nogroup.v1beta1.clusterSecretStore

"ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields."

Index

• fn new(name)
• obj metadata
  • fn withAnnotations(annotations)
  • fn withAnnotationsMixin(annotations)
  • fn withClusterName(clusterName)
  • fn withCreationTimestamp(creationTimestamp)
  • fn withDeletionGracePeriodSeconds(deletionGracePeriodSeconds)
  • fn withDeletionTimestamp(deletionTimestamp)
  • fn withFinalizers(finalizers)
  • fn withFinalizersMixin(finalizers)
  • fn withGenerateName(generateName)
  • fn withGeneration(generation)
  • fn withLabels(labels)
  • fn withLabelsMixin(labels)
  • fn withName(name)
  • fn withNamespace(namespace)
  • fn withOwnerReferences(ownerReferences)
  • fn withOwnerReferencesMixin(ownerReferences)
  • fn withResourceVersion(resourceVersion)
  • fn withSelfLink(selfLink)
  • fn withUid(uid)
• obj spec
  • fn withConditions(conditions)
  • fn withConditionsMixin(conditions)
  • fn withController(controller)
  • fn withRefreshInterval(refreshInterval)
  • obj spec.conditions
    • fn withNamespaces(namespaces)
    • fn withNamespacesMixin(namespaces)
    • obj spec.conditions.namespaceSelector
      • fn withMatchExpressions(matchExpressions)
      • fn withMatchExpressionsMixin(matchExpressions)
      • fn withMatchLabels(matchLabels)
      • fn withMatchLabelsMixin(matchLabels)
      • obj spec.conditions.namespaceSelector.matchExpressions
        • fn withKey(key)
        • fn withOperator(operator)
        • fn withValues(values)
        • fn withValuesMixin(values)
  • obj spec.provider
    • obj spec.provider.akeyless
      • fn withAkeylessGWApiURL(akeylessGWApiURL)
      • fn withCaBundle(caBundle)
      • obj spec.provider.akeyless.authSecretRef
        • obj spec.provider.akeyless.authSecretRef.kubernetesAuth
          • fn withAccessID(accessID)
          • fn withK8sConfName(k8sConfName)
          • obj spec.provider.akeyless.authSecretRef.kubernetesAuth.secretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.akeyless.authSecretRef.kubernetesAuth.serviceAccountRef
            • fn withAudiences(audiences)
            • fn withAudiencesMixin(audiences)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.akeyless.authSecretRef.secretRef
          • obj spec.provider.akeyless.authSecretRef.secretRef.accessID
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.akeyless.authSecretRef.secretRef.accessType
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
      • obj spec.provider.akeyless.caProvider
        • fn withKey(key)
        • fn withName(name)
        • fn withNamespace(namespace)
        • fn withType(type)
    • obj spec.provider.alibaba
      • fn withRegionID(regionID)
      • obj spec.provider.alibaba.auth
        • obj spec.provider.alibaba.auth.rrsa
          • fn withOidcProviderArn(oidcProviderArn)
          • fn withOidcTokenFilePath(oidcTokenFilePath)
          • fn withRoleArn(roleArn)
          • fn withSessionName(sessionName)
        • obj spec.provider.alibaba.auth.secretRef
          • obj spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.aws
      • fn withAdditionalRoles(additionalRoles)
      • fn withAdditionalRolesMixin(additionalRoles)
      • fn withExternalID(externalID)
      • fn withRegion(region)
      • fn withRole(role)
      • fn withService(service)
      • obj spec.provider.aws.auth
        • obj spec.provider.aws.auth.jwt
          • obj spec.provider.aws.auth.jwt.serviceAccountRef
            • fn withAudiences(audiences)
            • fn withAudiencesMixin(audiences)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.aws.auth.secretRef
          • obj spec.provider.aws.auth.secretRef.accessKeyIDSecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.aws.auth.secretRef.secretAccessKeySecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.aws.auth.secretRef.sessionTokenSecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.azurekv
      • fn withAuthType(authType)
      • fn withEnvironmentType(environmentType)
      • fn withIdentityId(identityId)
      • fn withTenantId(tenantId)
      • fn withVaultUrl(vaultUrl)
      • obj spec.provider.azurekv.authSecretRef
        • obj spec.provider.azurekv.authSecretRef.clientId
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
        • obj spec.provider.azurekv.authSecretRef.clientSecret
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
      • obj spec.provider.azurekv.serviceAccountRef
        • fn withAudiences(audiences)
        • fn withAudiencesMixin(audiences)
        • fn withName(name)
        • fn withNamespace(namespace)
    • obj spec.provider.doppler
      • fn withConfig(config)
      • fn withFormat(format)
      • fn withNameTransformer(nameTransformer)
      • fn withProject(project)
      • obj spec.provider.doppler.auth
        • obj spec.provider.doppler.auth.secretRef
          • obj spec.provider.doppler.auth.secretRef.dopplerToken
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.fake
      • fn withData(data)
      • fn withDataMixin(data)
      • obj spec.provider.fake.data
        • fn withKey(key)
        • fn withValue(value)
        • fn withValueMap(valueMap)
        • fn withValueMapMixin(valueMap)
        • fn withVersion(version)
    • obj spec.provider.gcpsm
      • fn withProjectID(projectID)
      • obj spec.provider.gcpsm.auth
        • obj spec.provider.gcpsm.auth.secretRef
          • obj spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.gcpsm.auth.workloadIdentity
          • fn withClusterLocation(clusterLocation)
          • fn withClusterName(clusterName)
          • fn withClusterProjectID(clusterProjectID)
          • obj spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef
            • fn withAudiences(audiences)
            • fn withAudiencesMixin(audiences)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.gitlab
      • fn withEnvironment(environment)
      • fn withGroupIDs(groupIDs)
      • fn withGroupIDsMixin(groupIDs)
      • fn withInheritFromGroups(inheritFromGroups)
      • fn withProjectID(projectID)
      • fn withUrl(url)
      • obj spec.provider.gitlab.auth
        • obj spec.provider.gitlab.auth.secretRef
          • obj spec.provider.gitlab.auth.secretRef.accessToken
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.ibm
      • fn withServiceUrl(serviceUrl)
      • obj spec.provider.ibm.auth
        • obj spec.provider.ibm.auth.containerAuth
          • fn withIamEndpoint(iamEndpoint)
          • fn withProfile(profile)
          • fn withTokenLocation(tokenLocation)
        • obj spec.provider.ibm.auth.secretRef
          • obj spec.provider.ibm.auth.secretRef.secretApiKeySecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.keepersecurity
      • fn withFolderID(folderID)
      • obj spec.provider.keepersecurity.authRef
        • fn withKey(key)
        • fn withName(name)
        • fn withNamespace(namespace)
    • obj spec.provider.kubernetes
      • fn withRemoteNamespace(remoteNamespace)
      • obj spec.provider.kubernetes.auth
        • obj spec.provider.kubernetes.auth.cert
          • obj spec.provider.kubernetes.auth.cert.clientCert
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.kubernetes.auth.cert.clientKey
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.kubernetes.auth.serviceAccount
          • fn withAudiences(audiences)
          • fn withAudiencesMixin(audiences)
          • fn withName(name)
