Skip to content

generators.v1alpha1.vaultDynamicSecret

Index

Fields

fn new

new(name)

new returns an instance of VaultDynamicSecret

obj metadata

"ObjectMeta is metadata that all persisted resources must have, which includes all objects users must create."

fn metadata.withAnnotations

withAnnotations(annotations)

"Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations"

fn metadata.withAnnotationsMixin

withAnnotationsMixin(annotations)

"Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations"

Note: This function appends passed data to existing values

fn metadata.withClusterName

withClusterName(clusterName)

"The name of the cluster which the object belongs to. This is used to distinguish resources with same name and namespace in different clusters. This field is not set anywhere right now and apiserver is going to ignore it if set in create or update request."

fn metadata.withCreationTimestamp

withCreationTimestamp(creationTimestamp)

"Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers."

fn metadata.withDeletionGracePeriodSeconds

withDeletionGracePeriodSeconds(deletionGracePeriodSeconds)

"Number of seconds allowed for this object to gracefully terminate before it will be removed from the system. Only set when deletionTimestamp is also set. May only be shortened. Read-only."

fn metadata.withDeletionTimestamp

withDeletionTimestamp(deletionTimestamp)

"Time is a wrapper around time.Time which supports correct marshaling to YAML and JSON. Wrappers are provided for many of the factory methods that the time package offers."

fn metadata.withFinalizers

withFinalizers(finalizers)

"Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list."

fn metadata.withFinalizersMixin

withFinalizersMixin(finalizers)

"Must be empty before the object is deleted from the registry. Each entry is an identifier for the responsible component that will remove the entry from the list. If the deletionTimestamp of the object is non-nil, entries in this list can only be removed. Finalizers may be processed and removed in any order. Order is NOT enforced because it introduces significant risk of stuck finalizers. finalizers is a shared field, any actor with permission can reorder it. If the finalizer list is processed in order, then this can lead to a situation in which the component responsible for the first finalizer in the list is waiting for a signal (field value, external system, or other) produced by a component responsible for a finalizer later in the list, resulting in a deadlock. Without enforced ordering finalizers are free to order amongst themselves and are not vulnerable to ordering changes in the list."

Note: This function appends passed data to existing values

fn metadata.withGenerateName

withGenerateName(generateName)

"GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.\n\nIf this field is specified and the generated name exists, the server will NOT return a 409 - instead, it will either return 201 Created or 500 with Reason ServerTimeout indicating a unique name could not be found in the time allotted, and the client should retry (optionally after the time indicated in the Retry-After header).\n\nApplied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency"

fn metadata.withGeneration

withGeneration(generation)

"A sequence number representing a specific generation of the desired state. Populated by the system. Read-only."

fn metadata.withLabels

withLabels(labels)

"Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels"

fn metadata.withLabelsMixin

withLabelsMixin(labels)

"Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels"

Note: This function appends passed data to existing values

fn metadata.withName

withName(name)

"Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names"

fn metadata.withNamespace

withNamespace(namespace)

"Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the \"default\" namespace, but \"default\" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.\n\nMust be a DNS_LABEL. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/namespaces"

fn metadata.withOwnerReferences

withOwnerReferences(ownerReferences)

"List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller."

fn metadata.withOwnerReferencesMixin

withOwnerReferencesMixin(ownerReferences)

"List of objects depended by this object. If ALL objects in the list have been deleted, this object will be garbage collected. If this object is managed by a controller, then an entry in this list will point to this controller, with the controller field set to true. There cannot be more than one managing controller."

