diff --git a/operators/external-secrets-operator/0.9.2/manifests/external-secrets-operator-manager-config_v1_configmap.yaml b/operators/external-secrets-operator/0.9.2/manifests/external-secrets-operator-manager-config_v1_configmap.yaml new file mode 100644 index 00000000000..c1876c2c6b2 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/external-secrets-operator-manager-config_v1_configmap.yaml @@ -0,0 +1,16 @@ +apiVersion: v1 +data: + controller_manager_config.yaml: | + apiVersion: controller-runtime.sigs.k8s.io/v1alpha1 + kind: ControllerManagerConfig + health: + healthProbeBindAddress: :8081 + metrics: + bindAddress: 127.0.0.1:8080 + + leaderElection: + leaderElect: true + resourceName: 811c9dc5.external-secrets.io +kind: ConfigMap +metadata: + name: external-secrets-operator-manager-config diff --git a/operators/external-secrets-operator/0.9.2/manifests/external-secrets-operator.clusterserviceversion.yaml b/operators/external-secrets-operator/0.9.2/manifests/external-secrets-operator.clusterserviceversion.yaml new file mode 100644 index 00000000000..f6a08ea72b9 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/external-secrets-operator.clusterserviceversion.yaml @@ -0,0 +1,1068 @@ +apiVersion: operators.coreos.com/v1alpha1 +kind: ClusterServiceVersion +metadata: + annotations: + alm-examples: |- + [ + { + "apiVersion": "external-secrets.io/v1alpha1", + "kind": "ClusterSecretStore", + "metadata": { + "name": "example" + }, + "spec": { + "controller": "dev", + "provider": { + "aws": { + "auth": { + "secretRef": { + "accessKeyIDSecretRef": { + "key": "access-key", + "name": "awssm-secret" + }, + "secretAccessKeySecretRef": { + "key": "secret-access-key", + "name": "awssm-secret" + } + } + }, + "region": "eu-central-1", + "role": "iam-role", + "service": "SecretsManager" + }, + "gcpsm": { + "auth": { + "secretRef": { + "secretAccessKeySecretRef": { + "key": "secret-access-credentials", + "name": "gcpsm-secret", + "namespace": "example" + } + } + }, + "projectID": "myproject" + }, + "vault": { + "auth": { + "appRole": { + "path": "approle", + "roleId": "db02de05-fa39-4855-059b-67221c5c2f63", + "secretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "kubernetes": { + "mountPath": "kubernetes", + "role": "demo", + "secretRef": { + "key": "vault", + "name": "my-secret", + "namespace": "secret-admin" + }, + "serviceAccountRef": { + "name": "my-sa", + "namespace": "secret-admin" + } + }, + "tokenSecretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "caBundle": "...", + "namespace": "a-team", + "path": "secret", + "server": "https://vault.acme.org", + "version": "v2" + } + } + } + }, + { + "apiVersion": "external-secrets.io/v1alpha1", + "kind": "ExternalSecret", + "metadata": { + "annotations": { + "acme.org/sha": "1234" + }, + "labels": { + "acme.org/owned-by": "q-team" + }, + "name": "hello-world" + }, + "spec": { + "data": [ + { + "remoteRef": { + "key": "provider-key", + "property": "provider-key-property", + "version": "provider-key-version" + }, + "secretKey": "secret-key-to-be-managed" + } + ], + "dataFrom": [ + { + "key": "provider-key", + "property": "provider-key-property", + "version": "provider-key-version" + } + ], + "refreshInterval": "1h", + "secretStoreRef": { + "kind": "SecretStore", + "name": "secret-store-name" + }, + "target": { + "creationPolicy": "Merge", + "name": "my-secret", + "template": { + "data": { + "config.yml": "endpoints:\n- https://{{ .data.user }}:{{ .data.password }}@api.exmaple.com\n" + }, + "metadata": { + "annotations": {}, + "labels": {} + }, + "templateFrom": [ + { + "configMap": { + "items": [ + { + "key": "alertmanager.yaml" + } + ], + "name": "alertmanager" + } + } + ], + "type": "kubernetes.io/dockerconfigjson" + } + } + } + }, + { + "apiVersion": "external-secrets.io/v1alpha1", + "kind": "SecretStore", + "metadata": { + "name": "example", + "namespace": "example-ns" + }, + "spec": { + "controller": "dev", + "provider": { + "aws": { + "auth": { + "secretRef": { + "accessKeyIDSecretRef": { + "key": "access-key", + "name": "awssm-secret" + }, + "secretAccessKeySecretRef": { + "key": "secret-access-key", + "name": "awssm-secret" + } + } + }, + "region": "eu-central-1", + "role": "iam-role", + "service": "SecretsManager" + }, + "gcpsm": { + "auth": { + "secretRef": { + "secretAccessKeySecretRef": { + "key": "secret-access-credentials", + "name": "gcpsm-secret" + } + } + }, + "projectID": "myproject" + }, + "vault": { + "auth": { + "appRole": { + "path": "approle", + "roleId": "db02de05-fa39-4855-059b-67221c5c2f63", + "secretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "kubernetes": { + "mountPath": "kubernetes", + "role": "demo", + "secretRef": { + "key": "vault", + "name": "my-secret", + "namespace": "secret-admin" + }, + "serviceAccountRef": { + "name": "my-sa", + "namespace": "secret-admin" + } + }, + "tokenSecretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "caBundle": "...", + "caProvider": { + "key": "cert-key", + "name": "my-cert-secret", + "namespace": "my-cert-secret-namespace", + "type": "Secret" + }, + "namespace": "a-team", + "path": "secret", + "server": "https://vault.acme.org", + "version": "v2" + } + } + } + }, + { + "apiVersion": "external-secrets.io/v1beta1", + "kind": "ClusterExternalSecret", + "metadata": { + "name": "hello-world" + }, + "spec": { + "externalSecretName": "hello-world-es", + "externalSecretSpec": { + "data": [ + { + "remoteRef": { + "key": "provider-key", + "property": "provider-key-property", + "version": "provider-key-version" + }, + "secretKey": "secret-key-to-be-managed" + } + ], + "dataFrom": [ + { + "key": "provider-key", + "property": "provider-key-property", + "version": "provider-key-version" + } + ], + "refreshInterval": "1h", + "secretStoreRef": { + "kind": "SecretStore", + "name": "secret-store-name" + }, + "target": { + "creationPolicy": "Merge", + "name": "my-secret", + "template": { + "data": { + "config.yml": "endpoints:\n- https://{{ .data.user }}:{{ .data.password }}@api.exmaple.com\n" + }, + "metadata": { + "annotations": {}, + "labels": {} + }, + "templateFrom": [ + { + "configMap": { + "items": [ + { + "key": "alertmanager.yaml" + } + ], + "name": "alertmanager" + } + } + ], + "type": "kubernetes.io/dockerconfigjson" + } + } + }, + "namespaceSelector": { + "matchLabels": { + "cool": "label" + } + }, + "refreshTime": "1m" + } + }, + { + "apiVersion": "external-secrets.io/v1beta1", + "kind": "ClusterSecretStore", + "metadata": { + "name": "example" + }, + "spec": { + "controller": "dev", + "provider": { + "aws": { + "auth": { + "secretRef": { + "accessKeyIDSecretRef": { + "key": "access-key", + "name": "awssm-secret" + }, + "secretAccessKeySecretRef": { + "key": "secret-access-key", + "name": "awssm-secret" + } + } + }, + "region": "eu-central-1", + "role": "iam-role", + "service": "SecretsManager" + }, + "gcpsm": { + "auth": { + "secretRef": { + "secretAccessKeySecretRef": { + "key": "secret-access-credentials", + "name": "gcpsm-secret", + "namespace": "example" + } + } + }, + "projectID": "myproject" + }, + "vault": { + "auth": { + "appRole": { + "path": "approle", + "roleId": "db02de05-fa39-4855-059b-67221c5c2f63", + "secretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "kubernetes": { + "mountPath": "kubernetes", + "role": "demo", + "secretRef": { + "key": "vault", + "name": "my-secret", + "namespace": "secret-admin" + }, + "serviceAccountRef": { + "name": "my-sa", + "namespace": "secret-admin" + } + }, + "tokenSecretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "caBundle": "...", + "namespace": "a-team", + "path": "secret", + "server": "https://vault.acme.org", + "version": "v2" + } + } + } + }, + { + "apiVersion": "external-secrets.io/v1beta1", + "kind": "ExternalSecret", + "metadata": { + "annotations": { + "acme.org/sha": "1234" + }, + "labels": { + "acme.org/owned-by": "q-team" + }, + "name": "hello-world" + }, + "spec": { + "data": [ + { + "remoteRef": { + "key": "provider-key", + "property": "provider-key-property", + "version": "provider-key-version" + }, + "secretKey": "secret-key-to-be-managed" + } + ], + "dataFrom": [ + { + "extract": { + "conversionStrategy": "Default", + "key": "provider-key", + "property": "provider-key-property", + "version": "provider-key-version" + } + }, + { + "find": { + "conversionStrategy": "Unicode", + "name": { + "regexp": ".*foobar.*" + }, + "path": "path-to-filter", + "tags": { + "foo": "bar" + } + } + } + ], + "refreshInterval": "1h", + "secretStoreRef": { + "kind": "SecretStore", + "name": "secret-store-name" + }, + "target": { + "creationPolicy": "Merge", + "deletionPolicy": "Retain", + "name": "my-secret", + "template": { + "data": { + "config.yml": "endpoints:\n- https://{{ .data.user }}:{{ .data.password }}@api.exmaple.com\n" + }, + "metadata": { + "annotations": {}, + "labels": {} + }, + "templateFrom": [ + { + "configMap": { + "items": [ + { + "key": "alertmanager.yaml" + } + ], + "name": "alertmanager" + } + } + ], + "type": "kubernetes.io/dockerconfigjson" + } + } + } + }, + { + "apiVersion": "external-secrets.io/v1beta1", + "kind": "SecretStore", + "metadata": { + "name": "example", + "namespace": "example-ns" + }, + "spec": { + "controller": "dev", + "provider": { + "aws": { + "auth": { + "secretRef": { + "accessKeyIDSecretRef": { + "key": "access-key", + "name": "awssm-secret" + }, + "secretAccessKeySecretRef": { + "key": "secret-access-key", + "name": "awssm-secret" + } + } + }, + "region": "eu-central-1", + "role": "iam-role", + "service": "SecretsManager" + }, + "gcpsm": { + "auth": { + "secretRef": { + "secretAccessKeySecretRef": { + "key": "secret-access-credentials", + "name": "gcpsm-secret" + } + } + }, + "projectID": "myproject" + }, + "vault": { + "auth": { + "appRole": { + "path": "approle", + "roleId": "db02de05-fa39-4855-059b-67221c5c2f63", + "secretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "kubernetes": { + "mountPath": "kubernetes", + "role": "demo", + "secretRef": { + "key": "vault", + "name": "my-secret", + "namespace": "secret-admin" + }, + "serviceAccountRef": { + "name": "my-sa", + "namespace": "secret-admin" + } + }, + "tokenSecretRef": { + "key": "vault-token", + "name": "my-secret", + "namespace": "secret-admin" + } + }, + "caBundle": "...", + "caProvider": { + "key": "cert-key", + "name": "my-cert-secret", + "namespace": "my-cert-secret-namespace", + "type": "Secret" + }, + "namespace": "a-team", + "path": "secret", + "server": "https://vault.acme.org", + "version": "v2" + } + } + } + }, + { + "apiVersion": "operator.external-secrets.io/v1alpha1", + "kind": "OperatorConfig", + "metadata": { + "name": "sample" + }, + "spec": { + "affinity": {}, + "certController": { + "affinity": {}, + "create": true, + "deploymentAnnotations": {}, + "extraArgs": {}, + "extraEnv": [], + "fullnameOverride": "", + "image": { + "pullPolicy": "IfNotPresent", + "repository": "ghcr.io/external-secrets/external-secrets", + "tag": "" + }, + "imagePullSecrets": [], + "nameOverride": "", + "nodeSelector": {}, + "podAnnotations": {}, + "podLabels": {}, + "podSecurityContext": {}, + "priorityClassName": "", + "prometheus": { + "enabled": false, + "service": { + "port": 8080 + } + }, + "rbac": { + "create": true + }, + "requeueInterval": "5m", + "resources": {}, + "securityContext": {}, + "serviceAccount": { + "annotations": {}, + "create": true, + "name": "" + }, + "tolerations": [] + }, + "concurrent": 1, + "controllerClass": "", + "crds": { + "createClusterExternalSecret": true, + "createClusterSecretStore": true + }, + "createOperator": true, + "deploymentAnnotations": {}, + "extraArgs": {}, + "extraEnv": [], + "fullnameOverride": "", + "image": { + "pullPolicy": "IfNotPresent", + "repository": "ghcr.io/external-secrets/external-secrets", + "tag": "" + }, + "imagePullSecrets": [], + "installCRDs": false, + "leaderElect": false, + "nameOverride": "", + "nodeSelector": {}, + "podAnnotations": {}, + "podLabels": {}, + "podSecurityContext": {}, + "priorityClassName": "", + "processClusterExternalSecret": true, + "processClusterStore": true, + "prometheus": { + "enabled": false, + "service": { + "port": 8080 + } + }, + "rbac": { + "create": true + }, + "replicaCount": 1, + "resources": {}, + "scopedNamespace": "", + "scopedRBAC": false, + "securityContext": {}, + "serviceAccount": { + "annotations": {}, + "create": true, + "name": "" + }, + "tolerations": [], + "webhook": { + "affinity": {}, + "certCheckInterval": "5m", + "certDir": "/tmp/certs", + "create": true, + "deploymentAnnotations": {}, + "extraArgs": {}, + "extraEnv": [], + "fullnameOverride": "", + "image": { + "pullPolicy": "IfNotPresent", + "repository": "ghcr.io/external-secrets/external-secrets", + "tag": "" + }, + "imagePullSecrets": [], + "nameOverride": "", + "nodeSelector": {}, + "podAnnotations": {}, + "podLabels": {}, + "podSecurityContext": {}, + "priorityClassName": "", + "prometheus": { + "enabled": false, + "service": { + "port": 8080 + } + }, + "rbac": { + "create": true + }, + "replicaCount": 1, + "resources": {}, + "securityContext": {}, + "serviceAccount": { + "annotations": {}, + "create": true, + "name": "" + }, + "tolerations": [] + } + } + } + ] + capabilities: Deep Insights + categories: Security + certified: "false" + containerImage: ghcr.io/external-secrets/external-secrets-helm-operator@sha256:1886cea401e58dde094320e077271f31bdfebbe08cbb3b5e2053d3ef51e263eb + createdAt: "2023-08-05T10:30:11Z" + description: Operator to configure external-secrets helm-chart based operator + operatorframework.io/cluster-monitoring: "true" + operators.openshift.io/infrastructure-features: '["Disconnected"]' + operators.operatorframework.io/builder: operator-sdk-v1.18.0+git + operators.operatorframework.io/project_layout: helm.sdk.operatorframework.io/v1 + repository: https://github.com/external-secrets/external-secrets-helm-operator + labels: + operatorframework.io/arch.amd64: supported + operatorframework.io/os.linux: supported + name: external-secrets-operator.v0.9.2 + namespace: external-secrets +spec: + apiservicedefinitions: {} + customresourcedefinitions: + owned: + - kind: ACRAccessToken + name: acraccesstokens.generators.external-secrets.io + version: v1alpha1 + - description: Cluster scoped resource that allows you to manage ExternalSecrets across namespaces + displayName: ClusterExternalSecret + kind: ClusterExternalSecret + name: clusterexternalsecrets.external-secrets.io + version: v1beta1 + - description: Cluster-wide resource that defines how to access the external API + displayName: ClusterSecretStore v1alpha1 + kind: ClusterSecretStore + name: clustersecretstores.external-secrets.io + version: v1alpha1 + - description: Cluster-wide resource that defines how to access the external API + displayName: ClusterSecretStore v1beta1 + kind: ClusterSecretStore + name: clustersecretstores.external-secrets.io + version: v1beta1 + - kind: ECRAuthorizationToken + name: ecrauthorizationtokens.generators.external-secrets.io + version: v1alpha1 + - description: Describes what data should be fetched + displayName: ExternalSecret v1alpha1 + kind: ExternalSecret + name: externalsecrets.external-secrets.io + version: v1alpha1 + - description: Describes what data should be fetched + displayName: ExternalSecret v1beta1 + kind: ExternalSecret + name: externalsecrets.external-secrets.io + version: v1beta1 + - kind: Fake + name: fakes.generators.external-secrets.io + version: v1alpha1 + - kind: GCRAccessToken + name: gcraccesstokens.generators.external-secrets.io + version: v1alpha1 + - description: Configures external-secrets helm-chart based operator + displayName: OperatorConfig + kind: OperatorConfig + name: operatorconfigs.operator.external-secrets.io + version: v1alpha1 + - kind: Password + name: passwords.generators.external-secrets.io + version: v1alpha1 + - kind: PushSecret + name: pushsecrets.external-secrets.io + version: v1alpha1 + - description: Namespaced resource that defines how to access the external API + displayName: SecretStore v1alpha1 + kind: SecretStore + name: secretstores.external-secrets.io + version: v1alpha1 + - description: Namespaced resource that defines how to access the external API + displayName: SecretStore v1beta1 + kind: SecretStore + name: secretstores.external-secrets.io + version: v1beta1 + - kind: VaultDynamicSecret + name: vaultdynamicsecrets.generators.external-secrets.io + version: v1alpha1 + description: | + A Kubernetes Operator based on the Operator SDK (Helm version) to configure **[official external-secrets operator helm chart](https://github.com/external-secrets/external-secrets)**, so it can be installed via OLM without having to do any change on current Helm Charts. + + Before any other resources provided by this Operator can be deployed, it is essential to create an + OperatorConfig resource. + + The usual Helm Chart file `values.yaml`, like: + ```yaml + prometheus: + enabled: true + service: + port: 8080 + resources: + requests: + cpu: 10m + memory: 96Mi + limits: + cpu: 100m + memory: 256Mi + ``` + + need to be encapsulated into a new custom resource called `OperatorConfig`: + ```yaml + apiVersion: operator.external-secrets.io/v1alpha1 + kind: OperatorConfig + metadata: + name: cluster + spec: + prometheus: + enabled: true + service: + port: 8080 + resources: + requests: + cpu: 10m + memory: 96Mi + limits: + cpu: 100m + memory: 256Mi + ``` + + Once the OperatorConfig resource is deployed, the operator will create all helm chart resources, using the custom resource name as a preffix for all resources names, like for example a `Deployment` called `cluster-external-secrets`. + + ## Documentation + + * [Upstream Documentation](https://external-secrets.io) + * [Helm Operator Install](https://github.com/external-secrets/external-secrets-helm-operator/blob/main/docs/install.md) + * [Helm Operator Development](https://github.com/external-secrets/external-secrets-helm-operator/blob/main/docs/development.md) + * [Helm Operator Release](https://github.com/external-secrets/external-secrets-helm-operator/blob/main/docs/release.md) + + ## Contributing + + You can contribute by: + + * Raising any issues you find using External Secrets Operator + * Fixing issues by opening [Pull Requests](https://github.com/external-secrets/external-secrets-helm-operator/pulls) + * Submitting a patch or opening a PR + * Improving documentation + * Talking about External Secrets Operator + + All bugs, tasks or enhancements are tracked as [GitHub issues](https://github.com/external-secrets/external-secrets-helm-operator/issues). + + ## License + + External Secrets Operator is under Apache 2.0 license. See the [LICENSE](LICENSE) file for details. + displayName: External Secrets Operator + icon: + - base64data: iVBORw0KGgoAAAANSUhEUgAAATsAAAEXCAYAAADSsuOKAAAACXBIWXMAAAsTAAALEwEAmpwYAAAKT2lDQ1BQaG90b3Nob3AgSUNDIHByb2ZpbGUAAHjanVNnVFPpFj333vRCS4iAlEtvUhUIIFJCi4AUkSYqIQkQSoghodkVUcERRUUEG8igiAOOjoCMFVEsDIoK2AfkIaKOg6OIisr74Xuja9a89+bN/rXXPues852zzwfACAyWSDNRNYAMqUIeEeCDx8TG4eQuQIEKJHAAEAizZCFz/SMBAPh+PDwrIsAHvgABeNMLCADATZvAMByH/w/qQplcAYCEAcB0kThLCIAUAEB6jkKmAEBGAYCdmCZTAKAEAGDLY2LjAFAtAGAnf+bTAICd+Jl7AQBblCEVAaCRACATZYhEAGg7AKzPVopFAFgwABRmS8Q5ANgtADBJV2ZIALC3AMDOEAuyAAgMADBRiIUpAAR7AGDIIyN4AISZABRG8lc88SuuEOcqAAB4mbI8uSQ5RYFbCC1xB1dXLh4ozkkXKxQ2YQJhmkAuwnmZGTKBNA/g88wAAKCRFRHgg/P9eM4Ors7ONo62Dl8t6r8G/yJiYuP+5c+rcEAAAOF0ftH+LC+zGoA7BoBt/qIl7gRoXgugdfeLZrIPQLUAoOnaV/Nw+H48PEWhkLnZ2eXk5NhKxEJbYcpXff5nwl/AV/1s+X48/Pf14L7iJIEyXYFHBPjgwsz0TKUcz5IJhGLc5o9H/LcL//wd0yLESWK5WCoU41EScY5EmozzMqUiiUKSKcUl0v9k4t8s+wM+3zUAsGo+AXuRLahdYwP2SycQWHTA4vcAAPK7b8HUKAgDgGiD4c93/+8//UegJQCAZkmScQAAXkQkLlTKsz/HCAAARKCBKrBBG/TBGCzABhzBBdzBC/xgNoRCJMTCQhBCCmSAHHJgKayCQiiGzbAdKmAv1EAdNMBRaIaTcA4uwlW4Dj1wD/phCJ7BKLyBCQRByAgTYSHaiAFiilgjjggXmYX4IcFIBBKLJCDJiBRRIkuRNUgxUopUIFVIHfI9cgI5h1xGupE7yAAygvyGvEcxlIGyUT3UDLVDuag3GoRGogvQZHQxmo8WoJvQcrQaPYw2oefQq2gP2o8+Q8cwwOgYBzPEbDAuxsNCsTgsCZNjy7EirAyrxhqwVqwDu4n1Y8+xdwQSgUXACTYEd0IgYR5BSFhMWE7YSKggHCQ0EdoJNwkDhFHCJyKTqEu0JroR+cQYYjIxh1hILCPWEo8TLxB7iEPENyQSiUMyJ7mQAkmxpFTSEtJG0m5SI+ksqZs0SBojk8naZGuyBzmULCAryIXkneTD5DPkG+Qh8lsKnWJAcaT4U+IoUspqShnlEOU05QZlmDJBVaOaUt2ooVQRNY9aQq2htlKvUYeoEzR1mjnNgxZJS6WtopXTGmgXaPdpr+h0uhHdlR5Ol9BX0svpR+iX6AP0dwwNhhWDx4hnKBmbGAcYZxl3GK+YTKYZ04sZx1QwNzHrmOeZD5lvVVgqtip8FZHKCpVKlSaVGyovVKmqpqreqgtV81XLVI+pXlN9rkZVM1PjqQnUlqtVqp1Q61MbU2epO6iHqmeob1Q/pH5Z/YkGWcNMw09DpFGgsV/jvMYgC2MZs3gsIWsNq4Z1gTXEJrHN2Xx2KruY/R27iz2qqaE5QzNKM1ezUvOUZj8H45hx+Jx0TgnnKKeX836K3hTvKeIpG6Y0TLkxZVxrqpaXllirSKtRq0frvTau7aedpr1Fu1n7gQ5Bx0onXCdHZ4/OBZ3nU9lT3acKpxZNPTr1ri6qa6UbobtEd79up+6Ynr5egJ5Mb6feeb3n+hx9L/1U/W36p/VHDFgGswwkBtsMzhg8xTVxbzwdL8fb8VFDXcNAQ6VhlWGX4YSRudE8o9VGjUYPjGnGXOMk423GbcajJgYmISZLTepN7ppSTbmmKaY7TDtMx83MzaLN1pk1mz0x1zLnm+eb15vft2BaeFostqi2uGVJsuRaplnutrxuhVo5WaVYVVpds0atna0l1rutu6cRp7lOk06rntZnw7Dxtsm2qbcZsOXYBtuutm22fWFnYhdnt8Wuw+6TvZN9un2N/T0HDYfZDqsdWh1+c7RyFDpWOt6azpzuP33F9JbpL2dYzxDP2DPjthPLKcRpnVOb00dnF2e5c4PziIuJS4LLLpc+Lpsbxt3IveRKdPVxXeF60vWdm7Obwu2o26/uNu5p7ofcn8w0nymeWTNz0MPIQ+BR5dE/C5+VMGvfrH5PQ0+BZ7XnIy9jL5FXrdewt6V3qvdh7xc+9j5yn+M+4zw33jLeWV/MN8C3yLfLT8Nvnl+F30N/I/9k/3r/0QCngCUBZwOJgUGBWwL7+Hp8Ib+OPzrbZfay2e1BjKC5QRVBj4KtguXBrSFoyOyQrSH355jOkc5pDoVQfujW0Adh5mGLw34MJ4WHhVeGP45wiFga0TGXNXfR3ENz30T6RJZE3ptnMU85ry1KNSo+qi5qPNo3ujS6P8YuZlnM1VidWElsSxw5LiquNm5svt/87fOH4p3iC+N7F5gvyF1weaHOwvSFpxapLhIsOpZATIhOOJTwQRAqqBaMJfITdyWOCnnCHcJnIi/RNtGI2ENcKh5O8kgqTXqS7JG8NXkkxTOlLOW5hCepkLxMDUzdmzqeFpp2IG0yPTq9MYOSkZBxQqohTZO2Z+pn5mZ2y6xlhbL+xW6Lty8elQfJa7OQrAVZLQq2QqboVFoo1yoHsmdlV2a/zYnKOZarnivN7cyzytuQN5zvn//tEsIS4ZK2pYZLVy0dWOa9rGo5sjxxedsK4xUFK4ZWBqw8uIq2Km3VT6vtV5eufr0mek1rgV7ByoLBtQFr6wtVCuWFfevc1+1dT1gvWd+1YfqGnRs+FYmKrhTbF5cVf9go3HjlG4dvyr+Z3JS0qavEuWTPZtJm6ebeLZ5bDpaql+aXDm4N2dq0Dd9WtO319kXbL5fNKNu7g7ZDuaO/PLi8ZafJzs07P1SkVPRU+lQ27tLdtWHX+G7R7ht7vPY07NXbW7z3/T7JvttVAVVN1WbVZftJ+7P3P66Jqun4lvttXa1ObXHtxwPSA/0HIw6217nU1R3SPVRSj9Yr60cOxx++/p3vdy0NNg1VjZzG4iNwRHnk6fcJ3/ceDTradox7rOEH0x92HWcdL2pCmvKaRptTmvtbYlu6T8w+0dbq3nr8R9sfD5w0PFl5SvNUyWna6YLTk2fyz4ydlZ19fi753GDborZ752PO32oPb++6EHTh0kX/i+c7vDvOXPK4dPKy2+UTV7hXmq86X23qdOo8/pPTT8e7nLuarrlca7nuer21e2b36RueN87d9L158Rb/1tWeOT3dvfN6b/fF9/XfFt1+cif9zsu72Xcn7q28T7xf9EDtQdlD3YfVP1v+3Njv3H9qwHeg89HcR/cGhYPP/pH1jw9DBY+Zj8uGDYbrnjg+OTniP3L96fynQ89kzyaeF/6i/suuFxYvfvjV69fO0ZjRoZfyl5O/bXyl/erA6xmv28bCxh6+yXgzMV70VvvtwXfcdx3vo98PT+R8IH8o/2j5sfVT0Kf7kxmTk/8EA5jz/GMzLdsAAAAgY0hSTQAAeiUAAICDAAD5/wAAgOkAAHUwAADqYAAAOpgAABdvkl/FRgAATN5JREFUeNrsnXdAk9fex79JIMyEAGHvvTciiDgQcW/rqFqrXba93e1t6+14u+1tb/fQDq1774ED2TiQvffehE2AhIz3Dy2tlQSEBJJwPv/ca3l4kud3zvnwO+c5gyIWi0EgEAiqDpWEgEAgENkRCASCiqAm6xtSKBQS1UkAh8PRaO/oMu7q7mZ1dXWzurp7WF1d3azOrm69jq5ug66uHlZHV49Be2e3QUd3r0FrF9eks5fP4vTx2T1CEXRpVLC16Bw9bXqHIVOnicXQbtPXY7SxmLptTKZuB4vJaNNjMjqZTEYHk6Hbcfd/GR36LGYzm83mkRJQfWQ9xEaR+Q2J7FSG6upadjOHY9bU1GJRW99gW15Z65ieVxocU9oQOtHfLdzRLNnfw/GWva1lqaW5WaWJiVGdMZvdYG1tySElR2RHZEeQSF5+oWN1bZ19aVmlW2pWfvCBG/nrlPVZNk5zPxLo437L0cG2wNrSotzD3bWUlDCRHZHdJKSqqsakoqrasaCo1CfxdkbE0ZSiFar+zGuDXE6HTfWLdnNxzLKzsS61sbFqIjWByI7ITtW6ozW17NKyCrfMnPygw+fjnkhv7HCb7DHxN2UVrF8y63dfL/cURwe7Amsr0v0lsiOyU0rSM7I9snPzA89fS1xzJrN8IYmIdJb72l9aMjfsmLene6q/n3ceiQiRHZGdApOYfCv4Zkr6rLf3nP+MRGNsfLZlydshQf5xYaHBt0g0iOyI7BSAhKSbwYk370S8tz/qIxIN+fDhpgXvhoVMiZ4xPYSIj8iOyG48SU3P9Eq+mRr+6q6T35BojC9fPbPq5dCQwJhAf98cEg0iO1JKcqCissosJTUj7LdD515UhHluk51wR7PkJx9d+l1QoF+ina1NA4kIkR1hjNy8nRp4NSZhyYeHr71HoqGYvLd+7oeR4TPOh0wNTCXRILIjPAQcDkfjxu20OXsOn33hXHbFfBIR5WCpt93lLeuXfT9tasB1sqSNyI4ghfKKKrPEG7cjt36+5w9VfD4alQodLU1oaNAH/5tAIEA3tw8CoVClnnX3m1seD5s29aq9HeniEtkRBiksKrG9Hpe0+MUfj32vis+npUGHvaUZnGwsYGdhAqauzuDP+nh8VNQ1oKSqHhW1jejs4arUs3/3/JoX5syafsHVxamS1HQiu0lLfmGR/ZXo+GWv/3L6K1V8PgqFAiN9PYRP9cWKOdMQFuAJYwPWA9d19nBxIyMfUUmpiLmdidLqepXL9L58esWr8yJmnnV3dSknNZ/IbtJQVFxqe/la3DJVnjpCo1JhbWaMDYvDsXXFPFibGQ37O22d3Tgfdxu/n7qMlJwilRMecHfqyvy5s866ODuSTI/ITnWpqKw2i45JWLLtm4O7VP1ZTdkG+NejS/HyphXQpKuP+Pf6+nm4djMd7/90ADnFFSobn50vb3gmInzGeTtbazKmR2SnOrR2dGhER8cte/TDXUcnw/PqamtiWfg0fPHak0N2W4eNV2c39p+Lxke7DqGzm6vSsTr03jNrIyJmnTVkscjbWznLjmzLLmeuXY+fvfHpN65MFtFRKBQ4Wptjy/LIUYkOAAz1GIgI9kOor4fKx+vRD3cd3fj0G1euXY+fTVqLnOsmyezkQ2Z2rtvRUxe2/PdU/BuT6bm1NTWwMmI6dr7/4kN1X/9JT28fDl2Mxav//QX9fP6kiN2/V878Yu3KxXt8vT0LSAsimZ3CU1/fwNq97/CWgI1v5E820QGAHkMHXs62YxLd3a6wFtzsrUf0YkNV+O+p+DcCNr6Rv3vf4S319Q0s0ppkC5GdDImNTwp7+pX3Tz315b7dkzUGTB1tuNhayuReLKYOHKzNJ10Mn/py3+6nX3n/VGx8UhhpVUR2CkV5RaXZV9/vei3ihU8SogpqJvXYi7aWJqzNjGVyL7q6Opi62pMyjlEFNbMjXvgk4avvd71WXlFpRloZkd2Ec+16/Oy1z7x9/Y1fz3xJogGIRCL08fgyupcYAoFwUsfzjV/PfLn2mbevkxcYRHYTRlVVjcm3P/720vxXdsSQMx3+orePh7om2Rzn0M/jo7Wje9LHNL2xw23+Kztivv3xt5eqqmpMSC0jshs3kpJvBb20/ZN9ZPPMB+no6UFeadXYszqxGC3tnSitrhOSqN7l1V0nv3lp+yf7kpJvBZFoENnJnf2Hjm+a+ewHt8/nVEWSaAwhuy4u0vJK0N7VM6b7dHZzxVlF5ddrmzg0EtW/OJ9TFTnz2Q9u7z90fBOJBpGdXMgvLLL/zweff/b4jt37SDQkMyAQoLCypjf6ZkbdWLK64sranAvxt/RJRIfm8R279/3ng88/yy8ssifRILKTGbHxSWFbX/7g3I6TcW+RaAxPbSNHe9+56Iq80qrC0YiuprGl6WzszYrUvBJ/Ek3J7DgZ99bWlz84R6aojAyygmIYDh87tW7jx78eJlXl4WAxdETLZodcfXXzKlsPRxvXhxHd7lNXbu86fmkep71Tg0RyZBx456n169esPKJKz0Q2AhgnqqpqTI6dvvDYW7vP/Zc0pdELb2FYUPTWlfP0fFzsA/WZuhLH37h9/cgvq849E3Oj/PdTV4joRpPpbV367zUrFu+zsbFqIrIjshsRWTl5br/sOfzyzui0p0kTGhuaGnR4OdnmPbV6YfXWFZELJF2XXVxR9M73e5uS0nJndHF7SeBGybaIgF+e3rL+Gx8vD6VfXytrN6mR6nE/CUk3g194e8ePydUcMl4kA/p5fNzJLfbQZ+p2bF0h+QV2TWNL06WElBkkYmNjZ3Ta0znFVYEJSTefJ4d63w95QfE3LkZdmz/7uQ9vEtERlJnkao7/7Oc+vHkx6ho5mY7I7kEOHzu1bumbX0WRSBBUhaVvfhV1+NipdSQSRHYA7u4i/OvuA0+TN64EVWTjx78e/nX3gadbOzom/QufST1mV1tXb7D/wPHNr/1y6ivSLAiqyrZvDu7i9vbp1NbV77W0MG8jsptkVFRWm+0/fHLLO/sufUKaA0HVee2XU1/19fdrVVRW75msh/xMStmVllVY7D10fNtHR6LfIc2AMFl4Z9+lT3h8vlZpWcVORwe7usn2/JNOdsUlZVZ7D53Y9unxmO2k+hMmGx8diX5HKBRRi0vKdjo7OdQQ2amw6PYdPvncZydiyRrX8UeLhEAx+PR4zHaxWEwtLin7aTIJb9LIrrSs3OKPgyeI6CYOMndRgfizHZSWlf/g6GA/Kbq0k0J25RVVZnsPHd9GRKfQ+JAQjL/waDSqoLyi6id7OxuVf2mh8rKrqa1j7zt88omPj14nLyMUGz0SgvHn46PX36HT6bya2rqdVpYWHFV+VpWWHYfD0dh3+OTm9/ZHfUSqNYEwNO/tj/pIS1Ojj8Ph/MBms3lEdkrIiTOXtpBTvwiE4Xnj1zNfamtpcQHsVNVnVNnlYgeOnHj0+e8O/0yqMYEwMp7/7vDPB46ceJTITok4d+Hyws2f/n6QVF8C4eHY/OnvB89duLyQyE4JiI1PClux/duLpNoSCKNjxfZvL6riuRYqJbv0jGyPlz/47g9SXQmEsfHyB9/9kZ6R7UFkp4CUlVda/PT7wTdzOd3kaDkCYYzkcrrtf/r94Jtl5ZUWqvJMKvM29sjJc1v2JGSTg4MJBBmxJyF7k53NuWIAH5PMTkHYe/AYmUtHIMiB9/ZHfbT34LHNRHYKwLXrcbO3fr7nD1ItCQT5sPXzPX9cux43m8huAsnOyXN+YvvXZ0h1JBDkyxPbvz6TnZPnTGQ3ATQ2NTP3HDzxQl0fn0mqIoEgX+r6+Mw9B0+80NjUrLTtTWlfUJy/dG3dd5du/YtUQwJhfPju0q1/ubs45gD4hWR240RMXGLYtq8P7CLVj0AYX7Z9fWBXTFyiUk44VjrZlZSWW23f8TNZ80ogTBDbd/z8c0lpuRWRnZw5fvri5jv17R6kyil4xaJSwNDRgrWZMdzsreFmby31en2mLnxdHWBpYgQ2iwzDKjJ36ts9jp++qHTTUShisVi2N6RQ5PZlL1y6On/ZW19HkeqmWKjRaGAxdGDC1oeFsSGMDFhgs5gwZDFhpK8Hho42nG0t4O/mKPEenPZOJGfmo7GlHdy+ftS3tKKntx9Nre2oa+agidOO5rYODAiEJOAKwtkdryxYvDDysrzuL3M3KYvsCoqK7T0feamMVDHFQF1NDRYmhnC1tYKNuTEcrMxhacqGnYUJzIwMYWzAAl199O+/hCIRunp6UdvEQWVdI2oaOaioa0R5bQOKK+tQ18xBV08vKYgJJvf4tw5uLs7lyiA7pXkbq4xpsypmcCaGLPi42MPJxgIeDjbwcbWHrbkJDGXc9aRRqdBn6kKfqQsvJ1sAQD+Pj/LaRmQXV6CoshbZxeUoLK9BTWMLevt5pIAmrl2+T7qxMiLq6vXIxa9/eYVUrYlBS4MOFzsr+Ls7wt/VEVN9XOBoZQGGzsSdjvin+DILy5BRWIbb2YUoqqxFa0cXKbBx5sKXr89bEDnnKunGjpGKyiqz+ZteSSvt7DMj1Wp80dbUgI+LPab5umOarzumeLnA3MhA4b5ne1cP0vJLcDu7EAlpucgsLCPSG0cc9bQaLu//OsDOVrYnlE26buyFqOg1RHTji4a6OlzsLDE/NBDhU30w1dttQrO44dBn6iIi2A8hPm4In+qLmNtZiLuThbT8EjKuNw6UdvaZXYiKXgPgW9KNHSW3UlL9Q598N41Up/GBRqPC0oSNeaGBiAj2w9wQf4WWnCS4ff3IKCjDpcQURN/KQE5xBXmLOw4k//ZRQHBQYDrJ7EbB7gMnXyRVaHxg6GhhZqA3ls4KxvywKTLprgqEQnR2c9HZ04uuHi64ff0Sr6XT1WHAZEBXWwsGerpQVxt91dTR0sR0fw94OFpjqrcrTl5LQsztTDRy2klBy7+9Pk4yu4fk3IXLC8lZEuOTzVmbGmPV3OlYHRmGQA+nUd+rt5+HitpGNHLaUNvEQVNrO5rbOtHe1YOOrh509/ZJ/F1NujrY9+bkGRuwYKTPhIUJG2ZsA1ibGYGtP7oztIUiEcpqGnA6Ohnn4m4hPb+EZHly5PSnLy1aunj+JUXM7BRSdjU1dezAFdtqOXyBBqk+8kNLUwNBns5YO38WVs0NfejpIyKRGJ09XJRU1aGkqg5FlbUoqa5DXVMrquqb0NLeCf6A4OEFTKWCxdCBtbkJLE0M4WBlDlc7KzjZWMDZxgJmo8g6O3u4SEzLxR9nriEmJZOM5ckJNl2Nl3p6p6WVlQWHdGNHwNWY+GVEdPKFqauNRTOCsGV5JEL9PaChrj7i3+XxB1Be24CsonKk5ZeioLwaBWXVqGpofujvQVdXh6EeA+r3JiCLRCL09PahtbMbrZ3dyCgoBY1KhQGLAXd7a3g42sLXxR4+rg5ws7eCtubIqomerg4ipwXAwtgQVqZGOBNzAzWNLaQiyBgOX6BxNSZ+GYDfSTd2GAoKi+0915CVEvKCSqHAyEAPq+aG4alV8+HlbPdQkiuuqkNiWi6SM/KQXlCKkqq60X0PKgW25iZYMisYjtbmoN+TrUgkQhe3F42cdjS0tKG6oRmVdU2ob2kdzPqMDPQQ6OGMEB83BHm5wMvJDmz9kWel1Q0tOHwpFocuxSKvtIpUCjmQe+xbBzfXsa2sUPnM7uKVmFWkqshPdObGhnhy1XxsXDwHthYmDy25uDvZuJmZjwZO25i+i6WJEf61fik2LZ0DfSZjyM/8c6lYYUUN7uQWI7OwHEWVtWjktONC/G3Ep+bAx9kOMwK9EDnNH/7uTiPK9KzNjLB15TwYshjYeewSMgvJ31Y5teMvSGYngcysHLeATf/OJ1VFfqLbtmYRnlq9YETjc0KhELVNHFy7mYGrN9JwM7NgzJID7q7IWDo7BD/853noM3WHvX5AIEB9cytScooQdycbCem5KCir/qtLrqONAA8nLJoRhLnT/OFsYzGit7ltnd04H3cL3x86R4QnB9L2/9fd18ergGR2Q3Dm4tVHSRVRDNH19PYhOSMP52Jv4XJyGqrqm2T2fQz0GAj0cBqR6IC7mw7YmJvA0tQIoX4eCL6dieNXE5GckYfObi66uL2ITclCXmkV0vNLsXjmVIRP9R22a2ugx8CSWcEQA/iBCE9e7fldktn9869AeqZX0ONvZ5MqMrGiE4nFaOK04/T1ZByJikNqXsmo3qhKw8rUCG9sWY3n1i0Z1e/38/nIL63Gkag4nIxOQlX9Xy9G6OpqcLaxxMq5oVgRHgovZ1uS4U0gKX985h3g75tDMru/cfZS9DpSNWSPoT4Tz65djCdXzR9WdAMCAYoqa7HvbDROXksa1dvVkdDZzUV+WTX4A4JRbQOlSafD390Rpmx9mBkZ4MCFGGQV3R0L5w8IkFtaiQZOG0qq6vDY0rmYNcVLarf2zwwP9zK8DCI8WbfrHEX4LgqR2aVnZHtM2fxmLqkaskVPVwcbl4TjvW0bhhVdbz8PNzPzse9cNM7F3pI6AXjM2SaVCj9XB3z84uOYGeg1pn3v2jq7cSbmBn48fH5QeINS1KAj0MMJzzyyCAtnTIGers6w9zp8KQ5f/nGCTEuRIXf2fu7p7+edN9GZHe3//u//ZHrDDz744KF/x9Le5dm4nLLZpFrIDi0NOmZP9cX2p9bBytRoWNHFpWThiz0ncCU5DX08vly/m1gsRldPL6obWzAwIIBIJIZAcHdpGX9gADpamiN/Tk0N2JibQIOujvyyKnR2cwd/JhAKUdfUiqKqWjC0tOBgbQZNOl3qvUzZ+ujr5yO3tBI8/gCpSDLAQofWFBt9Of5hf0/WbprwzC4vv9DRe90rJaRKyHBsQo0GXxd77HjlCcya4j0i0X259yQSUse3t6GuRoOZkQE8HG1hbMACcHdbKRtzEzhZm8PTyRbWZkYjerNa39yKXccu4ocj5+8THnB3bp6bgzVeeHQpVkeGDZvh5ZdVY8fvR3H8SgJZWiYjso987eTh7lo6kZndhI/ZRccmLSJVQbZ/bCyN2Xh27eKRie5OFr784yQS0sZ/WGVAIER1QwuqG+7vMmprasDR2hy+rvYI8nJF+FQfONtYSr2XubEh1i6YicLKWpy8lnTfz4QiEQrKqvH9oXMAMKzwXOwssWV5JCrrmnAjk8yEkmE7n9AtoCY0s6uorDZzXPpMPakKskNPVwePLZ2Dj17YDF1treFFt+cEEtIUc7iUSqXCzEgfkdMCsHb+TMwI9AJdSpbXz+PjSnIa3v1hL/L/Ng/v7xmeu4M1nl+/FI9EhkGPIVl4nT1cnLiaiM9/P47y2gZSsWRA6bld5na21iMOpqzdNKFHKSbfSiHjdDKErq4GX1cHPLFyvlTRDQgEyCmuwJd7Tiqs6IC7S8fqmlpxNCoen+w6jCOX4tDR3SPxek0NOqZ6u2LFnNAhu75CkQj5ZdX48fA5nI29iQGBQOofjbkhAVg8MwjqajRSuVSgvU+o7F77cu9uUgVkB1tfD0+tmg/PewfUDCkQsRhV9c349sCZCem6jobefh6SM/Px393HceJqEvhSJGVkoIeZgV5wdxj6nNo/hffL8UuIuZ0l9XMtTAyxZFYwpni6kMqlAu19wmR37Xr8bLKziezQ1tTAzEAvLJ41Vep1re1d2HPmKs7E3FCq5xOJRCiuqsMvJy7harLkzavvdlVtMH96oMRrhCIRMovK8euJKGQXV0i9l7+7I1ZHhsn89LTJCIcv0Lh2PX7CsrsJk92Zi9fIJGIZQaFQYGnCxpOrFkjtvnZz+3Ax4Tb2no2W+aqI8RJeXmkVdp++guKqWqnZ3VQvV5gbG0q8pp/HR1J6Lg5eiAGnvUtqdzYswBOhvu6koil5u58Q2eXmFTjujE57mhS9bNDV1kT4VF+E+LhJvGZAIEROSQV+PHIejTJYzD9R8PgDuJNTjJPXkiQKm0alwtrMCD7DbF/F6ejCudibw47fOVmbY/GsqbAeZr4iYXh2Rqc9nZtX4DhpZJd8604EKXbZZXUWxobYsDhc6kqE1o4uHL4Uh4wC5V8K1dTWgYTUXFRK2ZzAyIAFN3vrYe9VXtuI41cTkF1cKeWPiRZmBHhhTrAfqXBK3P4nRHbPfXv4Z1LkssvqZk3xQYC75LMjevt5SM7Iw+nrN1TimUUiEUqr6xCXIvkFgyGLAUdr82HvJRSJkFlQhpPXEh+YjPx3rM2MEervATYZu1Pa9j/usotLSA4lxS07DFlMbJSS1YnEYtQ2tmDv2WtK3X39J/UtbUjNk7zwRpNOh7mxIYzurcwYrjt77UY6ktIlL9+kq6vdPTDcj4zdKasHxl121+NvLCRFLRu0NOgIdHeCv5Ssrofbh+hbmQo9n2408PgDqG9pRXNbh8RrtDU1R5yJFVfV4ULCbbS0d0q8xsnaAjMDvUd87gVBsTwwrrKrra03+PR4zHZS1LKBxdTFsvBpUsfqmts6cODCdfTIcReTiaK3nyf1TSqNRpW64uLvcPv6cTu7UGp2p6utCR8Xe6nzGAkj49PjMdtra+sNxvMzx1V2WTl5QaSYZQONSoWFMRuzgiSvf+3r5yE1r0RlN6Tk9vWjqa1dauYrbUnYPymracD1WxlSx+6cbMwR7ONKKqAS+mBcZXc1NmkJKWLZoK2pgUAPJ5ixDaRkdZ04eDFGKefUjSiz65Oe2QmEQvAGRr5NE7evHxkFZUjPlzwWaKTPgoeDzbA7pxAUzwfjJrvq6lr2D5dTniNFLBv0GDpYMH2KxJ8PCIQoq6lHYprq7ona0d2D0qq6IWXex+OjtLoepdUPt89EWU09EtJyJc67+3Pbdw8nG1IJx8gPl1Oeq66uZauc7HLyCwJJ8coGCoUCQxYDIb6SJxF3dvcg+laGSo7V/QmnvQvRtzJwIzP/PuHxBwTIKizD2ZibaO3oeqh7tnf1IKu4XOqW9PZWpgiU8lKIoJheGLf97OISb0eSopUNGnR1ONtYwkCPIfGats5uXIi/rdJxGBAIkFFYhh2/HUX4VF+42FqCSqOitKoesXcypb5skIRQJEJ5TSMyC8rgaGUusSvrYmsJbU0N9PbzSIUcuxcuq4zsOByOhkn4pldI0coGHS1NBHo4S+3C1jS2PHQXThnp6ulFTEoWMgrLYG1qBCqVirpmDho57aO+Z3VDM1LzSrAsPGTIraLo6mqwNDWClakRiiprSYUcA1+dT36Fw+G8zWaz5f5XY1xkl19YQtbZyFR2Ggj0lDK3rrcPKbnFKvti4p+IRCK0dnQ9dJdVokC5vSiqrEV9SxtszIyHvMbcyADOtpZEdrLzwy15f864jNmlZmSTVRMyREtDA15Okhe5d3N7cTOzgARqDDRy2lBUIVlkxgYs2FmYkEApkR/GRXaf773wCSlS2UBXV4OthanU8bqe3n6k5ZMzjMZCS3sXymsbJf7cgMWEpQnZBUWZ/CB32RUUFduTTTplhyadDmcbC4k/HxAIUN/ciqbWdhKssciurQPlNfVSsms6TNish5q0TBgaDl+gUVBUbK/0sisqLvMgxSk71NXVYCFlU8o+Hl/qxpaEkcHt60ddMwcdUlZT6GppwYDJIMFSEk/IXXZ30rOnkaKUoezUaFJ34OXxB6Tu80YYOZ09vVJ3itHX04WZkQEJlJJ4Qu6y23Ey7i1SlLKUndqw241XSBlrIoycjm4uGqTITkdLE/pMXRIoJfGEXGWXX1hkT4pRttCo1GGPSRzLHDPC/X84eriSV6Co0WhQV1cjgVISX8hVduXlVc6kCGUsOxoVerraEn8uFosnzfw6edPbz0NHl+Rzahk62mTnYiXyhVxll51XRNbDjnM3lscXoKaxhQRKBnB7+9DaKVl2Whp0qVk2QbF8IVfZnbiStJkUoYwLjEqFjpam1G6stN17CSNHKBJDIBSSQIwT8vaF3GRXX9/AymruciRFSCAQRkJWc5djfX0DS+lkV1vfQDb8kgM8Ph8lVXVDZyJCETp7uCRIMqK3rx8dXd2Su7l9/ejo7iGBUhJvyE12VdW1JKuTA+1dPRKPRGzr6sb5uNskSDKC29ePvLIqFA+x2F8gFKKoslYlzuFVJOTpDbnJrrCknKyckAPd3F4cu5KAE1cT0c+/u+W4SCxGI6cd+89dx7HLCSRIMkIoEiElpxi7jl+6T3g8/gBuZhVg79lrZNcTJfIGRSwWy/aGFAoAYNbSzXcSK5vJ21g5QFdXg4utJWYEesPRygz9/AFkF5fjVlYBKurI6glZY2Koj1A/d3g62YKhrY3mtg7cyS1Cal6JSu8EPRGE2Rqnxp3bOwW4O41KKWRH814gJkUnX9TVaDAyYEEgEJI3sHKGRqVCR1sT2poa6OntJ5KTZ0adHUWRh+zk0o0tLim1IkUmfwYEQtQ3txLRjVOXtqunF42cdiI6OSMvf8hlrUtTM8eCFNk/MgMaFfaWZpgb4g87S1No0ekkKJOcfj4fZTX1SMrIQ2F5rcQTzSYb9/xRoxSya2hsJrL7h+jc7K2x/al1CPFxg4mhPuhkTeWkhz8gQCOnDTMDvbH79FVcvZFGgiJHf8ilxVXX1pMNAP4GQ1sLT61agOXh04jkCIPQ1dVgbWYMIwMWuH08lNc2TIpDkibKH/IZsyurItNO/oaOthYemRdGREcYEi0NOnxd7aWeKzKZkJc/5CK7szdy15Ei+1v6TKXC2IBFAkGQCIuhC7Y+2UFFnv6Qi+zImRMEwsNBo1FBo1JJIOToD5lHt6a2jk2Ki0AgKJpHZC67rq5u0l8jEAgK5xGZj5h3dfcQ2T0kLW0deOf7fSQQKow+UxfzQgMwO8iHBGOCPCIH2ZHM7qFjxu3F76cuk0CoMBbGbFiZGhHZTaBHZN6N7ezs1iNFRSAQFM0jsh+zI5kdgUCYFJkdeUFBIBAU0CNykF0POSKdQCAonEdIZkcgEEhmNxo6SGZHIBAU0CMyl117Zw9ZQUEgEBTOI7LP7Lp7SWZHIBAUziMyl11rd58RKSoCgaBoHpG57DhcnjEpKgKBoGgekb3syPZOBAJBAT1CNtAiEAiTApnLjk1X45GwEggERfOI7GWno9FMiopAICiaR2QuO0OGVgspKgKBoGgekbnsWAztNlJUBAJB0Twic9np6+lySFERCARF84jsMzumLsnsCASCwnlE5rLTYzI6SFERCARF84gcZEcyOwKBoHgeIZkdgUCYFJmdzE8XYzImn+xoNCrsLUzh7WIPkUiERk47MovK0NfPJ7WWMCrU1WiwtzSDi60l1NXVUNPYgrzSKnD7+ifF88vDIzKXnZ4eo3MyVUpNDToemReGjYvnwJStD7FYjM5uLm5nF+Lbg2dR10ReThMesqHramPJzKl4dFE4zIwMQKNR0dnNxdXkNBy8GIuKukbVz+zk4BGS2Y0leDQaAtyd8PaT6+BsYzH438ViMZxtLSEQirD92z2k9RIeKqObNy0Arz2+Gh6ONqBR/xppsrMwRR+Pj53HLqp8hicPj1Bl/yV1J43sNDXoWB4+7T7RAQCFQoEhi4mls4NhaUI2biaMHCMDFkL9PB4QHQCYGRlgZqAXXGwtJ0E3VvYekb3sJtELCnU1Nfi42g8dWAoF+kwGTAz1SQsmjBhTtj5szI0fEN1fEtABi6mr+rJThqknVpYWk2aQikIBtDQ0pP5cXU2NtGDCiNGgq0NLk2wJKQ+PyGU/O7LNE4FAUDR/yEV2y6Z5HiFFRiAQFMkfculjOTvY5CEuk5SarAuLRoOFsSG8ne2hpUknAZlg+nh8VDc0o7ymAd29fSQgsvSHssjO2tK8nBSZDNNvCgWmRgZ4bMkchE/1hZEBC+pqNBKYCUYgEKKrpxdp+SU4cOE60vJLSVAU2B9ykZ2ZqXEdKTLZYaDHwCuPrcC6+bNgZkSO5VU03B2toa/HwHcHzyCdCE9h/SGXMTsTYzaRnYxQV1ODp5MtNi6eQ0SnoLAYupgXGoAF06eArk7eviuqP+QiO2cnxxpSZLJBR0sDYQFeMNLXI8FQYAz1mHB3sIaxAZlXqaj+kNtRimG2xqmk2GQwzkCjwciAiE7RoVIp0NLQgJYGeXGkqN6QW849J9TvfGLllUBSfPKBxx9AbmklSqvrSTDGGXNjQ/i62IOho02CIQdvxJ3bq1yyc3WyzyNFJz+4ff24lHgHhy/FkWCMM7OmeMPK1IjITsm8ITfZ2VhbktdSckQgFKKptR3FlbUkGOOMk40F+AMCEggl84bcZGdpblal7IGnUChgaGvB2sx48L8JRSJU1Teht181VsRp0NVhaqiPLm4f2ru6x3QvGpUKpq42NOjqaOS0j/m7MXW0wdbXQ30zB/38gTHdS5NOB1NXG/18Prp6elWi7NTV1GBsoAd9JmPwv3V096C5rUNpZSxPb8hNdubmZh3+EWtLs5q7HJUl0FQKBaZsA0z1doWnkw3cHWzAYuiAof1Xd0UkFqGirhG/nYhCXlm1UjcWIwM9bF0xD/NCA9DQ0oY/zlzDtZvpoxOTrjYWhQVh8/K5GBgQICrpDn46cmHU383T0Ravb1kNSxM2bmYV4NcTUahuGN0h8Q5WZti8bC5CfNxQWd+EgxdiEHcnW6nLztbcBI/MC0P4VN/76idvYACd3VxUNzYjPb8Ut7MLUVHXqBTy8zFmlpqbm3UonewAYPW86Xuz9l/6SNGDTKNS4ePigLXzZyDAwwkmhvowZDFgwGRAbYiVCn5ujrA0McJrX/yi1A3GjG2A59cvgbmRIdo6u1FR1zRq2enp6mC6vwcigv0gEAohEApHLTuGjjZC/T2wMiIUWhp0sBg6uJGZP2rZWRizMX96IPzdHFHbxEFeaZVSy87c2BBh/p54YuU8mLL1Qf3HdlAikQg9vf1YMH0KmjjtyC+vwtUbGUhKz0VzW4fCPtfqedP3pkcfldv95So7bw+XVOCSwktu3YKZCAvwhKO1OfRHsFeYlgYdAe6OWD13utJ3Yc2NDO9WBDUa9HRHP+BOo1GhraV59140GrQ1NUd9L7q6GgyYutC+t9WRloYGGDpao6/karTBrbjU1dSUfgslP1cHhAV4wtzYcOgeyr3hBKauNhyszODtYo/p/l7IKirDyWvJiLmdiY7uHoV7rru+kB9ylZ29vU2xIlYWCgVgMXRFjy6aLdi0ZA7dwWpkkvvneImfmyMIhPHG0docrnZWI75eV1sTrnaWsDEzgq+rA6b5umHPmavIK1WsYXV5+0KusnN3dSmneS9QqIBSKRQ421rWvbp5ZXtEsJ/n318+PJwwKdBUkgmkGnR1WJkaAWKgtGZk8/JoVCpYTF0Y6euhqbVj8OUFXU0NxoYs6GhpobmtHe1dPSNscFqwNjVCW1f3fS8vGDpasDQxQltnN5pa20f8PCYG+lBTo9338kJHSxPmxoYQCIWob24FbwQvNdRoNLD1mWBoa6OprV0pXl7w+APg8fiDme9I0dLUgIutJdj6erC3NMPOYxcRm5KFAYFijOe5u7qUK63sAOCtVbN27DgZ95aiiM7Fzqrum7e2cYK8XHwY2qPvGvEHBpCYloM5wf4K3TAYOlpYHj4NT61eAJFIjLLaBtzKKkBKTtEDuyxTqVSYsvUR4u2GEF83+Ls7QV1NDWl5xfho12F09XDh7WKHj17YDIa2Ntq7upFeUIrYlGx09nAf+Gw9hg5CvN0Q7OMGPzcHsFlMVNQ14bdTlxGXkgVHa3O8sGEZAt2d0MXtRX5ZNZLSc1FcWTek4NzsrBDq74np/h6wNTdBXz8Pp68n45cTUTDUY2J15HRsXDIHYpEY1Y3NSMrIw62sAmjS1R8QnK25CYJ9XDHN1x2ejragUCi4fjsTu45dREu7Yh+QV1HXCEsTNoK8XEb1+4Z6DMwN8YM+UxdsfSYuJdyZ8G7tW6tm7fgkOwpKLbsp/t43cDJOoUQ3M8DLR20MWyTxBwZw9UY6jl9JVHjZGeoxsXb+TEzzdYdYLEaAhxNmBXqhue3+Bq1JV8fsIB+42VnB2JAFE0MW9JkMiMVisPWZiEnJwo2MfMwM9EZ4kC9oNCqEQhGmeDpjyaxgdHP7YMr+a12ol7Mt9n/2b9iYGcPYkAUDJgM0GhW2FqbIL69GXEoWrM2MsWHRbLAYuhCKRJji6YJ5oQFoae8ES/evYQVTI308v24pBI8IYcrWh4kBC1qaGhAIhOjp68eZ2JuwMDLEsvAQhPi4AQD8+Y6Y5uuOptYOiMViGBuwBjPM1XOnIyLYF8YGLJgY6oOpqw2RWAwqjYrkjDzEpmQpdJlmFpahn8eHk435fdNOHjbLC/JygQGLARqViiNR8ROa4U3x974h78+Qu+xcnB0mfCUFBYCBHoP37dvPcmYEePqo0UYuOpFIjOa2drS0d0EkEqGB04b0/FIcuhir0G+2/t7d/vN5KRQKtDTosDE3gY25yX3Xqaupwd7SbMiT0tRoNNCoVIjv/ZtGu/v2j0ajgq2vB7a+HsRiMUQi8eDvGenrYd60gMFr/8oeKYN78anRqNCk0//qNjN0wGLowMXW8r57MXW04efq8MC9QLmbjVIpFFColPsOqdGk02FtZgxrM2OIxGKIxeJ7jZwOV3urBw60oVIo0FBXh4a6usKXaUt7J5Iz8lBZ14S50/zhYGUGuro6WAxdmBiyRrzzyp/Z8ra1i9HZw0VUYuqECW88PCF32bm5OJebBC7hcfiCCXsFRqer4/NXn0iZEeAZNhLRCYUiZBaVI+ZWBnJKK1HT0II+Ph8Qi9Hbz0Nb591xJwM9hsI3jEZOGz777QjKaxsQ4usGLyc7KVKk/BUDkQjNbZ1ITs9FVGIqkjPy0M3txcWEFLCYuggP8oGXs93gwve7EqTcd7+//7ujm4uUnCLcyMzH6egkAEBuSRX+/dXvmBnojVA/98HMcLh78fgDKK9tQMztTJyMTkZbZze4ff34Zv9p1DW3ItjH7T5pUymUu2+l/vH/gbsrUWobObiZVYDLSam4k1es8GUqEolR3dCCE1cTkZSeC4auNqhUKjTU1cFm3d19JSLEH4EeTtDRkv5WnEqlwtfFHtvWLEJ7Vw8S03LH/XnYdDWem4tzudLLDgDe3Lz4P2/8eubLiagYajQaNiwOj181d/rM4UQnEolQVFmL305eRmJ6HhpaWtHe1YN+Hh/KSh+PjxuZBaisa4KpkT6cbSwxI8ALkaEBsBhi6kJbZzcuJ6ciI78Ud/JK0NzajgZOO7q5dwfuS6rq8MOhszh5LQnmRgbwdrHH/NAAhPp5PPjZ/TxkFVcgKiEFaQWlqGlsAae9C5yOu13optZ2HLwQg+hbGbA2NYK7gzXmBPthzlTfB17+CIRClFbX43zcbeSUVKC0uh4NLW1oam0Hf0AA/oAAcXeyUVRZCzMjQ7jbWyPE1w0hPm5w+ke2+md2lJiWi5jbmcgqrkBLWweaWzvQxVWe1RXdvX3orr5/O3g1NRqSM/JwMSEFvq4OWB0ZhpmBXlKlp0FXR6ifB5bOCkZ5TQPqmlvH9Tne3Lz4P6+mnodKyC7QzzsZODMhXThLE3br20+u9dAd5mUEf0CA/eev47eTl1FSVaeQ85BGy4BAgKqGZlQ3tiC3pAot7Z2Y7u8hcTwyq7AMf5y9NuSbVoFQiEZOOxo57cgupqKyvgmudpZDyk4MoLaxBfvORaOe0wahUHR/Bi0SobOHi84eLsqq65FXVgUtTQ3Mn/7gZjk0KhWtHd04G3MTWUVl6BviD1Afj4/y2kZU1DUhq6gMHT09mObrPuRz9vT2ITkjD4cuxiqV4IZDIBCC09EFTkcXymoakFVUjhVzpuHRReGwtzSV+Hs6WppYGTEd+WXVOHAhZly7s3f9IH+o4/Eh7q5OGROT1VGxZUVklp2FKVvadTz+AP73xwl89tsR3MktUinR3ScfsRg6WpqYGegFCxP2YDb7d3HoMxmYE+wHAz3msPfTpNPh7WyP2UE+9wnsz/tp0tXh7mCNaX7uD4huqIFVGzNjRE7zHxxPEwhFg1k1hUKBi60lFs+cOjj+Ju05DVl6mObrDst7zykQCu+bimJqqI8gLxcYG7KgqnD7+pFTUomdxy7is1+PDHtGhpUpG5GhAXC1sxzX7zlefhgX2bHZbN6rS0K/Hu+sztyY3fbEynlThxXd3pP48ch5VNY1QZXR1dbE3BB/bFoaMThHq6aJgx2/HUV8avZglybY2w2vPLZS6kaUNCoV7g7W+Ne95WZ/doGPRMVh59ELg+NBDlbm2LI8Ev7DTMC2MjXChsXhCPJyHRRdckYePtp1aHBeniGLgaWzg7EiIlTqvVgMHSwMm4K182cOdofzy6rx3cGzSM64Ow6upamB8CBfbF42F3q6Oipb5iKRCI2cdpyKTsbPR88jp6RS6vhdmL8npvm6j9vh7q8uCf2azWbzVEZ2ADArbOrV8SxkGo2KtfNnZJiyDXQkd++EOBmdhJ8On5fJLh2KDJVKhZO1BV57fBVMDe++CGjv6sHJa4n45cQlfLP/zOBYDUNHC4tnBuGp1Qsly8nMCM+tWwI/N4fBYYC0/BL89/fjOHo5HtG3MgblOcXLFU+umi9xlQpTRxtzpvpidWTYoGALK2rwzb7TOHwpDgcuxKCfxweFQoGDlRkeWxqBqfek+GA2T8MUT2c8sXLe4HSTRk4bzly/ge8OnsHu01dR3dhyV576TKyeOx2PzAuDqtPZw8XZmJs4fiUBTa0dEq8zNtBDoKfz3UnoKuaFcZOdl7vbuG7TrkalYfXc6TbSujq1jc34cs8JNLa2q3xlN2Xr47n1S+DhYDOY0d7OLsQPh86hpa0TNzLz8cvxS+i7JxVTtj7Wzp+BKZ7OD8pJVxtzg/2xZFYw6PemapTV1OPrfadQWFmDvNIq/Hz0AsprG+/JTAuR0wKwfuHsIf8o+bs74oUNywfP2WjgtOHE1QTE3slEfXMrTl5LQsztrEF5hvi4YcuKSLAYD/4dc7Ixx6YlEYPP2c/jIyk9DwcvxqChpQ3XbqbjyKU48PgDoFIosLUwxYo5oQhwd1L5OtDe1YMTVxNx9UaaxF1QqFQqQrzd4Otqr3JeGDfZWVtbcv41P+in8erCOlibVbs72EjsO/EHBNh96irylXybppFiwGRgXmjg4Fy12iYOvjt4BtUNd7Ocjq4enIpOxoX424MZkinbYMg3mUwdbfi42g/KppHTjkOX4pCYngeh8O6YXVJ6Hn47GfWXPI30EeztOuS4n6O1Odzs76717O3rR2JaLg5djEVPbz8EQiFySyqx58xVFFbU3OuOa8HR2hxG+g+Ot7H1WfBwtIH6vblmeaVV+P3UlcEhiiZOO45fScD5uFsAAHU1GmzMjeFqbzUp6kF5bSMuxN9GQbnkem9nZQpHa3O5d2X/NT/oJ2trS47KyQ4AImdPPz8en0OjUhER4lcmae2qWAy0dfVg95mrEAiFk6KSt3V1IyrxDvr6eWjktOGHQ+eQlP7XPE6hSISymgbsPHoBKTlF6OfxkVtaiVtZBUNmCIlpOahvbkVnDxcXE25jz+kr6PvbhqbtXT04E3MTR6PiIRSKUF7TiOu3HhyH5vEHkF9ejZScQgiEImQWVWDnsYuoqv9rO6c+Hg/xqdn4+egFNHLa0dzagaT0PNS3PDhFoqKuEdG3MtDPH0BBeQ1+PHIeNzLzIRSJBp8zv7wah6PikFtSiX4eH4UVNciTMpalSgiEQqTkFCGzsEziNRrq6rCzML1vRYwy+2CwtzeeH+bj5ZEyPuNTFEzxdJE4ui4UCZGcnjviheeqQEtbBz779QgO3ptWUFxV98Buy/yBAaTkFmPbh9+BxdQFp60TVUPsIdfbz8OV5HRU1X8CNTUa6ppbHxjzFInubnL6yS+HceDCdXRz+1BR1zhk48sqLMdzH/0AQxYTbZ3dKK6qG5TT3+V5NCp+8BDqmsYWcPv6H7hfY8tdkV9MSAG3tx9lNfUPXMfjDyAuJRtbG76CrrYWmts6VP7l1N9paGlDVlE5mls7JL6NtjBhw5Stj5p745vK7IMJkZ2lpXnbux998emnx2O2y7UbCwpMDfUlLm8QCIS4mJCCycSAQIjK+iZU1ktv1H39PGQXV0i9RiwWo6O7B7eyC6V/5oAAFXWNQ0ru7/w5RWK4z/xz/thwmUtNY8uwjbSzh4v0gsl5TIpAKERJdT2qGpolys7W3AQWJuzuO7nFclkmtP2R8E8tLc3bxvO5qeMd6Dkzp8ltN08KhQIna/OG5XNCb/i5OnhLzuxEKCgn53gTJi+c9k60SvnDoaerDXMjw+7hlpspogcUIrMDgFkzQpNluccdBYCZkWFXZGhA5rxp/ur2VmZG+kxdez2G5LlTdHU1bFkeCT1dbVy/namUlVVTg45gbzeVOfhHmfB1sR/Trs4TBV1dDb6uDlgyaypCfT3g4ShxsgKMDPTw0sblphHBvg2xKVllF+Jvu1bUNbFl6QGVlx0A/PTS+mef+/bwz2O9D1NHC6siwxKeWrXAxJSt72FiqG+oQR9+1wo1Gg1r5s/AjABPpOWXYOexi8N2yRQNHS1NLAybgjB/T2KfcUZLkz7qrZUmTNCuDtiwOBwzA71gY2YMPYYOpK0Vp6urw8HKjGplyjYL9HA2XRYe0nHm+s2k09eTveuaW5ljbf/PPBE17jGYENmFBk+JxreHx5TNOdlaNnz64uZqf3cnL2sz44d6bUShUKDP1IU+Uxc2FibwdLLFgQsx+PVE1JCD3ooIjUqFgR5DKXZeIUwcBnoMLJkVjE1L5sDHxR56ujqgUikPkQ2qw9zYkGJsyNJ3srEMnebnXvPriaj8pPS84NGunw0NnhI9EbGgTsSHenq4lW6LCBjV0VwUCgULwqbc2fX+S60LwoKmPqzo/om2pgZ8XOzxyqYV+O+rT0BeYxSjpZfHQ3p+CWm1Cs6AQIjmtg60tHcolOg2L5uLt59ci2m+7tBn6j6U6P7ZG7IwNqQsmhFk/f6zG90WTA9MGM08vG0RAb94erhNyJsh6kQVxPJFc4+MRnRh/p45/3vjaasQH1fPkXRZR3pfc2NDrJk/U+GE19/Px83MgvvmxBEUj4LyakTfykAXt29M9+H29qNbBudg/Cm659Ytgb2l2Yg39BzJ8EmQl7PeG1sf8R+N8EbT7pVednPnzIxl09UeanTdydq84fNXn9BwsrEwfZjdhkcqPBZDB4/Mm4H3nt0wsr/mAwKk5BQN+TOxWIzO7l5U1jeO6XuJxGJU1DXiP9/twdUbacQqCpjRpeWX4LsDZ3DtZjpEItGY7tfQ0ib1fNyOzh6pb1GBuytM1i+chefXLYGNmfGoszlpXdsAdyfdf299xD98qk/iSH+PTVfjzZ0zM3aiykptIivK/17fvHXzp78fHKmMPnphc6Wfm0OIvL7Pn2N5jy6cjczCMhy+FCf1+j4eH8evxGPZ7GDYWty/zXk3tw+/nLiElvZOWBqP7SUWf0CAlJxivP7Fr/B3j4Wnoy3Y+kximgmms6cXeaVVyCoqQ2lNAzq7uWO+Z1tXN5Iy8jB7qi+8ne/fVbqptQNJGXkoqaqTnkiE+OGJlfNhLQfR/SU8Nfi7O+k+vnyubVNre3FmYbnzSNr7xnXnJ6y8JlR2ocFBscDvI5LQluVz4+dPD5w5koyuq6cXSRl5UVmFZRqNrR1UGpUi8nVzsJ/u52Frb2k27GeZGLLw5tY1iLmViSYp50wIhEJkFVfg+U9+wDNrFiLE2w0spi7u5Jbg+JV4HL4UN/w+biPOIAQoqKhBZX0Trt3MgAZdjdhGAbK6Hm4fuP28MWd0fyIUihCTkgWhSIRNi+dgRqAXNDXoyCoqx8GLsThz/YbU6UZu9tZYPicUrnZWw4qOPyBASVUdMgvLUFJdj/auHpgbGYjdHaxr/NwcLS1N2NThhDdvWqBVZmH5rcq6JlFHN5c6fHvH5JSdna11w7c//vbyq7tOfiPtOoa2Fl55bJXDcGNpQqEIe85eTTgWFc+sbmzx6+rh6vH4Ai1QgDMxN3sNWQy42lrhja2PPPBX876+PZUKByszPL48Ep/vPiY9u+vnIS4lG6XV9dBn6kJNTQ2d3T1oaGmX+Sag4ntnYJC5dSqeMXZzEX0zA7kllTDQY4JGpaCL24v6lrZhs8ewAE9EBPsNO0aXW1qJ/eeuI+5ONjjtneD29WNAIIQGXV3E0NHSsDRhp66OnKG7am6om7EBS6I1mbramD890OlWVmFqfGp2kKTrvnpm1ct2ttYNk1Z2ABAxe/pFDCO7xTOnJjnZmE+Xdk1HN1f08o6dN+JSs7wbW9pYgn9kVJ3dXO3qhmYUVtSiuKoOn7z4OCJC/CTeT0ODjseWReCHw+eGnY7CGxhAWU0DaaUEmdHbz0N5bePgNlkjwdHKHCE+boNbZUnK5qJvZmDn8Yu4lVWAjq4eiO7f+ZnW3NZhUlXfbFJaXd+VV1qZtG3NoiBPJ1uJB2YFuDsZTvF0LkjNK5bYViJmT7840TGlTvQX8HB3Lf2/DfPel9atfGxZhI607qtAKMRbX/+eeOp60vTaRs4DovtnJpZRWIrX//crom+mSw4MhQJzI0NETgsgLY+gFLjaW8HT0UZq9/VGZj5+PHIOsbcz0dbZ/U/R3dem6ppbmYej4sJ2HruYUlRZOyDpntqaGpji6Wxrb2U25Alh/7dh3vse7q4TvhCZqgiFtCgy/KSkn5mx9bum+bhJTMFEIjGOXUlIOnY5YWZv38i6dyKRGAVl1fhw5yGpO5/Q1dXuO1+BQFBU6Opq8HKyhau9tcRrSqrqcOhiLBLTcoc8sEhSl/ro5fjQiwm386T1cHxc7E0drcxrH7Z9TzrZ+ft55/1nzZxPh8z8HG3LtKWM1QlFQnz+21Hrhz0hSigSIauoHEcvJ0i8Rl2NJvF0KgJBkWCz9GBlaiT13JCk9Dxcu5n+0GO+7V091CtJadyswnKJmYG1mbGaKVv/gZTyP2vmfOrv560Qk0SpilJYyxZGDDnZ0MfVXuI2MGKxGInpuVmFlbXWo/nMPh4fB85flxwcKhVmRgYKt6qCQPgnJoYsmLINJP68tbMbOSUVQ254OhIyCsuCCiqqW6RllrYWJgwjAxZvJO16UssuwN835911ER8PNR4gTXZ3cotbRzu9QyQSobKuSWpXVkNdbcityQkERUJHWxO62pL/KJdW1aGosnbUU6E6unvUC8prmprbOiSeY6lJp9fR1f9aKPDuuoiPA/x9c4jshmD5oshDf/83hQI42VhILEExgObWjjHNmuQLBIPnMAwJhSJVuASCQjRkCkXqi4k+Hn/E43RDJwZi9PH4xfwBgXi07ZnI7m/4+ngVfP7Esn//3WZ1zZx+aZldYUWt3lg+UywWo62rW+rPe3r7SWsiKDU93D70jHHdbje3l8Ht7Zd2aIvtn//n8yeW/dvXx6uAyE4Ki+b99eZGDCA5PZ8pOfh9ouzicpexfJ5AKERiao7Ev2YNLa0oqa4jrYWg0JRU16O4cuh6yh8QIL+8GuW1Y5sLmlNSGVhSXTfkoF9XTy+KKmvbWto6mP9sx0R2EnBzdS7/5bVNT/757/g72VOOXo6/8c/rhCIRPvz5YEJzW8eYjnPnDwhw6GIsrt5IfyCja2prx/Zv/7jv1CwCQRFpbuvAiauJiL+T/cDPbmTk4UpyKrrGuJtKcWWt/eWk1JKK2sb7sjsefwBHr8QXXb2R5sgfEOCX1zY96ebqXK5oMVLIBZaR4TPPsr8//COHL9Do4vbira93u8ffyYlfNDNIx5RtoFlcWdN5NCqenpSRN2Osa0/FYjFqmzl4+fOd2LQ4HKH+HtDS0EBBeRUOXYxDcgbZWomg+AiFItzMLsT7P+7HsvAQ+Ls7gT8wgITUHEQl3kFRVZ3ECcQjhccfwLErCcHltY03FoRN0fd1sTfr7ef1Rd/KqLoQf9u+sq7JjE1X40WGzzyriDFSSNlZWVlwzl24vHLF9m8vAkBNYwvrcFTszKs30zh0dXVeb3+/ZXNrJ4s/MCCTzxOJxCipqsO3B8/ij7PRoFEp4Pbz0NLWIfHkdAJB0ejr5yEltxjFVXVg6GjdOwWOi84ersw2pGjr7FaPT80Oyy4q5+rqaHUJhSLN9q6ekG5uL1UoEuHXj15aaWVlwVHE+Cjs1hlLF8+/9PSLb+/9PS5zM3B3y6Rubh9bXp8nFovBae8Ep72TtBqC0sIfGEBzWweapezWM1Z4/AE0trbroLX9viGkJ2b57l26eP4lRY0NVZELbuvGVd+R6ksgKAeK3l4VWnbBQYHp3zy7+mVSjQgExeabZ1e/HBwUmE5kNwYWL4g45qinRfZPIhAUFEc9rYbFCyKOKfr3VHjZ2dnaNHzz7vOPkypFIChoVvfu84/b2doofEJCVYZgLoicc/X9RyM/JNWKQFAs3n808sMFkXOuKsN3pSpLUB9ZsWgvqVoEAmmXKi87Nxfn8rM7XllAqheBoBic3fHKAjcXxVspofSyA4DFCyMvf7Rp4bukmhEIE8tHmxa+u3hh5GVl+s5UZQvyIysW7Z1irk/WcBEIE8QUc/08ZRxWUjrZOTna13z61rPPkipHIEwMn7717LNOjvY1RHbjQPissMSdr2x8hlQ7AmF82fnKxmfCZ4UlKuN3pypr0JcsnHvkxYXBP5DqN3lRU6OBoaMl9ZAZgux4cWHwD0sWzj2irN9faWVnamLctWXD6u8ttOhdpBpOPqzNjPGfp9bji9eegqWJEQmInLHQondt2bD6e1MTY6Vtb2rKXADeXh7F167HLZ//yucxpDpODvSZulgQNgVPrJwPb2c7ZBWVQ11djQRGzvz+6SvLvb08ipW6J6DshTB3zqzYvQePPb718z1/kCqpumhq0BHs7Ypn1y1GqK8HDFkMqKupgUqhkODImd1vbnl87pxZscr+HCrxJ3HzhjV7P/niO6v39kd9RKqmaqFGo8HZ1gJbV87DqojpYOvrkTG6ceTDTQve3bxhjUqsXlKZ/H/dqqV7KqrqnPckZG9Stu9uZWqM3DO7VK6hCIRCVNU349DFGBy9nPDQv2/GNsDGJeHYtDQCliZsMHW0H7gm0NMZZ757H7LatVqe0jZkMZWq/LbM8N6/btXSPf9540XV+MOpKg3Lwd62Lj0j+/M7+RWhuZxue2X67nR1NbjaWamc7MRiwMnGAtZmRtDS1MQfZ0a2XpzF0EXkNH88tmwugjydwWLqSuyuamtqwN7SlKRgMsaTzSh/7okNnzvY26rM0XoqNbLr7+edFxuf9HjEC58kkOo68VAogIa6OtzsrbFm3gxcv5WBmkbJB5JratAR4O6Ep1YvQESwH/SZutCgq5NATgDfvP/i4/5+3iq1UknlXmPNnjk98dyFy4v+PKyHoBhdOEsTNjwdbSXKztbcBNvWLsKy2SGwMGFDW1ODBG6COP3pS4tmz5yeqGrPRVXFwlq6eP6lvduf2ECqrSJ1acUQiiQfJs/t56G1oxv6TN1JKTr+wAB4/Ikfd9y7/YkNinxoDpHdEGxct/rQjy+uV4g1tLyBAWQVlWMy09nNRWG55OWUbR1d+PVEFNa8/imORMVPuoPJq+qbUVxZO6Hf4ccX1z+7cd3qQ6oaY6oqV6DVyxfu+eKp5a9P9Pfo6Obiyz9OoKe3f1KKrqaxBYcvx6GupVXiNUKRCB3dPbiZmY9//+9XPLb9C8SmZE2K+LR1diPuTjbS8ksm7Dt88dTy11cvX7hHleNMEY/xlPAHbqhgkzxrauvY+w6f3DaRc/AoFAoY2loIC/DEtjWL4O/uCBNDfZVuwAKhEC3tXbidXYiD568j+nYmurm9I4wXoEGnw9zIAPNCA/HihuVwsjFXScml5hXj5LUkXExIQSOnfUK+x4ebFrz72PpVO60sFetwa5m7SdVlBwDlFVVmew8df+7jo9ffmTDhAaDT1cFi6EJLgw4ajabi+YoYAqEIfTweunp60c/jj6ouaWtqwNXOChsWzcbGJeEw0Lt/rtqd3GJ88NMBlFTXK12ERCIh+nh8dHP70NvPk3njHgnvrJ3z8eZHH/nJ3k7xDsyRdTwmxaJCezubhtKy8p1CoUjtsxOxb01M0797knpTazsII6/s3L5+ZBaVoby2ARcSUvCv9UsxN8QfWpp3V1H09fNQ3diCspp6ErCH5O3Vs3dsWrdypyKKTh5MmhXUjg72dcUlZT8BwEQJjzA6hEIR2rt6kJiei8KKGkz388BLG5djqrcrCc4YRPfY+lU/OTrY102WZ55U20U4OznUFJeU/UShUESfHo/ZTqq8cjEwIEBDSyvOxd1CZlE5lsycCmdbSxKYh2T7I+Gfblq3cqezk0PNZHruSTFm909KyyosDhw9te2jI9HvkKqvnFCpFGhrakKTro4ubi/4AwISlBHw7rqIjzeuXbnT0cFO4TM6MmYnky6tXV1FZfVPGnR63zv7Ln1CmoDyIRKJ0dPbh57ePhKMEfLxYwv/s271sj12ttYNk/H5J+2uh3a21g21dfU7tTQ1+1775dRXpCkQVJn/Pb3y1dUrFu21tDBvm6wxmNRbvFpamLe1dnT8pKOtxd32zcFdpEkQVJGdL294ZuXKxXsNWSzeZI7DpByzG4rDx06t2/jxr4dJ0yCoEgfeeWr9+jUrlfKQHDKpWI5cjLo2f+mbX0WRJkJQBc59/uqCRQvmXlbW7y9rN1FJlfiLRQvmXo796b2QUGt2OokGQVkJtWanx/70Xogyi450Y8eJrJw8t1/2HH55Z3Ta06SKEJSJbREBvzy9Zf03Pl4eBcr+LKQbO05UVdWYHDt94bG3dp/7L2lCBGVgx9al/16zYvE+GxurJlV4HiK7cYa8uCAoA8r8IoLIToGIjU8Ke/uzn36+U9/uQZoVQZGYYq6f99nbzz2rituoE9lNEPmFRfYHj555asfJOLKJAEEheGvVrB0b1i7/1d3VRSW3wSaym2D2Hzq+6fEdu/eRpkaYSP54a+tjmx59ZL8qPyORnQKQlHwr6Muf/vjofE5VJGl2hPFkiZfN1defe/zd6aHBKar+rER2CkJVVY3JmQtX1r266+Q3pAkSxoOvnln18vLF846oyttWIjsl49r1+NnbP9/5Y3pjhxtpjgR54G/KKvj0zW3Pz50zM3YyPTeRnQJSXlFpdubClUff+PXMl6RpEmTJF08tf3354nmH7O1sJ922TER2CkxsfFLY/37a90FUQc1s0kwJY2GBm1Xsa8899r4qTikhslMR6usbWJej41Y89eW+3aTJEkbDr68/tnV+xKzT5uZmHZM5DkR2SkJmdq7b0VMXtvz3VPwbJBqEkfDvlTO/WLty8R5fb88CEg0iO6Xj2vX42V/tOvD+1cLamSQahKGIdLWMf/WZjR9MthcQRHYqSGtHh0Z0dNyyRz/cdZREg/B3Dr33zNqIiFlnJ/suwkR2KkZFZbVZdEzCErIFPGHnyxueiQifcX6yHn5DZDdJKCoutb18LW4ZmZA8+fjqmVUvz58766yLs2MliQaR3aQhv7DI/kp0/LLXfzlNTjdTcb58esWr8yJmnlXVRftEdoQRUVhUYns9Lmnxiz8e+55EQ7X47vk1L8yZNf2Cq4sTyeSI7Ah/Ul5RZZZ443bk1s/3/EGiodzsfnPL42HTpl61t7MhY3JEdgRJcDgcjRu30+bsOXz2hXPZFfNJRJSDpd52l7esX/b9tKkB19lsNnm7SmRHeBhu3k4NvBqTsOTDw9feI9FQTN5bP/fDyPAZ50OmBqaSaBDZEcZIRWWVWUpqRthvh869GFPaEEoiMrGEO5olP/no0u+CAv0S7WxJV5XIjiAXUtMzvZJvpoaTqSvjz1fPrHo5NCQwJtDfN4dEg8iOlNI4kpB0Mzjx5p2I9/ZHfUSiIR8+3LTg3bCQKdEzpofcItEgsiOyUwASk28F30xJn/X2nvOfkWiMjc+2LHk7JMg/Liw0mAiOyI7ITpFJz8j2yM7NDzx/LXHNmczyhSQi0lnua39pydywY96e7qn+ft55JCJEdkR2Skh1TS27tKzCLTMnP+jw+bgnyBbyd7c6X79k1u++Xu4pjg52BdZWlhxSU4jsiOxUjKqqGpOKqmrHgqJSn8TbGRFHU4pWqPozrw1yOR021S/azcUxy87GunSyHFpDZEdkR/gHefmFjtW1dfalZZVuqVn5wQdu5K9T1mfZOM39SKCP+y1HB9sCa0uLcg9311JSwkR2RHYEyd3f6lp2M4dj1tTUYlFb32BbXlnrmJ5XGqwI8/zCHc2S/T0cb9nbWpZamptVmpgY1Rmz2Q3W1qQ7SmQ3TrIjEAgERYRKQkAgEIjsCAQCQUX4/wEAtle3Qljask8AAAAASUVORK5CYII= + mediatype: image/png + install: + spec: + clusterPermissions: + - rules: + - apiGroups: + - "" + resources: + - namespaces + verbs: + - get + - apiGroups: + - "" + resources: + - secrets + verbs: + - '*' + - apiGroups: + - "" + resources: + - events + verbs: + - create + - apiGroups: + - admissionregistration.k8s.io + resources: + - validatingwebhookconfigurations + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - operator.external-secrets.io + resources: + - operatorconfigs + - operatorconfigs/status + - operatorconfigs/finalizers + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - "" + resources: + - pods + - services + - services/finalizers + - endpoints + - persistentvolumeclaims + - events + - configmaps + - secrets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apps + resources: + - deployments + - daemonsets + - replicasets + - statefulsets + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + - apiGroups: + - apiextensions.k8s.io + resources: + - customresourcedefinitions + verbs: + - '*' + - apiGroups: + - rbac.authorization.k8s.io + resources: + - clusterroles + - clusterrolebindings + - roles + - rolebindings + verbs: + - '*' + - apiGroups: + - "" + resources: + - serviceaccounts + - services + verbs: + - '*' + - apiGroups: + - apps + resources: + - deployments + verbs: + - '*' + - apiGroups: + - monitoring.coreos.com + resources: + - servicemonitors + verbs: + - create + - delete + - get + - list + - patch + - update + - watch + serviceAccountName: external-secrets-operator-controller-manager + deployments: + - label: + control-plane: controller-manager + name: external-secrets-operator-controller-manager + spec: + replicas: 1 + selector: + matchLabels: + control-plane: controller-manager + strategy: {} + template: + metadata: + labels: + control-plane: controller-manager + spec: + containers: + - args: + - --health-probe-bind-address=:8081 + - --metrics-bind-address=0.0.0.0:8080 + - --leader-elect + - --leader-election-id=external-secrets-operator + env: + - name: WATCH_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.annotations['olm.targetNamespaces'] + image: ghcr.io/external-secrets/external-secrets-helm-operator@sha256:1886cea401e58dde094320e077271f31bdfebbe08cbb3b5e2053d3ef51e263eb + livenessProbe: + httpGet: + path: /healthz + port: 8081 + initialDelaySeconds: 15 + periodSeconds: 20 + timeoutSeconds: 5 + name: manager + ports: + - containerPort: 8080 + name: metrics + protocol: TCP + readinessProbe: + httpGet: + path: /readyz + port: 8081 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 5 + resources: {} + securityContext: + allowPrivilegeEscalation: false + securityContext: + runAsNonRoot: true + serviceAccountName: external-secrets-operator-controller-manager + terminationGracePeriodSeconds: 10 + permissions: + - rules: + - apiGroups: + - "" + resources: + - configmaps + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - coordination.k8s.io + resources: + - leases + verbs: + - get + - list + - watch + - create + - update + - patch + - delete + - apiGroups: + - "" + resources: + - events + verbs: + - create + - patch + serviceAccountName: external-secrets-operator-controller-manager + strategy: deployment + installModes: + - supported: true + type: OwnNamespace + - supported: true + type: SingleNamespace + - supported: true + type: MultiNamespace + - supported: true + type: AllNamespaces + keywords: + - secrets + - secrets-manager + - vault + - aws + - azure + - google + - ibm + - akeyless + - yandex + - gitlab + - oracle + links: + - name: External Secrets Operator + url: https://external-secrets.io + - name: GitHub + url: https://github.com/external-secrets/external-secrets + - name: Slack + url: https://kubernetes.slack.com/messages/external-secrets + maintainers: + - email: contact@external-secrets.io + name: external-secrets community + maturity: alpha + minKubeVersion: 1.16.0 + provider: + name: External Secrets + url: https://external-secrets.io + version: 0.9.2 diff --git a/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_clusterexternalsecrets.yaml b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_clusterexternalsecrets.yaml new file mode 100644 index 00000000000..371ce8725bf --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_clusterexternalsecrets.yaml @@ -0,0 +1,553 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: clusterexternalsecrets.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: external-secrets.io + names: + categories: + - externalsecrets + kind: ClusterExternalSecret + listKind: ClusterExternalSecretList + plural: clusterexternalsecrets + shortNames: + - ces + singular: clusterexternalsecret + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .spec.externalSecretSpec.secretStoreRef.name + name: Store + type: string + - jsonPath: .spec.refreshTime + name: Refresh Interval + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterExternalSecret is the Schema for the clusterexternalsecrets + API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ClusterExternalSecretSpec defines the desired state of ClusterExternalSecret. + properties: + externalSecretMetadata: + description: The metadata of the external secrets to be created + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + externalSecretName: + description: The name of the external secrets to be created defaults + to the name of the ClusterExternalSecret + type: string + externalSecretSpec: + description: The spec for the ExternalSecrets to be created + properties: + data: + description: Data defines the connection between the Kubernetes + Secret keys and the Provider data + items: + description: ExternalSecretData defines the connection between + the Kubernetes Secret key (spec.data.) and the Provider + data. + properties: + remoteRef: + description: RemoteRef points to the remote secret and defines + which secret (version/property/..) to fetch. + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + metadataPolicy: + description: Policy for fetching tags/labels from provider + secrets, possible options are Fetch, None. Defaults + to None + type: string + property: + description: Used to select a specific property of the + Provider value (if a map), if supported + type: string + version: + description: Used to select a specific version of the + Provider value, if supported + type: string + required: + - key + type: object + secretKey: + description: SecretKey defines the key in which the controller + stores the value. This is the key in the Kind=Secret + type: string + sourceRef: + description: SourceRef allows you to override the source + from which the value will pulled from. + maxProperties: 1 + properties: + generatorRef: + description: GeneratorRef points to a generator custom + resource in + properties: + apiVersion: + default: generators.external-secrets.io/v1alpha1 + description: Specify the apiVersion of the generator + resource + type: string + kind: + description: Specify the Kind of the resource, e.g. + Password, ACRAccessToken etc. + type: string + name: + description: Specify the name of the generator resource + type: string + required: + - kind + - name + type: object + storeRef: + description: SecretStoreRef defines which SecretStore + to fetch the ExternalSecret data. + properties: + kind: + description: Kind of the SecretStore resource (SecretStore + or ClusterSecretStore) Defaults to `SecretStore` + type: string + name: + description: Name of the SecretStore resource + type: string + required: + - name + type: object + type: object + required: + - remoteRef + - secretKey + type: object + type: array + dataFrom: + description: DataFrom is used to fetch all properties from a specific + Provider data If multiple entries are specified, the Secret + keys are merged in the specified order + items: + properties: + extract: + description: 'Used to extract multiple key/value pairs from + one secret Note: Extract does not support sourceRef.Generator + or sourceRef.GeneratorRef.' + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + metadataPolicy: + description: Policy for fetching tags/labels from provider + secrets, possible options are Fetch, None. Defaults + to None + type: string + property: + description: Used to select a specific property of the + Provider value (if a map), if supported + type: string + version: + description: Used to select a specific version of the + Provider value, if supported + type: string + required: + - key + type: object + find: + description: 'Used to find secrets based on tags or regular + expressions Note: Find does not support sourceRef.Generator + or sourceRef.GeneratorRef.' + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + type: string + name: + description: Finds secrets based on the name. + properties: + regexp: + description: Finds secrets base + type: string + type: object + path: + description: A root path to start the find operations. + type: string + tags: + additionalProperties: + type: string + description: Find secrets based on tags. + type: object + type: object + rewrite: + description: Used to rewrite secret Keys after getting them + from the secret Provider Multiple Rewrite operations can + be provided. They are applied in a layered order (first + to last) + items: + properties: + regexp: + description: Used to rewrite with regular expressions. + The resulting key will be the output of a regexp.ReplaceAll + operation. + properties: + source: + description: Used to define the regular expression + of a re.Compiler. + type: string + target: + description: Used to define the target pattern + of a ReplaceAll operation. + type: string + required: + - source + - target + type: object + type: object + type: array + sourceRef: + description: SourceRef points to a store or generator which + contains secret values ready to use. Use this in combination + with Extract or Find pull values out of a specific SecretStore. + When sourceRef points to a generator Extract or Find is + not supported. The generator returns a static map of values + maxProperties: 1 + properties: + generatorRef: + description: GeneratorRef points to a generator custom + resource in + properties: + apiVersion: + default: generators.external-secrets.io/v1alpha1 + description: Specify the apiVersion of the generator + resource + type: string + kind: + description: Specify the Kind of the resource, e.g. + Password, ACRAccessToken etc. + type: string + name: + description: Specify the name of the generator resource + type: string + required: + - kind + - name + type: object + storeRef: + description: SecretStoreRef defines which SecretStore + to fetch the ExternalSecret data. + properties: + kind: + description: Kind of the SecretStore resource (SecretStore + or ClusterSecretStore) Defaults to `SecretStore` + type: string + name: + description: Name of the SecretStore resource + type: string + required: + - name + type: object + type: object + type: object + type: array + refreshInterval: + default: 1h + description: RefreshInterval is the amount of time before the + values are read again from the SecretStore provider Valid time + units are "ns", "us" (or "µs"), "ms", "s", "m", "h" May be set + to zero to fetch and create it once. Defaults to 1h. + type: string + secretStoreRef: + description: SecretStoreRef defines which SecretStore to fetch + the ExternalSecret data. + properties: + kind: + description: Kind of the SecretStore resource (SecretStore + or ClusterSecretStore) Defaults to `SecretStore` + type: string + name: + description: Name of the SecretStore resource + type: string + required: + - name + type: object + target: + default: + creationPolicy: Owner + deletionPolicy: Retain + description: ExternalSecretTarget defines the Kubernetes Secret + to be created There can be only one target