          • fn withNamespace(namespace)
        • obj spec.provider.kubernetes.auth.token
          • obj spec.provider.kubernetes.auth.token.bearerToken
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
      • obj spec.provider.kubernetes.server
        • fn withCaBundle(caBundle)
        • fn withUrl(url)
        • obj spec.provider.kubernetes.server.caProvider
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
          • fn withType(type)
    • obj spec.provider.onepassword
      • fn withConnectHost(connectHost)
      • fn withVaults(vaults)
      • fn withVaultsMixin(vaults)
      • obj spec.provider.onepassword.auth
        • obj spec.provider.onepassword.auth.secretRef
          • obj spec.provider.onepassword.auth.secretRef.connectTokenSecretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.oracle
      • fn withRegion(region)
      • fn withVault(vault)
      • obj spec.provider.oracle.auth
        • fn withTenancy(tenancy)
        • fn withUser(user)
        • obj spec.provider.oracle.auth.secretRef
          • obj spec.provider.oracle.auth.secretRef.fingerprint
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.oracle.auth.secretRef.privatekey
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
    • obj spec.provider.scaleway
      • fn withApiUrl(apiUrl)
      • fn withProjectId(projectId)
      • fn withRegion(region)
      • obj spec.provider.scaleway.accessKey
        • fn withValue(value)
        • obj spec.provider.scaleway.accessKey.secretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
      • obj spec.provider.scaleway.secretKey
        • fn withValue(value)
        • obj spec.provider.scaleway.secretKey.secretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
    • obj spec.provider.senhasegura
      • fn withIgnoreSslCertificate(ignoreSslCertificate)
      • fn withModule(module)
      • fn withUrl(url)
      • obj spec.provider.senhasegura.auth
        • fn withClientId(clientId)
        • obj spec.provider.senhasegura.auth.clientSecretSecretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
    • obj spec.provider.vault
      • fn withCaBundle(caBundle)
      • fn withForwardInconsistent(forwardInconsistent)
      • fn withNamespace(namespace)
      • fn withPath(path)
      • fn withReadYourWrites(readYourWrites)
      • fn withServer(server)
      • fn withVersion(version)
      • obj spec.provider.vault.auth
        • obj spec.provider.vault.auth.appRole
          • fn withPath(path)
          • fn withRoleId(roleId)
          • obj spec.provider.vault.auth.appRole.roleRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.vault.auth.appRole.secretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.vault.auth.cert
          • obj spec.provider.vault.auth.cert.clientCert
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.vault.auth.cert.secretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.vault.auth.iam
          • fn withExternalID(externalID)
          • fn withPath(path)
          • fn withRegion(region)
          • fn withRole(role)
          • fn withVaultAwsIamServerID(vaultAwsIamServerID)
          • fn withVaultRole(vaultRole)
          • obj spec.provider.vault.auth.iam.jwt
            • obj spec.provider.vault.auth.iam.jwt.serviceAccountRef
              • fn withAudiences(audiences)
              • fn withAudiencesMixin(audiences)
              • fn withName(name)
              • fn withNamespace(namespace)
          • obj spec.provider.vault.auth.iam.secretRef
            • obj spec.provider.vault.auth.iam.secretRef.accessKeyIDSecretRef
              • fn withKey(key)
              • fn withName(name)
              • fn withNamespace(namespace)
            • obj spec.provider.vault.auth.iam.secretRef.secretAccessKeySecretRef
              • fn withKey(key)
              • fn withName(name)
              • fn withNamespace(namespace)
            • obj spec.provider.vault.auth.iam.secretRef.sessionTokenSecretRef
              • fn withKey(key)
              • fn withName(name)
              • fn withNamespace(namespace)
        • obj spec.provider.vault.auth.jwt
          • fn withPath(path)
          • fn withRole(role)
          • obj spec.provider.vault.auth.jwt.kubernetesServiceAccountToken
            • fn withAudiences(audiences)
            • fn withAudiencesMixin(audiences)
            • fn withExpirationSeconds(expirationSeconds)
            • obj spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef
              • fn withAudiences(audiences)
              • fn withAudiencesMixin(audiences)
              • fn withName(name)
              • fn withNamespace(namespace)
          • obj spec.provider.vault.auth.jwt.secretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.vault.auth.kubernetes
          • fn withMountPath(mountPath)
          • fn withRole(role)
          • obj spec.provider.vault.auth.kubernetes.secretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
          • obj spec.provider.vault.auth.kubernetes.serviceAccountRef
            • fn withAudiences(audiences)
            • fn withAudiencesMixin(audiences)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.vault.auth.ldap
          • fn withPath(path)
          • fn withUsername(username)
          • obj spec.provider.vault.auth.ldap.secretRef
            • fn withKey(key)
            • fn withName(name)
            • fn withNamespace(namespace)
        • obj spec.provider.vault.auth.tokenSecretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
      • obj spec.provider.vault.caProvider
        • fn withKey(key)
        • fn withName(name)
        • fn withNamespace(namespace)
        • fn withType(type)
    • obj spec.provider.webhook
      • fn withBody(body)
      • fn withCaBundle(caBundle)
      • fn withHeaders(headers)
      • fn withHeadersMixin(headers)
      • fn withMethod(method)
      • fn withSecrets(secrets)
      • fn withSecretsMixin(secrets)
      • fn withTimeout(timeout)
      • fn withUrl(url)
      • obj spec.provider.webhook.caProvider
        • fn withKey(key)
        • fn withName(name)
        • fn withNamespace(namespace)
        • fn withType(type)
      • obj spec.provider.webhook.result
        • fn withJsonPath(jsonPath)
      • obj spec.provider.webhook.secrets
        • fn withName(name)
        • obj spec.provider.webhook.secrets.secretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
    • obj spec.provider.yandexcertificatemanager
      • fn withApiEndpoint(apiEndpoint)
      • obj spec.provider.yandexcertificatemanager.auth
        • obj spec.provider.yandexcertificatemanager.auth.authorizedKeySecretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
      • obj spec.provider.yandexcertificatemanager.caProvider
        • obj spec.provider.yandexcertificatemanager.caProvider.certSecretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
    • obj spec.provider.yandexlockbox
      • fn withApiEndpoint(apiEndpoint)
      • obj spec.provider.yandexlockbox.auth
        • obj spec.provider.yandexlockbox.auth.authorizedKeySecretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
      • obj spec.provider.yandexlockbox.caProvider
        • obj spec.provider.yandexlockbox.caProvider.certSecretRef
          • fn withKey(key)
          • fn withName(name)
          • fn withNamespace(namespace)
  • obj spec.retrySettings
    • fn withMaxRetries(maxRetries)
    • fn withRetryInterval(retryInterval)