Note: This function appends passed data to existing values

fn metadata.withResourceVersion

withResourceVersion(resourceVersion)

"An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.\n\nPopulated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency"

withSelfLink(selfLink)

"SelfLink is a URL representing this object. Populated by the system. Read-only.\n\nDEPRECATED Kubernetes will stop propagating this field in 1.20 release and the field is planned to be removed in 1.21 release."

fn metadata.withUid

withUid(uid)

"UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.\n\nPopulated by the system. Read-only. More info: http://kubernetes.io/docs/user-guide/identifiers#uids"

obj spec

fn spec.withController

withController(controller)

"Used to select the correct ESO controller (think: ingress.ingressClassName)\nThe ESO controller is instantiated with a specific controller name and filters VDS based on this property"

fn spec.withMethod

withMethod(method)

"Vault API method to use (GET/POST/other)"

fn spec.withParameters

withParameters(parameters)

"Parameters to pass to Vault write (for non-GET methods)"

fn spec.withPath

withPath(path)

"Vault path to obtain the dynamic secret from"

fn spec.withResultType

withResultType(resultType)

"Result type defines which data is returned from the generator.\nBy default it is the \"data\" section of the Vault API response.\nWhen using e.g. /auth/token/create the \"data\" section is empty but\nthe \"auth\" section contains the generated token.\nPlease refer to the vault docs regarding the result data structure."

obj spec.provider

"Vault provider common spec"

fn spec.provider.withCaBundle

withCaBundle(caBundle)

"PEM encoded CA bundle used to validate Vault server certificate. Only used\nif the Server URL is using HTTPS protocol. This parameter is ignored for\nplain HTTP protocol connection. If not set the system root certificates\nare used to validate the TLS connection."

fn spec.provider.withForwardInconsistent

withForwardInconsistent(forwardInconsistent)

"ForwardInconsistent tells Vault to forward read-after-write requests to the Vault\nleader instead of simply retrying within a loop. This can increase performance if\nthe option is enabled serverside.\nhttps://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header"

fn spec.provider.withNamespace

withNamespace(namespace)

"Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows\nVault environments to support Secure Multi-tenancy. e.g: \"ns1\".\nMore about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces"

fn spec.provider.withPath

withPath(path)

"Path is the mount path of the Vault KV backend endpoint, e.g:\n\"secret\". The v2 KV secret engine version specific \"/data\" path suffix\nfor fetching secrets from Vault is optional and will be appended\nif not present in specified path."

fn spec.provider.withReadYourWrites

withReadYourWrites(readYourWrites)

"ReadYourWrites ensures isolated read-after-write semantics by\nproviding discovered cluster replication states in each request.\nMore information about eventual consistency in Vault can be found here\nhttps://www.vaultproject.io/docs/enterprise/consistency"

fn spec.provider.withServer

withServer(server)

"Server is the connection address for the Vault server, e.g: \"https://vault.example.com:8200\"."

fn spec.provider.withVersion

withVersion(version)

"Version is the Vault KV secret engine version. This can be either \"v1\" or\n\"v2\". Version defaults to \"v2\"."

obj spec.provider.auth

"Auth configures how secret-manager authenticates with the Vault server."

obj spec.provider.auth.appRole

"AppRole authenticates with Vault using the App Role auth mechanism,\nwith the role and secret stored in a Kubernetes Secret resource."

fn spec.provider.auth.appRole.withPath

withPath(path)

"Path where the App Role authentication backend is mounted\nin Vault, e.g: \"approle\

fn spec.provider.auth.appRole.withRoleId

withRoleId(roleId)

"RoleID configured in the App Role authentication backend when setting\nup the authentication backend in Vault."

obj spec.provider.auth.appRole.roleRef

"Reference to a key in a Secret that contains the App Role ID used\nto authenticate with Vault.\nThe key field must be specified and denotes which entry within the Secret\nresource is used as the app role id."

fn spec.provider.auth.appRole.roleRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.appRole.roleRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.appRole.roleRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.appRole.secretRef

"Reference to a key in a Secret that contains the App Role secret used\nto authenticate with Vault.\nThe key field must be specified and denotes which entry within the Secret\nresource is used as the app role secret."

fn spec.provider.auth.appRole.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.appRole.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.appRole.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.cert

"Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate\nCert authentication method"

obj spec.provider.auth.cert.clientCert

"ClientCert is a certificate to authenticate using the Cert Vault\nauthentication method"

fn spec.provider.auth.cert.clientCert.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.cert.clientCert.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.cert.clientCert.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.cert.secretRef

