint)

"Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')"

obj spec.provider.yandexlockbox.auth

"Auth defines the information necessary to authenticate against Yandex Lockbox"

obj spec.provider.yandexlockbox.auth.authorizedKeySecretRef

"The authorized key used for authentication"

fn spec.provider.yandexlockbox.auth.authorizedKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.yandexlockbox.auth.authorizedKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.yandexlockbox.auth.authorizedKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.yandexlockbox.caProvider

"The provider for the CA bundle to use to validate Yandex.Cloud server certificate."

obj spec.provider.yandexlockbox.caProvider.certSecretRef

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.yandexlockbox.caProvider.certSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.yandexlockbox.caProvider.certSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.yandexlockbox.caProvider.certSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.retrySettings

"Used to configure http retries if failed"

fn spec.retrySettings.withMaxRetries

withMaxRetries(maxRetries)

fn spec.retrySettings.withRetryInterval

withRetryInterval(retryInterval)