Fields

fn new

new(name)

new returns an instance of ClusterSecretStore

obj metadata

"ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create."

fn metadata.withAnnotations

withAnnotations(annotations)

"Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations"

fn metadata.withAnnotationsMixin

withAnnotationsMixin(annotations)

"Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations"

Note: This function appends passed data to existing values

fn metadata.withClusterName

withClusterName(clusterName)

"The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request."

fn metadata.withCreationTimestamp

withCreationTimestamp(creationTimestamp)

"Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers."

fn metadata.withDeletionGracePeriodSeconds

withDeletionGracePeriodSeconds(deletionGracePeriodSeconds)

"Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only."

fn metadata.withDeletionTimestamp

withDeletionTimestamp(deletionTimestamp)

"Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers."

fn metadata.withFinalizers

withFinalizers(finalizers)

"Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list."

fn metadata.withFinalizersMixin

withFinalizersMixin(finalizers)

"Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list."

Note: This function appends passed data to existing values

fn metadata.withGenerateName

withGenerateName(generateName)

"GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header).\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency"

fn metadata.withGeneration

withGeneration(generation)

"A sequence number representing a specific generation of the desired state. Populated by the system. Read-only."

fn metadata.withLabels

withLabels(labels)

"Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels"

fn metadata.withLabelsMixin

withLabelsMixin(labels)

"Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels"

Note: This function appends passed data to existing values

fn metadata.withName

withName(name)

"Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names"

fn metadata.withNamespace

withNamespace(namespace)

"Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces"

fn metadata.withOwnerReferences

withOwnerReferences(ownerReferences)

"List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller."

fn metadata.withOwnerReferencesMixin

withOwnerReferencesMixin(ownerReferences)

"List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller."

Note: This function appends passed data to existing values

fn metadata.withResourceVersion

withResourceVersion(resourceVersion)

"An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency"

fn metadata.withSelfLink

withSelfLink(selfLink)

"SelfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release."

fn metadata.withUid

withUid(uid)

"UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids"

obj spec

"SecretStoreSpec defines the desired state of SecretStore."

fn spec.withConditions

withConditions(conditions)

"Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore"

fn spec.withConditionsMixin

withConditionsMixin(conditions)

"Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore"

Note: This function appends passed data to existing values

fn spec.withController

withController(controller)

"Used to select the correct ESO controller (think: ingress.ingressClassName) The ESO controller is instantiated with a specific controller name and filters ES based on this property"

fn spec.withRefreshInterval

withRefreshInterval(refreshInterval)

"Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config."

obj spec.conditions

"Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore"

fn spec.conditions.withNamespaces

withNamespaces(namespaces)

"Choose namespaces by name"

fn spec.conditions.withNamespacesMixin

withNamespacesMixin(namespaces)

"Choose namespaces by name"

Note: This function appends passed data to existing values

obj spec.conditions.namespaceSelector

"Choose namespace using a labelSelector"

fn spec.conditions.namespaceSelector.withMatchExpressions

withMatchExpressions(matchExpressions)

"matchExpressions is a list of label selector requirements. The requirements are ANDed."

fn spec.conditions.namespaceSelector.withMatchExpressionsMixin

withMatchExpressionsMixin(matchExpressions)

"matchExpressions is a list of label selector requirements. The requirements are ANDed."

Note: This function appends passed data to existing values

fn spec.conditions.namespaceSelector.withMatchLabels

withMatchLabels(matchLabels)

"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed."

fn spec.conditions.namespaceSelector.withMatchLabelsMixin

withMatchLabelsMixin(matchLabels)

"matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is \"key\", the operator is \"In\", and the values array contains only \"value\". The requirements are ANDed."

Note: This function appends passed data to existing values

obj spec.conditions.namespaceSelector.matchExpressions

"matchExpressions is a list of label selector requirements. The requirements are ANDed."

fn spec.conditions.namespaceSelector.matchExpressions.withKey

withKey(key)

"key is the label key that the selector applies to."

fn spec.conditions.namespaceSelector.matchExpressions.withOperator

withOperator(operator)

"operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist."

fn spec.conditions.namespaceSelector.matchExpressions.withValues

withValues(values)

"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch."

fn spec.conditions.namespaceSelector.matchExpressions.withValuesMixin

withValuesMixin(values)

"values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch."

Note: This function appends passed data to existing values

obj spec.provider

"Used to configure the provider. Only one provider may be set"

obj spec.provider.akeyless

"Akeyless configures this store to sync secrets using Akeyless Vault provider"

fn spec.provider.akeyless.withAkeylessGWApiURL

withAkeylessGWApiURL(akeylessGWApiURL)

"Akeyless GW API Url from which the secrets to be fetched from."

fn spec.provider.akeyless.withCaBundle

withCaBundle(caBundle)

"PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates are used to validate the TLS connection."

obj spec.provider.akeyless.authSecretRef

"Auth configures how the operator authenticates with Akeyless."

obj spec.provider.akeyless.authSecretRef.kubernetesAuth

"Kubernetes authenticates with Akeyless by passing the ServiceAccount token stored in the named Secret resource."

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.withAccessID

withAccessID(accessID)

"the Akeyless Kubernetes auth-method access-id"

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.withK8sConfName

withK8sConfName(k8sConfName)

"Kubernetes-auth configuration name in Akeyless-Gateway"

obj spec.provider.akeyless.authSecretRef.kubernetesAuth.secretRef

"Optional secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Akeyless. If a name is specified without a key, token is the default. If one is not specified, the one bound to the controller will be used."

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.akeyless.authSecretRef.kubernetesAuth.serviceAccountRef

"Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Akeyless. If the service account selector is not supplied, the secretRef will be used instead."