"SecretRef to a key in a Secret resource containing client private key to\nauthenticate with Vault using the Cert authentication method"

fn spec.provider.auth.cert.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.cert.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.cert.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.iam

"Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials\nAWS IAM authentication method"

fn spec.provider.auth.iam.withExternalID

withExternalID(externalID)

"AWS External ID set on assumed IAM roles"

fn spec.provider.auth.iam.withPath

withPath(path)

"Path where the AWS auth method is enabled in Vault, e.g: \"aws\

fn spec.provider.auth.iam.withRegion

withRegion(region)

"AWS region"

fn spec.provider.auth.iam.withRole

withRole(role)

"This is the AWS role to be assumed before talking to vault"

fn spec.provider.auth.iam.withVaultAwsIamServerID

withVaultAwsIamServerID(vaultAwsIamServerID)

"X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: https://developer.hashicorp.com/vault/docs/auth/aws"

fn spec.provider.auth.iam.withVaultRole

withVaultRole(vaultRole)

"Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine"

obj spec.provider.auth.iam.jwt

"Specify a service account with IRSA enabled"

obj spec.provider.auth.iam.jwt.serviceAccountRef

"A reference to a ServiceAccount resource."

fn spec.provider.auth.iam.jwt.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list"

fn spec.provider.auth.iam.jwt.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.auth.iam.jwt.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.auth.iam.jwt.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.iam.secretRef

"Specify credentials in a Secret object"

obj spec.provider.auth.iam.secretRef.accessKeyIDSecretRef

"The AccessKeyID is used for authentication"

fn spec.provider.auth.iam.secretRef.accessKeyIDSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.iam.secretRef.accessKeyIDSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.iam.secretRef.accessKeyIDSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.iam.secretRef.secretAccessKeySecretRef

"The SecretAccessKey is used for authentication"

fn spec.provider.auth.iam.secretRef.secretAccessKeySecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.iam.secretRef.secretAccessKeySecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.iam.secretRef.secretAccessKeySecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.iam.secretRef.sessionTokenSecretRef

"The SessionToken used for authentication\nThis must be defined if AccessKeyID and SecretAccessKey are temporary credentials\nsee: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html"

fn spec.provider.auth.iam.secretRef.sessionTokenSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.iam.secretRef.sessionTokenSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.iam.secretRef.sessionTokenSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.jwt

"Jwt authenticates with Vault by passing role and JWT token using the\nJWT/OIDC authentication method"

fn spec.provider.auth.jwt.withPath

withPath(path)

"Path where the JWT authentication backend is mounted\nin Vault, e.g: \"jwt\

fn spec.provider.auth.jwt.withRole

withRole(role)

"Role is a JWT role to authenticate using the JWT/OIDC Vault\nauthentication method"

obj spec.provider.auth.jwt.kubernetesServiceAccountToken

"Optional ServiceAccountToken specifies the Kubernetes service account for which to request\na token for with the TokenRequest API."

fn spec.provider.auth.jwt.kubernetesServiceAccountToken.withAudiences

withAudiences(audiences)

"Optional audiences field that will be used to request a temporary Kubernetes service\naccount token for the service account referenced by serviceAccountRef.\nDefaults to a single audience vault it not specified.\nDeprecated: use serviceAccountRef.Audiences instead"

fn spec.provider.auth.jwt.kubernetesServiceAccountToken.withAudiencesMixin

withAudiencesMixin(audiences)

"Optional audiences field that will be used to request a temporary Kubernetes service\naccount token for the service account referenced by serviceAccountRef.\nDefaults to a single audience vault it not specified.\nDeprecated: use serviceAccountRef.Audiences instead"

Note: This function appends passed data to existing values

fn spec.provider.auth.jwt.kubernetesServiceAccountToken.withExpirationSeconds

withExpirationSeconds(expirationSeconds)

"Optional expiration time in seconds that will be used to request a temporary\nKubernetes service account token for the service account referenced by\nserviceAccountRef.\nDeprecated: this will be removed in the future.\nDefaults to 10 minutes."

obj spec.provider.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef

"Service account field containing the name of a kubernetes ServiceAccount."