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.akeyless.authSecretRef.kubernetesAuth.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.akeyless.authSecretRef.secretRef

"Reference to a Secret that contains the details to authenticate with Akeyless."

obj spec.provider.akeyless.authSecretRef.secretRef.accessID

"The SecretAccessID is used for authentication"

fn spec.provider.akeyless.authSecretRef.secretRef.accessID.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.akeyless.authSecretRef.secretRef.accessID.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.akeyless.authSecretRef.secretRef.accessID.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.akeyless.authSecretRef.secretRef.accessType

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.akeyless.authSecretRef.secretRef.accessType.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.akeyless.authSecretRef.secretRef.accessType.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.akeyless.authSecretRef.secretRef.accessType.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.akeyless.authSecretRef.secretRef.accessTypeParam.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.akeyless.caProvider

"The provider for the CA bundle to use to validate Akeyless Gateway certificate."

fn spec.provider.akeyless.caProvider.withKey

withKey(key)

"The key where the CA certificate can be found in the Secret or ConfigMap."

fn spec.provider.akeyless.caProvider.withName

withName(name)

"The name of the object located at the provider type."

fn spec.provider.akeyless.caProvider.withNamespace

withNamespace(namespace)

"The namespace the Provider type is in. Can only be defined when used in a ClusterSecretStore."

fn spec.provider.akeyless.caProvider.withType

withType(type)

"The type of provider to use such as \"Secret\", or \"ConfigMap\"."

obj spec.provider.alibaba

"Alibaba configures this store to sync secrets using Alibaba Cloud provider"

fn spec.provider.alibaba.withRegionID

withRegionID(regionID)

"Alibaba Region to be used for the provider"

obj spec.provider.alibaba.auth

"AlibabaAuth contains a secretRef for credentials."

obj spec.provider.alibaba.auth.rrsa

"Authenticate against Alibaba using RRSA."

fn spec.provider.alibaba.auth.rrsa.withOidcProviderArn

withOidcProviderArn(oidcProviderArn)

fn spec.provider.alibaba.auth.rrsa.withOidcTokenFilePath

withOidcTokenFilePath(oidcTokenFilePath)

fn spec.provider.alibaba.auth.rrsa.withRoleArn

withRoleArn(roleArn)

fn spec.provider.alibaba.auth.rrsa.withSessionName

withSessionName(sessionName)

obj spec.provider.alibaba.auth.secretRef

"AlibabaAuthSecretRef holds secret references for Alibaba credentials."

obj spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef

"The AccessKeyID is used for authentication"

fn spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.alibaba.auth.secretRef.accessKeyIDSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef

"The AccessKeySecret is used for authentication"

fn spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.alibaba.auth.secretRef.accessKeySecretSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.aws

"AWS configures this store to sync secrets using AWS Secret Manager provider"

fn spec.provider.aws.withAdditionalRoles

withAdditionalRoles(additionalRoles)

"AdditionalRoles is a chained list of Role ARNs which the SecretManager provider will sequentially assume before assuming Role"

fn spec.provider.aws.withAdditionalRolesMixin

withAdditionalRolesMixin(additionalRoles)

"AdditionalRoles is a chained list of Role ARNs which the SecretManager provider will sequentially assume before assuming Role"

Note: This function appends passed data to existing values

fn spec.provider.aws.withExternalID

withExternalID(externalID)

"AWS External ID set on assumed IAM roles"

fn spec.provider.aws.withRegion

withRegion(region)

"AWS Region to be used for the provider"

fn spec.provider.aws.withRole

withRole(role)

"Role is a Role ARN which the SecretManager provider will assume"

fn spec.provider.aws.withService

withService(service)

"Service defines which service should be used to fetch the secrets"

obj spec.provider.aws.auth

"Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials"

obj spec.provider.aws.auth.jwt

"Authenticate against AWS using service account tokens."

obj spec.provider.aws.auth.jwt.serviceAccountRef

"A reference to a ServiceAccount resource."

fn spec.provider.aws.auth.jwt.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.aws.auth.jwt.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.aws.auth.jwt.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.aws.auth.jwt.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.aws.auth.secretRef

"AWSAuthSecretRef holds secret references for AWS credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate."

obj spec.provider.aws.auth.secretRef.accessKeyIDSecretRef

"The AccessKeyID is used for authentication"

fn spec.provider.aws.auth.secretRef.accessKeyIDSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.aws.auth.secretRef.accessKeyIDSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.aws.auth.secretRef.accessKeyIDSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.aws.auth.secretRef.secretAccessKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.aws.auth.secretRef.secretAccessKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.aws.auth.secretRef.secretAccessKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.aws.auth.secretRef.secretAccessKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.aws.auth.secretRef.sessionTokenSecretRef

"The SessionToken used for authentication This must be defined if AccessKeyID and SecretAccessKey are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html"

fn spec.provider.aws.auth.secretRef.sessionTokenSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.aws.auth.secretRef.sessionTokenSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.aws.auth.secretRef.sessionTokenSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.azurekv

"AzureKV configures this store to sync secrets using Azure Key Vault provider"

fn spec.provider.azurekv.withAuthType

withAuthType(authType)

"Auth type defines how to authenticate to the keyvault service. Valid values are: - \"ServicePrincipal\" (default): Using a service principal (tenantId, clientId, clientSecret) - \"ManagedIdentity\": Using Managed Identity assigned to the pod (see aad-pod-identity)"

fn spec.provider.azurekv.withEnvironmentType

withEnvironmentType(environmentType)

"EnvironmentType specifies the Azure cloud environment endpoints to use for connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint. The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud"

fn spec.provider.azurekv.withIdentityId

withIdentityId(identityId)

"If multiple Managed Identity is assigned to the pod, you can select the one to be used"

fn spec.provider.azurekv.withTenantId

withTenantId(tenantId)

"TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type."

fn spec.provider.azurekv.withVaultUrl

withVaultUrl(vaultUrl)

"Vault Url from which the secrets to be fetched from."

obj spec.provider.azurekv.authSecretRef

"Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type."

obj spec.provider.azurekv.authSecretRef.clientId

"The Azure clientId of the service principle used for authentication."

fn spec.provider.azurekv.authSecretRef.clientId.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.azurekv.authSecretRef.clientId.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.azurekv.authSecretRef.clientId.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.azurekv.authSecretRef.clientSecret

"The Azure ClientSecret of the service principle used for authentication."

fn spec.provider.azurekv.authSecretRef.clientSecret.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.azurekv.authSecretRef.clientSecret.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.azurekv.authSecretRef.clientSecret.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.azurekv.serviceAccountRef

"ServiceAccountRef specified the service account that should be used when authenticating with WorkloadIdentity."

fn spec.provider.azurekv.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.azurekv.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.azurekv.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.azurekv.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.doppler

"Doppler configures this store to sync secrets using the Doppler provider"

fn spec.provider.doppler.withConfig

withConfig(config)

"Doppler config (required if not using a Service Token)"

fn spec.provider.doppler.withFormat

withFormat(format)

"Format enables the downloading of secrets as a file (string)"

fn spec.provider.doppler.withNameTransformer

withNameTransformer(nameTransformer)

"Environment variable compatible name transforms that change secret names to a different format"

fn spec.provider.doppler.withProject

withProject(project)

"Doppler project (required if not using a Service Token)"

obj spec.provider.doppler.auth

"Auth configures how the Operator authenticates with the Doppler API"

obj spec.provider.doppler.auth.secretRef

obj spec.provider.doppler.auth.secretRef.dopplerToken

"The DopplerToken is used for authentication. See https://docs.doppler.com/reference/api#authentication for auth token types. The Key attribute defaults to dopplerToken if not specified."

fn spec.provider.doppler.auth.secretRef.dopplerToken.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.doppler.auth.secretRef.dopplerToken.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.doppler.auth.secretRef.dopplerToken.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.fake

"Fake configures a store with static key/value pairs"

fn spec.provider.fake.withData

withData(data)

fn spec.provider.fake.withDataMixin

withDataMixin(data)

Note: This function appends passed data to existing values

obj spec.provider.fake.data

fn spec.provider.fake.data.withKey

withKey(key)

fn spec.provider.fake.data.withValue

withValue(value)

fn spec.provider.fake.data.withValueMap

withValueMap(valueMap)

fn spec.provider.fake.data.withValueMapMixin

withValueMapMixin(valueMap)

Note: This function appends passed data to existing values

fn spec.provider.fake.data.withVersion

withVersion(version)

obj spec.provider.gcpsm

"GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider"

fn spec.provider.gcpsm.withProjectID

withProjectID(projectID)

"ProjectID project where secret is located"

obj spec.provider.gcpsm.auth

"Auth defines the information necessary to authenticate against GCP"

obj spec.provider.gcpsm.auth.secretRef

obj spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.gcpsm.auth.secretRef.secretAccessKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.gcpsm.auth.workloadIdentity

fn spec.provider.gcpsm.auth.workloadIdentity.withClusterLocation

withClusterLocation(clusterLocation)

fn spec.provider.gcpsm.auth.workloadIdentity.withClusterName

withClusterName(clusterName)

fn spec.provider.gcpsm.auth.workloadIdentity.withClusterProjectID

withClusterProjectID(clusterProjectID)

obj spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef

"A reference to a ServiceAccount resource."

fn spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.gcpsm.auth.workloadIdentity.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.gitlab

"GitLab configures this store to sync secrets using GitLab Variables provider"

fn spec.provider.gitlab.withEnvironment

withEnvironment(environment)

"Environment environment_scope of gitlab CI/CD variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment on how to create environments)"

fn spec.provider.gitlab.withGroupIDs

withGroupIDs(groupIDs)

"GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables."

fn spec.provider.gitlab.withGroupIDsMixin

withGroupIDsMixin(groupIDs)

"GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables."

Note: This function appends passed data to existing values

fn spec.provider.gitlab.withInheritFromGroups

withInheritFromGroups(inheritFromGroups)

"InheritFromGroups specifies whether parent groups should be discovered and checked for secrets."

fn spec.provider.gitlab.withProjectID

withProjectID(projectID)

"ProjectID specifies a project where secrets are located."

fn spec.provider.gitlab.withUrl

withUrl(url)

"URL configures the GitLab instance URL. Defaults to https://gitlab.com/."

obj spec.provider.gitlab.auth

"Auth configures how secret-manager authenticates with a GitLab instance."

obj spec.provider.gitlab.auth.secretRef

obj spec.provider.gitlab.auth.secretRef.accessToken

"AccessToken is used for authentication."

fn spec.provider.gitlab.auth.secretRef.accessToken.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.gitlab.auth.secretRef.accessToken.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.gitlab.auth.secretRef.accessToken.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.ibm

"IBM configures this store to sync secrets using IBM Cloud provider"

fn spec.provider.ibm.withServiceUrl

withServiceUrl(serviceUrl)

"ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance"

obj spec.provider.ibm.auth

"Auth configures how secret-manager authenticates with the IBM secrets manager."

obj spec.provider.ibm.auth.containerAuth

"IBM Container-based auth with IAM Trusted Profile."

fn spec.provider.ibm.auth.containerAuth.withIamEndpoint

withIamEndpoint(iamEndpoint)

fn spec.provider.ibm.auth.containerAuth.withProfile

withProfile(profile)

"the IBM Trusted Profile"

fn spec.provider.ibm.auth.containerAuth.withTokenLocation

withTokenLocation(tokenLocation)

"Location the token is mounted on the pod"

obj spec.provider.ibm.auth.secretRef

obj spec.provider.ibm.auth.secretRef.secretApiKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.ibm.auth.secretRef.secretApiKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.ibm.auth.secretRef.secretApiKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.ibm.auth.secretRef.secretApiKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.keepersecurity

"KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider"

fn spec.provider.keepersecurity.withFolderID

withFolderID(folderID)

obj spec.provider.keepersecurity.authRef

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.keepersecurity.authRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.keepersecurity.authRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.keepersecurity.authRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.kubernetes

"Kubernetes configures this store to sync secrets using a Kubernetes cluster provider"

fn spec.provider.kubernetes.withRemoteNamespace

withRemoteNamespace(remoteNamespace)

"Remote namespace to fetch the secrets from"

obj spec.provider.kubernetes.auth

"Auth configures how secret-manager authenticates with a Kubernetes instance."

obj spec.provider.kubernetes.auth.cert

"has both clientCert and clientKey as secretKeySelector"

obj spec.provider.kubernetes.auth.cert.clientCert

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.kubernetes.auth.cert.clientCert.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.kubernetes.auth.cert.clientCert.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.kubernetes.auth.cert.clientCert.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.kubernetes.auth.cert.clientKey

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.kubernetes.auth.cert.clientKey.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.kubernetes.auth.cert.clientKey.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.kubernetes.auth.cert.clientKey.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.kubernetes.auth.serviceAccount