fn spec.provider.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list"

fn spec.provider.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.auth.jwt.kubernetesServiceAccountToken.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.jwt.secretRef

"Optional SecretRef that refers to a key in a Secret resource containing JWT token to\nauthenticate with Vault using the JWT/OIDC authentication method."

fn spec.provider.auth.jwt.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.jwt.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.jwt.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.kubernetes

"Kubernetes authenticates with Vault by passing the ServiceAccount\ntoken stored in the named Secret resource to the Vault server."

fn spec.provider.auth.kubernetes.withMountPath

withMountPath(mountPath)

"Path where the Kubernetes authentication backend is mounted in Vault, e.g:\n\"kubernetes\

fn spec.provider.auth.kubernetes.withRole

withRole(role)

"A required field containing the Vault Role to assume. A Role binds a\nKubernetes ServiceAccount with a set of Vault policies."

obj spec.provider.auth.kubernetes.secretRef

"Optional secret field containing a Kubernetes ServiceAccount JWT used\nfor authenticating with Vault. If a name is specified without a key,\ntoken is the default. If one is not specified, the one bound to\nthe controller will be used."

fn spec.provider.auth.kubernetes.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.kubernetes.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.kubernetes.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.kubernetes.serviceAccountRef

"Optional service account field containing the name of a kubernetes ServiceAccount.\nIf the service account is specified, the service account secret token JWT will be used\nfor authenticating with Vault. If the service account selector is not supplied,\nthe secretRef will be used instead."

fn spec.provider.auth.kubernetes.serviceAccountRef.withAudiences

withAudiences(audiences)

"Audience specifies the aud claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list"

fn spec.provider.auth.kubernetes.serviceAccountRef.withAudiencesMixin

withAudiencesMixin(audiences)

"Audience specifies the aud claim for the service account token\nIf the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity\nthen this audiences will be appended to the list"

Note: This function appends passed data to existing values

fn spec.provider.auth.kubernetes.serviceAccountRef.withName

withName(name)

"The name of the ServiceAccount resource being referred to."

fn spec.provider.auth.kubernetes.serviceAccountRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.ldap

"Ldap authenticates with Vault by passing username/password pair using\nthe LDAP authentication method"

fn spec.provider.auth.ldap.withPath

withPath(path)

"Path where the LDAP authentication backend is mounted\nin Vault, e.g: \"ldap\

fn spec.provider.auth.ldap.withUsername

withUsername(username)

"Username is a LDAP user name used to authenticate using the LDAP Vault\nauthentication method"

obj spec.provider.auth.ldap.secretRef

"SecretRef to a key in a Secret resource containing password for the LDAP\nuser used to authenticate with Vault using the LDAP authentication\nmethod"

fn spec.provider.auth.ldap.secretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.ldap.secretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.ldap.secretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.auth.tokenSecretRef

"TokenSecretRef authenticates with Vault by presenting a token."

fn spec.provider.auth.tokenSecretRef.withKey

withKey(key)

"The key of the entry in the Secret resource's data field to be used. Some instances of this field may be\ndefaulted, in others it may be required."

fn spec.provider.auth.tokenSecretRef.withName

withName(name)

"The name of the Secret resource being referred to."

fn spec.provider.auth.tokenSecretRef.withNamespace

withNamespace(namespace)

"Namespace of the resource being referred to. Ignored if referent is not cluster-scoped. cluster-scoped defaults\nto the namespace of the referent."

obj spec.provider.caProvider

"The provider for the CA bundle to use to validate Vault server certificate."

fn spec.provider.caProvider.withKey

withKey(key)

"The key where the CA certificate can be found in the Secret or ConfigMap."

fn spec.provider.caProvider.withName

withName(name)

"The name of the object located at the provider type."

fn spec.provider.caProvider.withNamespace

withNamespace(namespace)

"The namespace the Provider type is in.\nCan only be defined when used in a ClusterSecretStore."

fn spec.provider.caProvider.withType

withType(type)

"The type of provider to use such as \"Secret\", or \"ConfigMap\"."