"points to a service account that should be used for authentication"

fn spec.provider.kubernetes.auth.serviceAccount.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.kubernetes.auth.serviceAccount.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.kubernetes.auth.serviceAccount.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.kubernetes.auth.serviceAccount.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.kubernetes.auth.token

"use static token to authenticate with"

obj spec.provider.kubernetes.auth.token.bearerToken

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.kubernetes.auth.token.bearerToken.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.kubernetes.auth.token.bearerToken.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.kubernetes.auth.token.bearerToken.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.kubernetes.server

"configures the Kubernetes server Address."

fn spec.provider.kubernetes.server.withCaBundle

withCaBundle(caBundle)

"CABundle is a base64-encoded CA certificate"

fn spec.provider.kubernetes.server.withUrl

withUrl(url)

"configures the Kubernetes server Address."

obj spec.provider.kubernetes.server.caProvider

"see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider"

fn spec.provider.kubernetes.server.caProvider.withKey

withKey(key)

"The key where the CA certificate can be found in the Secret or ConfigMap."

fn spec.provider.kubernetes.server.caProvider.withName

withName(name)

"The name of the object located at the provider type."

fn spec.provider.kubernetes.server.caProvider.withNamespace

withNamespace(namespace)

"The namespace the Provider type is in. Can only be defined when used in a ClusterSecretStore."

fn spec.provider.kubernetes.server.caProvider.withType

withType(type)

"The type of provider to use such as \"Secret\", or \"ConfigMap\"."

obj spec.provider.onepassword

"OnePassword configures this store to sync secrets using the 1Password Cloud provider"

fn spec.provider.onepassword.withConnectHost

withConnectHost(connectHost)

"ConnectHost defines the OnePassword Connect Server to connect to"

fn spec.provider.onepassword.withVaults

withVaults(vaults)

"Vaults defines which OnePassword vaults to search in which order"

fn spec.provider.onepassword.withVaultsMixin

withVaultsMixin(vaults)

"Vaults defines which OnePassword vaults to search in which order"

Note: This function appends passed data to existing values

obj spec.provider.onepassword.auth

"Auth defines the information necessary to authenticate against OnePassword Connect Server"

obj spec.provider.onepassword.auth.secretRef

"OnePasswordAuthSecretRef holds secret references for 1Password credentials."

obj spec.provider.onepassword.auth.secretRef.connectTokenSecretRef

"The ConnectToken is used for authentication to a 1Password Connect Server."

fn spec.provider.onepassword.auth.secretRef.connectTokenSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.onepassword.auth.secretRef.connectTokenSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.onepassword.auth.secretRef.connectTokenSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.oracle

"Oracle configures this store to sync secrets using Oracle Vault provider"

fn spec.provider.oracle.withRegion

withRegion(region)

"Region is the region where vault is located."

fn spec.provider.oracle.withVault

withVault(vault)

"Vault is the vault's OCID of the specific vault where secret is located."

obj spec.provider.oracle.auth

"Auth configures how secret-manager authenticates with the Oracle Vault. If empty, use the instance principal, otherwise the user credentials specified in Auth."

fn spec.provider.oracle.auth.withTenancy

withTenancy(tenancy)

"Tenancy is the tenancy OCID where user is located."

fn spec.provider.oracle.auth.withUser

withUser(user)

"User is an access OCID specific to the account."

obj spec.provider.oracle.auth.secretRef

"SecretRef to pass through sensitive information."

obj spec.provider.oracle.auth.secretRef.fingerprint

"Fingerprint is the fingerprint of the API private key."

fn spec.provider.oracle.auth.secretRef.fingerprint.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.oracle.auth.secretRef.fingerprint.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.oracle.auth.secretRef.fingerprint.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.oracle.auth.secretRef.privatekey

"PrivateKey is the user's API Signing Key in PEM format, used for authentication."

fn spec.provider.oracle.auth.secretRef.privatekey.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.oracle.auth.secretRef.privatekey.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.oracle.auth.secretRef.privatekey.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.scaleway

"Scaleway"

fn spec.provider.scaleway.withApiUrl

withApiUrl(apiUrl)

"APIURL is the url of the api to use. Defaults to https://api.scaleway.com"

fn spec.provider.scaleway.withProjectId

withProjectId(projectId)

"ProjectID is the id of your project, which you can find in the console: https://console.scaleway.com/project/settings"

fn spec.provider.scaleway.withRegion

withRegion(region)

"Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone"

obj spec.provider.scaleway.accessKey

"AccessKey is the non-secret part of the api key."

fn spec.provider.scaleway.accessKey.withValue

withValue(value)

"Value can be specified directly to set a value without using a secret."

obj spec.provider.scaleway.accessKey.secretRef

"SecretRef references a key in a secret that will be used as value."

fn spec.provider.scaleway.accessKey.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.scaleway.accessKey.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.scaleway.accessKey.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.scaleway.secretKey

"SecretKey is the non-secret part of the api key."

fn spec.provider.scaleway.secretKey.withValue

withValue(value)

"Value can be specified directly to set a value without using a secret."

obj spec.provider.scaleway.secretKey.secretRef

"SecretRef references a key in a secret that will be used as value."

fn spec.provider.scaleway.secretKey.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.scaleway.secretKey.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.scaleway.secretKey.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.senhasegura

"Senhasegura configures this store to sync secrets using senhasegura provider"

fn spec.provider.senhasegura.withIgnoreSslCertificate

withIgnoreSslCertificate(ignoreSslCertificate)

"IgnoreSslCertificate defines if SSL certificate must be ignored"

fn spec.provider.senhasegura.withModule

withModule(module)

"Module defines which senhasegura module should be used to get secrets"

fn spec.provider.senhasegura.withUrl

withUrl(url)

"URL of senhasegura"

obj spec.provider.senhasegura.auth

"Auth defines parameters to authenticate in senhasegura"

fn spec.provider.senhasegura.auth.withClientId

withClientId(clientId)

obj spec.provider.senhasegura.auth.clientSecretSecretRef

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.senhasegura.auth.clientSecretSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.senhasegura.auth.clientSecretSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.senhasegura.auth.clientSecretSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault

"Vault configures this store to sync secrets using Hashi provider"

fn spec.provider.vault.withCaBundle

withCaBundle(caBundle)

"PEM encoded CA bundle used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection."

fn spec.provider.vault.withForwardInconsistent

withForwardInconsistent(forwardInconsistent)

"ForwardInconsistent tells Vault to forward read-after-write requests to the Vault leader instead of simply retrying within a loop. This can increase performance if the option is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header"

fn spec.provider.vault.withNamespace

withNamespace(namespace)

"Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: \"ns1\". More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces"

fn spec.provider.vault.withPath

withPath(path)

"Path is the mount path of the Vault KV backend endpoint, e.g: \"secret\". The v2 KV secret engine version specific \"/data\" path suffix for fetching secrets from Vault is optional and will be appended if not present in specified path."

fn spec.provider.vault.withReadYourWrites

withReadYourWrites(readYourWrites)

"ReadYourWrites ensures isolated read-after-write semantics by providing discovered cluster replication states in each request. More information about eventual consistency in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency"

fn spec.provider.vault.withServer

withServer(server)

"Server is the connection address for the Vault server, e.g: \"https://vault.example.com:8200\"."

fn spec.provider.vault.withVersion

withVersion(version)

"Version is the Vault KV secret engine version. This can be either \"v1\" or \"v2\". Version defaults to \"v2\"."

obj spec.provider.vault.auth

"Auth configures how secret-manager authenticates with the Vault server."

obj spec.provider.vault.auth.appRole

"AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource."

fn spec.provider.vault.auth.appRole.withPath

withPath(path)

"Path where the App Role authentication backend is mounted in Vault, e.g: \"approle\

fn spec.provider.vault.auth.appRole.withRoleId

withRoleId(roleId)

"RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault."

obj spec.provider.vault.auth.appRole.roleRef

"Reference to a key in a Secret that contains the App Role ID used to authenticate with Vault. The key field must be specified and denotes which entry within the Secret resource is used as the app role id."

fn spec.provider.vault.auth.appRole.roleRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.appRole.roleRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.appRole.roleRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.appRole.secretRef

"Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The key field must be specified and denotes which entry within the Secret resource is used as the app role secret."

fn spec.provider.vault.auth.appRole.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.appRole.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.appRole.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.cert

"Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate Cert authentication method"

obj spec.provider.vault.auth.cert.clientCert

"ClientCert is a certificate to authenticate using the Cert Vault authentication method"

fn spec.provider.vault.auth.cert.clientCert.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.cert.clientCert.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.cert.clientCert.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.cert.secretRef

"SecretRef to a key in a Secret resource containing client private key to authenticate with Vault using the Cert authentication method"

fn spec.provider.vault.auth.cert.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.cert.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.cert.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.iam

"Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials AWS IAM authentication method"

fn spec.provider.vault.auth.iam.withExternalID

withExternalID(externalID)

"AWS External ID set on assumed IAM roles"

fn spec.provider.vault.auth.iam.withPath

withPath(path)

"Path where the AWS auth method is enabled in Vault, e.g: \"aws\

fn spec.provider.vault.auth.iam.withRegion

withRegion(region)

"AWS region"

fn spec.provider.vault.auth.iam.withRole

withRole(role)

"This is the AWS role to be assumed before talking to vault"

fn spec.provider.vault.auth.iam.withVaultAwsIamServerID

withVaultAwsIamServerID(vaultAwsIamServerID)

"X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws"

fn spec.provider.vault.auth.iam.withVaultRole

withVaultRole(vaultRole)

"Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine"

obj spec.provider.vault.auth.iam.jwt

"Specify a service account with IRSA enabled"

obj spec.provider.vault.auth.iam.jwt.serviceAccountRef

"A reference to a ServiceAccount resource."

fn spec.provider.vault.auth.iam.jwt.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.vault.auth.iam.jwt.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.vault.auth.iam.jwt.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.vault.auth.iam.jwt.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.iam.secretRef

"Specify credentials in a Secret object"

obj spec.provider.vault.auth.iam.secretRef.accessKeyIDSecretRef

"The AccessKeyID is used for authentication"

fn spec.provider.vault.auth.iam.secretRef.accessKeyIDSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.iam.secretRef.accessKeyIDSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.iam.secretRef.accessKeyIDSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.iam.secretRef.secretAccessKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.vault.auth.iam.secretRef.secretAccessKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.iam.secretRef.secretAccessKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.iam.secretRef.secretAccessKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.iam.secretRef.sessionTokenSecretRef

"The SessionToken used for authentication This must be defined if AccessKeyID and SecretAccessKey are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html"

fn spec.provider.vault.auth.iam.secretRef.sessionTokenSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.iam.secretRef.sessionTokenSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.iam.secretRef.sessionTokenSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.jwt

"Jwt authenticates with Vault by passing role and JWT token using the JWT/OIDC authentication method"

fn spec.provider.vault.auth.jwt.withPath

withPath(path)

"Path where the JWT authentication backend is mounted in Vault, e.g: \"jwt\

fn spec.provider.vault.auth.jwt.withRole

withRole(role)

"Role is a JWT role to authenticate using the JWT/OIDC Vault authentication method"

obj spec.provider.vault.auth.jwt.kubernetesServiceAccountToken

"Optional ServiceAccountToken specifies the Kubernetes service account for which to request a token for with the TokenRequest API."

fn spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.withAudiences

withAudiences(audiences)

"Optional audiences field that will be used to request a temporary Kubernetes service account token for the service account referenced by serviceAccountRef. Defaults to a single audience vault it not specified. Deprecated: use serviceAccountRef.Audiences instead"

fn spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.withAudiencesMixin

withAudiencesMixin(audiences)

"Optional audiences field that will be used to request a temporary Kubernetes service account token for the service account referenced by serviceAccountRef. Defaults to a single audience vault it not specified. Deprecated: use serviceAccountRef.Audiences instead"

Note: This function appends passed data to existing values

fn spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.withExpirationSeconds

withExpirationSeconds(expirationSeconds)

"Optional expiration time in seconds that will be used to request a temporary Kubernetes service account token for the service account referenced by serviceAccountRef. Deprecated: this will be removed in the future. Defaults to 10 minutes."

obj spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef

"Service account field containing the name of a kubernetes ServiceAccount."

fn spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.vault.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.jwt.secretRef

"Optional SecretRef that refers to a key in a Secret resource containing JWT token to authenticate with Vault using the JWT/OIDC authentication method."

fn spec.provider.vault.auth.jwt.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.jwt.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.jwt.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.kubernetes

"Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server."

fn spec.provider.vault.auth.kubernetes.withMountPath

withMountPath(mountPath)

"Path where the Kubernetes authentication backend is mounted in Vault, e.g: \"kubernetes\

fn spec.provider.vault.auth.kubernetes.withRole

withRole(role)

"A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies."

obj spec.provider.vault.auth.kubernetes.secretRef

"Optional secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. If a name is specified without a key, token is the default. If one is not specified, the one bound to the controller will be used."

fn spec.provider.vault.auth.kubernetes.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.kubernetes.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.kubernetes.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.kubernetes.serviceAccountRef

"Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Vault. If the service account selector is not supplied, the secretRef will be used instead."

fn spec.provider.vault.auth.kubernetes.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

fn spec.provider.vault.auth.kubernetes.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.vault.auth.kubernetes.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.vault.auth.kubernetes.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.ldap

"Ldap authenticates with Vault by passing username/password pair using the LDAP authentication method"

fn spec.provider.vault.auth.ldap.withPath

withPath(path)

"Path where the LDAP authentication backend is mounted in Vault, e.g: \"ldap\

fn spec.provider.vault.auth.ldap.withUsername

withUsername(username)

"Username is a LDAP user name used to authenticate using the LDAP Vault authentication method"

obj spec.provider.vault.auth.ldap.secretRef

"SecretRef to a key in a Secret resource containing password for the LDAP user used to authenticate with Vault using the LDAP authentication method"

fn spec.provider.vault.auth.ldap.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.ldap.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.ldap.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.auth.tokenSecretRef

"TokenSecretRef authenticates with Vault by presenting a token."

fn spec.provider.vault.auth.tokenSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.vault.auth.tokenSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.vault.auth.tokenSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.vault.caProvider

"The provider for the CA bundle to use to validate Vault server certificate."

fn spec.provider.vault.caProvider.withKey

withKey(key)

"The key where the CA certificate can be found in the Secret or ConfigMap."

fn spec.provider.vault.caProvider.withName

withName(name)

"The name of the object located at the provider type."

fn spec.provider.vault.caProvider.withNamespace

withNamespace(namespace)

"The namespace the Provider type is in. Can only be defined when used in a ClusterSecretStore."

fn spec.provider.vault.caProvider.withType

withType(type)

"The type of provider to use such as \"Secret\", or \"ConfigMap\"."

obj spec.provider.webhook

"Webhook configures this store to sync secrets using a generic templated webhook"

fn spec.provider.webhook.withBody

withBody(body)

"Body"

fn spec.provider.webhook.withCaBundle

withCaBundle(caBundle)

"PEM encoded CA bundle used to validate webhook server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection."

fn spec.provider.webhook.withHeaders

withHeaders(headers)

"Headers"

fn spec.provider.webhook.withHeadersMixin

withHeadersMixin(headers)

"Headers"

Note: This function appends passed data to existing values

fn spec.provider.webhook.withMethod

withMethod(method)

"Webhook Method"

fn spec.provider.webhook.withSecrets

withSecrets(secrets)

"Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name"

fn spec.provider.webhook.withSecretsMixin

withSecretsMixin(secrets)

"Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name"

Note: This function appends passed data to existing values

fn spec.provider.webhook.withTimeout

withTimeout(timeout)

"Timeout"

fn spec.provider.webhook.withUrl

withUrl(url)

"Webhook url to call"

obj spec.provider.webhook.caProvider

"The provider for the CA bundle to use to validate webhook server certificate."

fn spec.provider.webhook.caProvider.withKey

withKey(key)

"The key the value inside of the provider type to use, only used with \"Secret\" type"

fn spec.provider.webhook.caProvider.withName

withName(name)

"The name of the object located at the provider type."

fn spec.provider.webhook.caProvider.withNamespace

withNamespace(namespace)

"The namespace the Provider type is in."

fn spec.provider.webhook.caProvider.withType

withType(type)

"The type of provider to use such as \"Secret\", or \"ConfigMap\"."

obj spec.provider.webhook.result

"Result formatting"

fn spec.provider.webhook.result.withJsonPath

withJsonPath(jsonPath)

"Json path of return value"

obj spec.provider.webhook.secrets

"Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name"

fn spec.provider.webhook.secrets.withName

withName(name)

"Name of this secret in templates"

obj spec.provider.webhook.secrets.secretRef

"Secret ref to fill in credentials"

fn spec.provider.webhook.secrets.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.webhook.secrets.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.webhook.secrets.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.yandexcertificatemanager

"YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider"

fn spec.provider.yandexcertificatemanager.withApiEndpoint

withApiEndpoint(apiEndpoint)

"Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')"

obj spec.provider.yandexcertificatemanager.auth

"Auth defines the information necessary to authenticate against Yandex Certificate Manager"

obj spec.provider.yandexcertificatemanager.auth.authorizedKeySecretRef

"The authorized key used for authentication"

fn spec.provider.yandexcertificatemanager.auth.authorizedKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.yandexcertificatemanager.auth.authorizedKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.yandexcertificatemanager.auth.authorizedKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.yandexcertificatemanager.caProvider

"The provider for the CA bundle to use to validate Yandex.Cloud server certificate."

obj spec.provider.yandexcertificatemanager.caProvider.certSecretRef

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.yandexcertificatemanager.caProvider.certSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.yandexcertificatemanager.caProvider.certSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.yandexcertificatemanager.caProvider.certSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.yandexlockbox

"YandexLockbox configures this store to sync secrets using Yandex Lockbox provider"

fn spec.provider.yandexlockbox.withApiEndpoint

withApiEndpoint(apiEndpoint)

"Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')"

obj spec.provider.yandexlockbox.auth

"Auth defines the information necessary to authenticate against Yandex Lockbox"

obj spec.provider.yandexlockbox.auth.authorizedKeySecretRef

"The authorized key used for authentication"

fn spec.provider.yandexlockbox.auth.authorizedKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.yandexlockbox.auth.authorizedKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.yandexlockbox.auth.authorizedKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.provider.yandexlockbox.caProvider

"The provider for the CA bundle to use to validate Yandex.Cloud server certificate."

obj spec.provider.yandexlockbox.caProvider.certSecretRef

"A reference to a specific 'key' within a Secret resource, In some instances, key is a required field."

fn spec.provider.yandexlockbox.caProvider.certSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be defaulted, in others it may be required."

fn spec.provider.yandexlockbox.caProvider.certSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.yandexlockbox.caProvider.certSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults to the namespace of the referent."

obj spec.retrySettings

"Used to configure http retries if failed"

fn spec.retrySettings.withMaxRetries

withMaxRetries(maxRetries)

fn spec.retrySettings.withRetryInterval

withRetryInterval(retryInterval)