per ExternalSecret. + properties: + creationPolicy: + default: Owner + description: CreationPolicy defines rules on how to create + the resulting Secret Defaults to 'Owner' + enum: + - Owner + - Orphan + - Merge + - None + type: string + deletionPolicy: + default: Retain + description: DeletionPolicy defines rules on how to delete + the resulting Secret Defaults to 'Retain' + enum: + - Delete + - Merge + - Retain + type: string + immutable: + description: Immutable defines if the final secret will be + immutable + type: boolean + name: + description: Name defines the name of the Secret resource + to be managed This field is immutable Defaults to the .metadata.name + of the ExternalSecret resource + type: string + template: + description: Template defines a blueprint for the created + Secret resource. + properties: + data: + additionalProperties: + type: string + type: object + engineVersion: + default: v2 + type: string + mergePolicy: + default: Replace + type: string + metadata: + description: ExternalSecretTemplateMetadata defines metadata + fields for the Secret blueprint. + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + templateFrom: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + templateAs: + default: Values + type: string + required: + - key + type: object + type: array + name: + type: string + required: + - items + - name + type: object + literal: + type: string + secret: + properties: + items: + items: + properties: + key: + type: string + templateAs: + default: Values + type: string + required: + - key + type: object + type: array + name: + type: string + required: + - items + - name + type: object + target: + default: Data + type: string + type: object + type: array + type: + type: string + type: object + type: object + type: object + namespaceSelector: + description: The labels to select by to find the Namespaces to create + the ExternalSecrets in. + properties: + matchExpressions: + description: matchExpressions is a list of label selector requirements. + The requirements are ANDed. + items: + description: A label selector requirement is a selector that + contains values, a key, and an operator that relates the key + and values. + properties: + key: + description: key is the label key that the selector applies + to. + type: string + operator: + description: operator represents a key's relationship to + a set of values. Valid operators are In, NotIn, Exists + and DoesNotExist. + type: string + values: + description: values is an array of string values. If the + operator is In or NotIn, the values array must be non-empty. + If the operator is Exists or DoesNotExist, the values + array must be empty. This array is replaced during a strategic + merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. A single + {key,value} in the matchLabels map is equivalent to an element + of matchExpressions, whose key field is "key", the operator + is "In", and the values array contains only "value". The requirements + are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + refreshTime: + description: The time in which the controller should reconcile it's + objects and recheck namespaces for labels. + type: string + required: + - externalSecretSpec + - namespaceSelector + type: object + status: + description: ClusterExternalSecretStatus defines the observed state of + ClusterExternalSecret. + properties: + conditions: + items: + properties: + message: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + failedNamespaces: + description: Failed namespaces are the namespaces that failed to apply + an ExternalSecret + items: + description: ClusterExternalSecretNamespaceFailure represents a + failed namespace deployment and it's reason. + properties: + namespace: + description: Namespace is the namespace that failed when trying + to apply an ExternalSecret + type: string + reason: + description: Reason is why the ExternalSecret failed to apply + to the namespace + type: string + required: + - namespace + type: object + type: array + provisionedNamespaces: + description: ProvisionedNamespaces are the namespaces where the ClusterExternalSecret + has secrets + items: + type: string + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_clustersecretstores.yaml b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_clustersecretstores.yaml new file mode 100644 index 00000000000..142e3b9c9eb --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_clustersecretstores.yaml @@ -0,0 +1,3940 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: clustersecretstores.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: external-secrets.io + names: + categories: + - externalsecrets + kind: ClusterSecretStore + listKind: ClusterSecretStoreList + plural: clustersecretstores + shortNames: + - css + singular: clustersecretstore + scope: Cluster + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].reason + name: Status + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: ClusterSecretStore represents a secure external location for + storing secrets, which can be referenced as part of `storeRef` fields. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: SecretStoreSpec defines the desired state of SecretStore. + properties: + controller: + description: 'Used to select the correct ESO controller (think: ingress.ingressClassName) + The ESO controller is instantiated with a specific controller name + and filters ES based on this property' + type: string + provider: + description: Used to configure the provider. Only one provider may + be set + maxProperties: 1 + minProperties: 1 + properties: + akeyless: + description: Akeyless configures this store to sync secrets using + Akeyless Vault provider + properties: + akeylessGWApiURL: + description: Akeyless GW API Url from which the secrets to + be fetched from. + type: string + authSecretRef: + description: Auth configures how the operator authenticates + with Akeyless. + properties: + kubernetesAuth: + description: Kubernetes authenticates with Akeyless by + passing the ServiceAccount token stored in the named + Secret resource. + properties: + accessID: + description: the Akeyless Kubernetes auth-method access-id + type: string + k8sConfName: + description: Kubernetes-auth configuration name in + Akeyless-Gateway + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Akeyless. If a name is specified without a key, + `token` is the default. If one is not specified, + the one bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Akeyless. If the service account selector is + not supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - accessID + - k8sConfName + type: object + secretRef: + description: Reference to a Secret that contains the details + to authenticate with Akeyless. + properties: + accessID: + description: The SecretAccessID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessType: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessTypeParam: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + caBundle: + description: PEM/base64 encoded CA bundle used to validate + Akeyless Gateway certificate. Only used if the AkeylessGWApiURL + URL is using HTTPS protocol. If not set the system root + certificates are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Akeyless Gateway certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + required: + - akeylessGWApiURL + - authSecretRef + type: object + alibaba: + description: Alibaba configures this store to sync secrets using + Alibaba Cloud provider + properties: + auth: + description: AlibabaAuth contains a secretRef for credentials. + properties: + rrsa: + description: Authenticate against Alibaba using RRSA. + properties: + oidcProviderArn: + type: string + oidcTokenFilePath: + type: string + roleArn: + type: string + sessionName: + type: string + required: + - oidcProviderArn + - oidcTokenFilePath + - roleArn + - sessionName + type: object + secretRef: + description: AlibabaAuthSecretRef holds secret references + for Alibaba credentials. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessKeySecretSecretRef: + description: The AccessKeySecret is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - accessKeyIDSecretRef + - accessKeySecretSecretRef + type: object + type: object + regionID: + description: Alibaba Region to be used for the provider + type: string + required: + - auth + - regionID + type: object + aws: + description: AWS configures this store to sync secrets using AWS + Secret Manager provider + properties: + auth: + description: 'Auth defines the information necessary to authenticate + against AWS if not set aws sdk will infer credentials from + your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + properties: + jwt: + description: Authenticate against AWS using service account + tokens. + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + type: object + secretRef: + description: AWSAuthSecretRef holds secret references + for AWS credentials both AccessKeyID and SecretAccessKey + must be defined in order to properly authenticate. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + region: + description: AWS Region to be used for the provider + type: string + role: + description: Role is a Role ARN which the SecretManager provider + will assume + type: string + service: + description: Service defines which service should be used + to fetch the secrets + enum: + - SecretsManager + - ParameterStore + type: string + required: + - region + - service + type: object + azurekv: + description: AzureKV configures this store to sync secrets using + Azure Key Vault provider + properties: + authSecretRef: + description: Auth configures how the operator authenticates + with Azure. Required for ServicePrincipal auth type. + properties: + clientId: + description: The Azure clientId of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + clientSecret: + description: The Azure ClientSecret of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + authType: + default: ServicePrincipal + description: 'Auth type defines how to authenticate to the + keyvault service. Valid values are: - "ServicePrincipal" + (default): Using a service principal (tenantId, clientId, + clientSecret) - "ManagedIdentity": Using Managed Identity + assigned to the pod (see aad-pod-identity)' + enum: + - ServicePrincipal + - ManagedIdentity + - WorkloadIdentity + type: string + identityId: + description: If multiple Managed Identity is assigned to the + pod, you can select the one to be used + type: string + serviceAccountRef: + description: ServiceAccountRef specified the service account + that should be used when authenticating with WorkloadIdentity. + properties: + audiences: + description: Audience specifies the `aud` claim for the + service account token If the service account uses a + well-known annotation for e.g. IRSA or GCP Workload + Identity then this audiences will be appended to the + list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + tenantId: + description: TenantID configures the Azure Tenant to send + requests to. Required for ServicePrincipal auth type. + type: string + vaultUrl: + description: Vault Url from which the secrets to be fetched + from. + type: string + required: + - vaultUrl + type: object + fake: + description: Fake configures a store with static key/value pairs + properties: + data: + items: + properties: + key: + type: string + value: + type: string + valueMap: + additionalProperties: + type: string + type: object + version: + type: string + required: + - key + type: object + type: array + required: + - data + type: object + gcpsm: + description: GCPSM configures this store to sync secrets using + Google Cloud Platform Secret Manager provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against GCP + properties: + secretRef: + properties: + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + workloadIdentity: + properties: + clusterLocation: + type: string + clusterName: + type: string + clusterProjectID: + type: string + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - clusterLocation + - clusterName + - serviceAccountRef + type: object + type: object + projectID: + description: ProjectID project where secret is located + type: string + type: object + gitlab: + description: GitLab configures this store to sync secrets using + GitLab Variables provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a GitLab instance. + properties: + SecretRef: + properties: + accessToken: + description: AccessToken is used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + required: + - SecretRef + type: object + projectID: + description: ProjectID specifies a project where secrets are + located. + type: string + url: + description: URL configures the GitLab instance URL. Defaults + to https://gitlab.com/. + type: string + required: + - auth + type: object + ibm: + description: IBM configures this store to sync secrets using IBM + Cloud provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the IBM secrets manager. + properties: + secretRef: + properties: + secretApiKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + required: + - secretRef + type: object + serviceUrl: + description: ServiceURL is the Endpoint URL that is specific + to the Secrets Manager service instance + type: string + required: + - auth + type: object + kubernetes: + description: Kubernetes configures this store to sync secrets + using a Kubernetes cluster provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a Kubernetes instance. + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + clientKey: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + serviceAccount: + description: points to a service account that should be + used for authentication + properties: + serviceAccount: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + remoteNamespace: + default: default + description: Remote namespace to fetch the secrets from + type: string + server: + description: configures the Kubernetes server Address. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the + provider type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + required: + - auth + type: object + oracle: + description: Oracle configures this store to sync secrets using + Oracle Vault provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Oracle Vault. If empty, use the instance principal, + otherwise the user credentials specified in Auth. + properties: + secretRef: + description: SecretRef to pass through sensitive information. + properties: + fingerprint: + description: Fingerprint is the fingerprint of the + API private key. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + privatekey: + description: PrivateKey is the user's API Signing + Key in PEM format, used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - fingerprint + - privatekey + type: object + tenancy: + description: Tenancy is the tenancy OCID where user is + located. + type: string + user: + description: User is an access OCID specific to the account. + type: string + required: + - secretRef + - tenancy + - user + type: object + region: + description: Region is the region where vault is located. + type: string + vault: + description: Vault is the vault's OCID of the specific vault + where secret is located. + type: string + required: + - region + - vault + type: object + vault: + description: Vault configures this store to sync secrets using + Hashi provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Vault server. + properties: + appRole: + description: AppRole authenticates with Vault using the + App Role auth mechanism, with the role and secret stored + in a Kubernetes Secret resource. + properties: + path: + default: approle + description: 'Path where the App Role authentication + backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication + backend when setting up the authentication backend + in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains + the App Role secret used to authenticate with Vault. + The `key` field must be specified and denotes which + entry within the Secret resource is used as the + app role secret. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + - roleId + - secretRef + type: object + cert: + description: Cert authenticates with TLS Certificates + by passing client certificate, private key and ca certificate + Cert authentication method + properties: + clientCert: + description: ClientCert is a certificate to authenticate + using the Cert Vault authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretRef: + description: SecretRef to a key in a Secret resource + containing client private key to authenticate with + Vault using the Cert authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + jwt: + description: Jwt authenticates with Vault by passing role + and JWT token using the JWT/OIDC authentication method + properties: + kubernetesServiceAccountToken: + description: Optional ServiceAccountToken specifies + the Kubernetes service account for which to request + a token for with the `TokenRequest` API. + properties: + audiences: + description: Optional audiences field that will + be used to request a temporary Kubernetes service + account token for the service account referenced + by `serviceAccountRef`. Defaults to a single + audience `vault` it not specified. + items: + type: string + type: array + expirationSeconds: + description: Optional expiration time in seconds + that will be used to request a temporary Kubernetes + service account token for the service account + referenced by `serviceAccountRef`. Defaults + to 10 minutes. + format: int64 + type: integer + serviceAccountRef: + description: Service account field containing + the name of a kubernetes ServiceAccount. + properties: + audiences: + description: Audience specifies the `aud` + claim for the service account token If the + service account uses a well-known annotation + for e.g. IRSA or GCP Workload Identity then + this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + path: + default: jwt + description: 'Path where the JWT authentication backend + is mounted in Vault, e.g: "jwt"' + type: string + role: + description: Role is a JWT role to authenticate using + the JWT/OIDC Vault authentication method + type: string + secretRef: + description: Optional SecretRef that refers to a key + in a Secret resource containing JWT token to authenticate + with Vault using the JWT/OIDC authentication method. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + type: object + kubernetes: + description: Kubernetes authenticates with Vault by passing + the ServiceAccount token stored in the named Secret + resource to the Vault server. + properties: + mountPath: + default: kubernetes + description: 'Path where the Kubernetes authentication + backend is mounted in Vault, e.g: "kubernetes"' + type: string + role: + description: A required field containing the Vault + Role to assume. A Role binds a Kubernetes ServiceAccount + with a set of Vault policies. + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Vault. If a name is specified without a key, `token` + is the default. If one is not specified, the one + bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Vault. If the service account selector is not + supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - mountPath + - role + type: object + ldap: + description: Ldap authenticates with Vault by passing + username/password pair using the LDAP authentication + method + properties: + path: + default: ldap + description: 'Path where the LDAP authentication backend + is mounted in Vault, e.g: "ldap"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource + containing password for the LDAP user used to authenticate + with Vault using the LDAP authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + username: + description: Username is a LDAP user name used to + authenticate using the LDAP Vault authentication + method + type: string + required: + - path + - username + type: object + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by + presenting a token. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caBundle: + description: PEM encoded CA bundle used to validate Vault + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Vault server certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + forwardInconsistent: + description: ForwardInconsistent tells Vault to forward read-after-write + requests to the Vault leader instead of simply retrying + within a loop. This can increase performance if the option + is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header + type: boolean + namespace: + description: 'Name of the vault namespace. Namespaces is a + set of features within Vault Enterprise that allows Vault + environments to support Secure Multi-tenancy. e.g: "ns1". + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault KV backend + endpoint, e.g: "secret". The v2 KV secret engine version + specific "/data" path suffix for fetching secrets from Vault + is optional and will be appended if not present in specified + path.' + type: string + readYourWrites: + description: ReadYourWrites ensures isolated read-after-write + semantics by providing discovered cluster replication states + in each request. More information about eventual consistency + in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency + type: boolean + server: + description: 'Server is the connection address for the Vault + server, e.g: "https://vault.example.com:8200".' + type: string + version: + default: v2 + description: Version is the Vault KV secret engine version. + This can be either "v1" or "v2". Version defaults to "v2". + enum: + - v1 + - v2 + type: string + required: + - auth + - server + type: object + webhook: + description: Webhook configures this store to sync secrets using + a generic templated webhook + properties: + body: + description: Body + type: string + caBundle: + description: PEM encoded CA bundle used to validate webhook + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + webhook server certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + headers: + additionalProperties: + type: string + description: Headers + type: object + method: + description: Webhook Method + type: string + result: + description: Result formatting + properties: + jsonPath: + description: Json path of return value + type: string + type: object + secrets: + description: Secrets to fill in templates These secrets will + be passed to the templating function as key value pairs + under the given name + items: + properties: + name: + description: Name of this secret in templates + type: string + secretRef: + description: Secret ref to fill in credentials + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it may + be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of the + referent. + type: string + type: object + required: + - name + - secretRef + type: object + type: array + timeout: + description: Timeout + type: string + url: + description: Webhook url to call + type: string + required: + - result + - url + type: object + yandexlockbox: + description: YandexLockbox configures this store to sync secrets + using Yandex Lockbox provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Lockbox + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + required: + - auth + type: object + type: object + retrySettings: + description: Used to configure http retries if failed + properties: + maxRetries: + format: int32 + type: integer + retryInterval: + type: string + type: object + required: + - provider + type: object + status: + description: SecretStoreStatus defines the observed state of the SecretStore. + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].reason + name: Status + type: string + - jsonPath: .status.capabilities + name: Capabilities + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ClusterSecretStore represents a secure external location for + storing secrets, which can be referenced as part of `storeRef` fields. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: SecretStoreSpec defines the desired state of SecretStore. + properties: + conditions: + description: Used to constraint a ClusterSecretStore to specific namespaces. + Relevant only to ClusterSecretStore + items: + description: ClusterSecretStoreCondition describes a condition by + which to choose namespaces to process ExternalSecrets in for a + ClusterSecretStore instance. + properties: + namespaceSelector: + description: Choose namespace using a labelSelector + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. + If the operator is In or NotIn, the values array + must be non-empty. If the operator is Exists or + DoesNotExist, the values array must be empty. This + array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: Choose namespaces by name + items: + type: string + type: array + type: object + type: array + controller: + description: 'Used to select the correct ESO controller (think: ingress.ingressClassName) + The ESO controller is instantiated with a specific controller name + and filters ES based on this property' + type: string + provider: + description: Used to configure the provider. Only one provider may + be set + maxProperties: 1 + minProperties: 1 + properties: + akeyless: + description: Akeyless configures this store to sync secrets using + Akeyless Vault provider + properties: + akeylessGWApiURL: + description: Akeyless GW API Url from which the secrets to + be fetched from. + type: string + authSecretRef: + description: Auth configures how the operator authenticates + with Akeyless. + properties: + kubernetesAuth: + description: Kubernetes authenticates with Akeyless by + passing the ServiceAccount token stored in the named + Secret resource. + properties: + accessID: + description: the Akeyless Kubernetes auth-method access-id + type: string + k8sConfName: + description: Kubernetes-auth configuration name in + Akeyless-Gateway + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Akeyless. If a name is specified without a key, + `token` is the default. If one is not specified, + the one bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Akeyless. If the service account selector is + not supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - accessID + - k8sConfName + type: object + secretRef: + description: Reference to a Secret that contains the details + to authenticate with Akeyless. + properties: + accessID: + description: The SecretAccessID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessType: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessTypeParam: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + caBundle: + description: PEM/base64 encoded CA bundle used to validate + Akeyless Gateway certificate. Only used if the AkeylessGWApiURL + URL is using HTTPS protocol. If not set the system root + certificates are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Akeyless Gateway certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. Can + only be defined when used in a ClusterSecretStore. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + required: + - akeylessGWApiURL + - authSecretRef + type: object + alibaba: + description: Alibaba configures this store to sync secrets using + Alibaba Cloud provider + properties: + auth: + description: AlibabaAuth contains a secretRef for credentials. + properties: + rrsa: + description: Authenticate against Alibaba using RRSA. + properties: + oidcProviderArn: + type: string + oidcTokenFilePath: + type: string + roleArn: + type: string + sessionName: + type: string + required: + - oidcProviderArn + - oidcTokenFilePath + - roleArn + - sessionName + type: object + secretRef: + description: AlibabaAuthSecretRef holds secret references + for Alibaba credentials. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessKeySecretSecretRef: + description: The AccessKeySecret is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - accessKeyIDSecretRef + - accessKeySecretSecretRef + type: object + type: object + regionID: + description: Alibaba Region to be used for the provider + type: string + required: + - auth + - regionID + type: object + aws: + description: AWS configures this store to sync secrets using AWS + Secret Manager provider + properties: + additionalRoles: + description: AdditionalRoles is a chained list of Role ARNs + which the SecretManager provider will sequentially assume + before assuming Role + items: + type: string + type: array + auth: + description: 'Auth defines the information necessary to authenticate + against AWS if not set aws sdk will infer credentials from + your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + properties: + jwt: + description: Authenticate against AWS using service account + tokens. + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + type: object + secretRef: + description: AWSAuthSecretRef holds secret references + for AWS credentials both AccessKeyID and SecretAccessKey + must be defined in order to properly authenticate. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + sessionTokenSecretRef: + description: 'The SessionToken used for authentication + This must be defined if AccessKeyID and SecretAccessKey + are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html' + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + externalID: + description: AWS External ID set on assumed IAM roles + type: string + region: + description: AWS Region to be used for the provider + type: string + role: + description: Role is a Role ARN which the SecretManager provider + will assume + type: string + service: + description: Service defines which service should be used + to fetch the secrets + enum: + - SecretsManager + - ParameterStore + type: string + sessionTags: + description: AWS STS assume role session tags + items: + properties: + key: + type: string + value: + type: string + required: + - key + - value + type: object + type: array + transitiveTagKeys: + description: AWS STS assume role transitive session tags. + Required when multiple rules are used with SecretStore + items: + type: string + type: array + required: + - region + - service + type: object + azurekv: + description: AzureKV configures this store to sync secrets using + Azure Key Vault provider + properties: + authSecretRef: + description: Auth configures how the operator authenticates + with Azure. Required for ServicePrincipal auth type. + properties: + clientId: + description: The Azure clientId of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + clientSecret: + description: The Azure ClientSecret of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + authType: + default: ServicePrincipal + description: 'Auth type defines how to authenticate to the + keyvault service. Valid values are: - "ServicePrincipal" + (default): Using a service principal (tenantId, clientId, + clientSecret) - "ManagedIdentity": Using Managed Identity + assigned to the pod (see aad-pod-identity)' + enum: + - ServicePrincipal + - ManagedIdentity + - WorkloadIdentity + type: string + environmentType: + default: PublicCloud + description: 'EnvironmentType specifies the Azure cloud environment + endpoints to use for connecting and authenticating with + Azure. By default it points to the public cloud AAD endpoint. + The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 + PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud' + enum: + - PublicCloud + - USGovernmentCloud + - ChinaCloud + - GermanCloud + type: string + identityId: + description: If multiple Managed Identity is assigned to the + pod, you can select the one to be used + type: string + serviceAccountRef: + description: ServiceAccountRef specified the service account + that should be used when authenticating with WorkloadIdentity. + properties: + audiences: + description: Audience specifies the `aud` claim for the + service account token If the service account uses a + well-known annotation for e.g. IRSA or GCP Workload + Identity then this audiences will be appended to the + list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + tenantId: + description: TenantID configures the Azure Tenant to send + requests to. Required for ServicePrincipal auth type. + type: string + vaultUrl: + description: Vault Url from which the secrets to be fetched + from. + type: string + required: + - vaultUrl + type: object + conjur: + description: Conjur configures this store to sync secrets using + conjur provider + properties: + auth: + properties: + apikey: + properties: + account: + type: string + apiKeyRef: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + userRef: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - account + - apiKeyRef + - userRef + type: object + required: + - apikey + type: object + caBundle: + type: string + url: + type: string + required: + - auth + - url + type: object + delinea: + description: Delinea DevOps Secrets Vault https://docs.delinea.com/online-help/products/devops-secrets-vault/current + properties: + clientId: + description: ClientID is the non-secret part of the credential. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + clientSecret: + description: ClientSecret is the secret part of the credential. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + tenant: + description: Tenant is the chosen hostname / site name. + type: string + tld: + description: TLD is based on the server location that was + chosen during provisioning. If unset, defaults to "com". + type: string + urlTemplate: + description: URLTemplate If unset, defaults to "https://%s.secretsvaultcloud.%s/v1/%s%s". + type: string + required: + - clientId + - clientSecret + - tenant + type: object + doppler: + description: Doppler configures this store to sync secrets using + the Doppler provider + properties: + auth: + description: Auth configures how the Operator authenticates + with the Doppler API + properties: + secretRef: + properties: + dopplerToken: + description: The DopplerToken is used for authentication. + See https://docs.doppler.com/reference/api#authentication + for auth token types. The Key attribute defaults + to dopplerToken if not specified. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - dopplerToken + type: object + required: + - secretRef + type: object + config: + description: Doppler config (required if not using a Service + Token) + type: string + format: + description: Format enables the downloading of secrets as + a file (string) + enum: + - json + - dotnet-json + - env + - yaml + - docker + type: string + nameTransformer: + description: Environment variable compatible name transforms + that change secret names to a different format + enum: + - upper-camel + - camel + - lower-snake + - tf-var + - dotnet-env + - lower-kebab + type: string + project: + description: Doppler project (required if not using a Service + Token) + type: string + required: + - auth + type: object + fake: + description: Fake configures a store with static key/value pairs + properties: + data: + items: + properties: + key: + type: string + value: + type: string + valueMap: + additionalProperties: + type: string + type: object + version: + type: string + required: + - key + type: object + type: array + required: + - data + type: object + gcpsm: + description: GCPSM configures this store to sync secrets using + Google Cloud Platform Secret Manager provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against GCP + properties: + secretRef: + properties: + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + workloadIdentity: + properties: + clusterLocation: + type: string + clusterName: + type: string + clusterProjectID: + type: string + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - clusterLocation + - clusterName + - serviceAccountRef + type: object + type: object + projectID: + description: ProjectID project where secret is located + type: string + type: object + gitlab: + description: GitLab configures this store to sync secrets using + GitLab Variables provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a GitLab instance. + properties: + SecretRef: + properties: + accessToken: + description: AccessToken is used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + required: + - SecretRef + type: object + environment: + description: Environment environment_scope of gitlab CI/CD + variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment + on how to create environments) + type: string + groupIDs: + description: GroupIDs specify, which gitlab groups to pull + secrets from. Group secrets are read from left to right + followed by the project variables. + items: + type: string + type: array + inheritFromGroups: + description: InheritFromGroups specifies whether parent groups + should be discovered and checked for secrets. + type: boolean + projectID: + description: ProjectID specifies a project where secrets are + located. + type: string + url: + description: URL configures the GitLab instance URL. Defaults + to https://gitlab.com/. + type: string + required: + - auth + type: object + ibm: + description: IBM configures this store to sync secrets using IBM + Cloud provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the IBM secrets manager. + maxProperties: 1 + minProperties: 1 + properties: + containerAuth: + description: IBM Container-based auth with IAM Trusted + Profile. + properties: + iamEndpoint: + type: string + profile: + description: the IBM Trusted Profile + type: string + tokenLocation: + description: Location the token is mounted on the + pod + type: string + required: + - profile + type: object + secretRef: + properties: + secretApiKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + serviceUrl: + description: ServiceURL is the Endpoint URL that is specific + to the Secrets Manager service instance + type: string + required: + - auth + type: object + keepersecurity: + description: KeeperSecurity configures this store to sync secrets + using the KeeperSecurity provider + properties: + authRef: + description: A reference to a specific 'key' within a Secret + resource, In some instances, `key` is a required field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this field + may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being referred + to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + folderID: + type: string + required: + - authRef + - folderID + type: object + kubernetes: + description: Kubernetes configures this store to sync secrets + using a Kubernetes cluster provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a Kubernetes instance. + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + clientKey: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + serviceAccount: + description: points to a service account that should be + used for authentication + properties: + audiences: + description: Audience specifies the `aud` claim for + the service account token If the service account + uses a well-known annotation for e.g. IRSA or GCP + Workload Identity then this audiences will be appended + to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + remoteNamespace: + default: default + description: Remote namespace to fetch the secrets from + type: string + server: + description: configures the Kubernetes server Address. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can + be found in the Secret or ConfigMap. + type: string + name: + description: The name of the object located at the + provider type. + type: string + namespace: + description: The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + required: + - auth + type: object + onepassword: + description: OnePassword configures this store to sync secrets + using the 1Password Cloud provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against OnePassword Connect Server + properties: + secretRef: + description: OnePasswordAuthSecretRef holds secret references + for 1Password credentials. + properties: + connectTokenSecretRef: + description: The ConnectToken is used for authentication + to a 1Password Connect Server. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - connectTokenSecretRef + type: object + required: + - secretRef + type: object + connectHost: + description: ConnectHost defines the OnePassword Connect Server + to connect to + type: string + vaults: + additionalProperties: + type: integer + description: Vaults defines which OnePassword vaults to search + in which order + type: object + required: + - auth + - connectHost + - vaults + type: object + oracle: + description: Oracle configures this store to sync secrets using + Oracle Vault provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Oracle Vault. If empty, use the instance principal, + otherwise the user credentials specified in Auth. + properties: + secretRef: + description: SecretRef to pass through sensitive information. + properties: + fingerprint: + description: Fingerprint is the fingerprint of the + API private key. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + privatekey: + description: PrivateKey is the user's API Signing + Key in PEM format, used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - fingerprint + - privatekey + type: object + tenancy: + description: Tenancy is the tenancy OCID where user is + located. + type: string + user: + description: User is an access OCID specific to the account. + type: string + required: + - secretRef + - tenancy + - user + type: object + region: + description: Region is the region where vault is located. + type: string + vault: + description: Vault is the vault's OCID of the specific vault + where secret is located. + type: string + required: + - region + - vault + type: object + scaleway: + description: Scaleway + properties: + accessKey: + description: AccessKey is the non-secret part of the api key. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + apiUrl: + description: APIURL is the url of the api to use. Defaults + to https://api.scaleway.com + type: string + projectId: + description: 'ProjectID is the id of your project, which you + can find in the console: https://console.scaleway.com/project/settings' + type: string + region: + description: 'Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone' + type: string + secretKey: + description: SecretKey is the non-secret part of the api key. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + required: + - accessKey + - projectId + - region + - secretKey + type: object + senhasegura: + description: Senhasegura configures this store to sync secrets + using senhasegura provider + properties: + auth: + description: Auth defines parameters to authenticate in senhasegura + properties: + clientId: + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + required: + - clientId + - clientSecretSecretRef + type: object + ignoreSslCertificate: + default: false + description: IgnoreSslCertificate defines if SSL certificate + must be ignored + type: boolean + module: + description: Module defines which senhasegura module should + be used to get secrets + type: string + url: + description: URL of senhasegura + type: string + required: + - auth + - module + - url + type: object + vault: + description: Vault configures this store to sync secrets using + Hashi provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Vault server. + properties: + appRole: + description: AppRole authenticates with Vault using the + App Role auth mechanism, with the role and secret stored + in a Kubernetes Secret resource. + properties: + path: + default: approle + description: 'Path where the App Role authentication + backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication + backend when setting up the authentication backend + in Vault. + type: string + roleRef: + description: Reference to a key in a Secret that contains + the App Role ID used to authenticate with Vault. + The `key` field must be specified and denotes which + entry within the Secret resource is used as the + app role id. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretRef: + description: Reference to a key in a Secret that contains + the App Role secret used to authenticate with Vault. + The `key` field must be specified and denotes which + entry within the Secret resource is used as the + app role secret. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + - secretRef + type: object + cert: + description: Cert authenticates with TLS Certificates + by passing client certificate, private key and ca certificate + Cert authentication method + properties: + clientCert: + description: ClientCert is a certificate to authenticate + using the Cert Vault authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretRef: + description: SecretRef to a key in a Secret resource + containing client private key to authenticate with + Vault using the Cert authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + iam: + description: Iam authenticates with vault by passing a + special AWS request signed with AWS IAM credentials + AWS IAM authentication method + properties: + externalID: + description: AWS External ID set on assumed IAM roles + type: string + jwt: + description: Specify a service account with IRSA enabled + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` + claim for the service account token If the + service account uses a well-known annotation + for e.g. IRSA or GCP Workload Identity then + this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + required: + - name + type: object + type: object + path: + description: 'Path where the AWS auth method is enabled + in Vault, e.g: "aws"' + type: string + region: + description: AWS region + type: string + role: + description: This is the AWS role to be assumed before + talking to vault + type: string + secretRef: + description: Specify credentials in a Secret object + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some + instances of this field may be defaulted, + in others it may be required. + type: string + name: + description: The name of the Secret resource + being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some + instances of this field may be defaulted, + in others it may be required. + type: string + name: + description: The name of the Secret resource + being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + type: object + sessionTokenSecretRef: + description: 'The SessionToken used for authentication + This must be defined if AccessKeyID and SecretAccessKey + are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html' + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some + instances of this field may be defaulted, + in others it may be required. + type: string + name: + description: The name of the Secret resource + being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + type: object + type: object + vaultAwsIamServerID: + description: 'X-Vault-AWS-IAM-Server-ID is an additional + header used by Vault IAM auth method to mitigate + against different types of replay attacks. More + details here: https://developer.hashicorp.com/vault/docs/auth/aws' + type: string + vaultRole: + description: Vault Role. In vault, a role describes + an identity with a set of permissions, groups, or + policies you want to attach a user of the secrets + engine + type: string + required: + - vaultRole + type: object + jwt: + description: Jwt authenticates with Vault by passing role + and JWT token using the JWT/OIDC authentication method + properties: + kubernetesServiceAccountToken: + description: Optional ServiceAccountToken specifies + the Kubernetes service account for which to request + a token for with the `TokenRequest` API. + properties: + audiences: + description: 'Optional audiences field that will + be used to request a temporary Kubernetes service + account token for the service account referenced + by `serviceAccountRef`. Defaults to a single + audience `vault` it not specified. Deprecated: + use serviceAccountRef.Audiences instead' + items: + type: string + type: array + expirationSeconds: + description: 'Optional expiration time in seconds + that will be used to request a temporary Kubernetes + service account token for the service account + referenced by `serviceAccountRef`. Deprecated: + this will be removed in the future. Defaults + to 10 minutes.' + format: int64 + type: integer + serviceAccountRef: + description: Service account field containing + the name of a kubernetes ServiceAccount. + properties: + audiences: + description: Audience specifies the `aud` + claim for the service account token If the + service account uses a well-known annotation + for e.g. IRSA or GCP Workload Identity then + this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + path: + default: jwt + description: 'Path where the JWT authentication backend + is mounted in Vault, e.g: "jwt"' + type: string + role: + description: Role is a JWT role to authenticate using + the JWT/OIDC Vault authentication method + type: string + secretRef: + description: Optional SecretRef that refers to a key + in a Secret resource containing JWT token to authenticate + with Vault using the JWT/OIDC authentication method. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + type: object + kubernetes: + description: Kubernetes authenticates with Vault by passing + the ServiceAccount token stored in the named Secret + resource to the Vault server. + properties: + mountPath: + default: kubernetes + description: 'Path where the Kubernetes authentication + backend is mounted in Vault, e.g: "kubernetes"' + type: string + role: + description: A required field containing the Vault + Role to assume. A Role binds a Kubernetes ServiceAccount + with a set of Vault policies. + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Vault. If a name is specified without a key, `token` + is the default. If one is not specified, the one + bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Vault. If the service account selector is not + supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - mountPath + - role + type: object + ldap: + description: Ldap authenticates with Vault by passing + username/password pair using the LDAP authentication + method + properties: + path: + default: ldap + description: 'Path where the LDAP authentication backend + is mounted in Vault, e.g: "ldap"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource + containing password for the LDAP user used to authenticate + with Vault using the LDAP authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + username: + description: Username is a LDAP user name used to + authenticate using the LDAP Vault authentication + method + type: string + required: + - path + - username + type: object + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by + presenting a token. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + userPass: + description: UserPass authenticates with Vault by passing + username/password pair + properties: + path: + default: user + description: 'Path where the UserPassword authentication + backend is mounted in Vault, e.g: "user"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource + containing password for the user used to authenticate + with Vault using the UserPass authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + username: + description: Username is a user name used to authenticate + using the UserPass Vault authentication method + type: string + required: + - path + - username + type: object + type: object + caBundle: + description: PEM encoded CA bundle used to validate Vault + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Vault server certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. Can + only be defined when used in a ClusterSecretStore. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + forwardInconsistent: + description: ForwardInconsistent tells Vault to forward read-after-write + requests to the Vault leader instead of simply retrying + within a loop. This can increase performance if the option + is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header + type: boolean + namespace: + description: 'Name of the vault namespace. Namespaces is a + set of features within Vault Enterprise that allows Vault + environments to support Secure Multi-tenancy. e.g: "ns1". + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault KV backend + endpoint, e.g: "secret". The v2 KV secret engine version + specific "/data" path suffix for fetching secrets from Vault + is optional and will be appended if not present in specified + path.' + type: string + readYourWrites: + description: ReadYourWrites ensures isolated read-after-write + semantics by providing discovered cluster replication states + in each request. More information about eventual consistency + in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency + type: boolean + server: + description: 'Server is the connection address for the Vault + server, e.g: "https://vault.example.com:8200".' + type: string + version: + default: v2 + description: Version is the Vault KV secret engine version. + This can be either "v1" or "v2". Version defaults to "v2". + enum: + - v1 + - v2 + type: string + required: + - auth + - server + type: object + webhook: + description: Webhook configures this store to sync secrets using + a generic templated webhook + properties: + body: + description: Body + type: string + caBundle: + description: PEM encoded CA bundle used to validate webhook + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + webhook server certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + headers: + additionalProperties: + type: string + description: Headers + type: object + method: + description: Webhook Method + type: string + result: + description: Result formatting + properties: + jsonPath: + description: Json path of return value + type: string + type: object + secrets: + description: Secrets to fill in templates These secrets will + be passed to the templating function as key value pairs + under the given name + items: + properties: + name: + description: Name of this secret in templates + type: string + secretRef: + description: Secret ref to fill in credentials + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it may + be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of the + referent. + type: string + type: object + required: + - name + - secretRef + type: object + type: array + timeout: + description: Timeout + type: string + url: + description: Webhook url to call + type: string + required: + - result + - url + type: object + yandexcertificatemanager: + description: YandexCertificateManager configures this store to + sync secrets using Yandex Certificate Manager provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Certificate Manager + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + required: + - auth + type: object + yandexlockbox: + description: YandexLockbox configures this store to sync secrets + using Yandex Lockbox provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Lockbox + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + required: + - auth + type: object + type: object + refreshInterval: + description: Used to configure store refresh interval in seconds. + Empty or 0 will default to the controller config. + type: integer + retrySettings: + description: Used to configure http retries if failed + properties: + maxRetries: + format: int32 + type: integer + retryInterval: + type: string + type: object + required: + - provider + type: object + status: + description: SecretStoreStatus defines the observed state of the SecretStore. + properties: + capabilities: + description: SecretStoreCapabilities defines the possible operations + a SecretStore can do. + type: string + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_externalsecrets.yaml b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_externalsecrets.yaml new file mode 100644 index 00000000000..13687fb8a50 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_externalsecrets.yaml @@ -0,0 +1,731 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: externalsecrets.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: external-secrets.io + names: + categories: + - externalsecrets + kind: ExternalSecret + listKind: ExternalSecretList + plural: externalsecrets + shortNames: + - es + singular: externalsecret + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .spec.secretStoreRef.name + name: Store + type: string + - jsonPath: .spec.refreshInterval + name: Refresh Interval + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].reason + name: Status + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: ExternalSecret is the Schema for the external-secrets API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ExternalSecretSpec defines the desired state of ExternalSecret. + properties: + data: + description: Data defines the connection between the Kubernetes Secret + keys and the Provider data + items: + description: ExternalSecretData defines the connection between the + Kubernetes Secret key (spec.data.) and the Provider data. + properties: + remoteRef: + description: ExternalSecretDataRemoteRef defines Provider data + location. + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + property: + description: Used to select a specific property of the Provider + value (if a map), if supported + type: string + version: + description: Used to select a specific version of the Provider + value, if supported + type: string + required: + - key + type: object + secretKey: + type: string + required: + - remoteRef + - secretKey + type: object + type: array + dataFrom: + description: DataFrom is used to fetch all properties from a specific + Provider data If multiple entries are specified, the Secret keys + are merged in the specified order + items: + description: ExternalSecretDataRemoteRef defines Provider data location. + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + property: + description: Used to select a specific property of the Provider + value (if a map), if supported + type: string + version: + description: Used to select a specific version of the Provider + value, if supported + type: string + required: + - key + type: object + type: array + refreshInterval: + default: 1h + description: RefreshInterval is the amount of time before the values + are read again from the SecretStore provider Valid time units are + "ns", "us" (or "µs"), "ms", "s", "m", "h" May be set to zero to + fetch and create it once. Defaults to 1h. + type: string + secretStoreRef: + description: SecretStoreRef defines which SecretStore to fetch the + ExternalSecret data. + properties: + kind: + description: Kind of the SecretStore resource (SecretStore or + ClusterSecretStore) Defaults to `SecretStore` + type: string + name: + description: Name of the SecretStore resource + type: string + required: + - name + type: object + target: + description: ExternalSecretTarget defines the Kubernetes Secret to + be created There can be only one target per ExternalSecret. + properties: + creationPolicy: + default: Owner + description: CreationPolicy defines rules on how to create the + resulting Secret Defaults to 'Owner' + type: string + immutable: + description: Immutable defines if the final secret will be immutable + type: boolean + name: + description: Name defines the name of the Secret resource to be + managed This field is immutable Defaults to the .metadata.name + of the ExternalSecret resource + type: string + template: + description: Template defines a blueprint for the created Secret + resource. + properties: + data: + additionalProperties: + type: string + type: object + engineVersion: + default: v1 + description: EngineVersion specifies the template engine version + that should be used to compile/execute the template specified + in .data and .templateFrom[]. + type: string + metadata: + description: ExternalSecretTemplateMetadata defines metadata + fields for the Secret blueprint. + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + templateFrom: + items: + maxProperties: 1 + minProperties: 1 + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + required: + - key + type: object + type: array + name: + type: string + required: + - items + - name + type: object + secret: + properties: + items: + items: + properties: + key: + type: string + required: + - key + type: object + type: array + name: + type: string + required: + - items + - name + type: object + type: object + type: array + type: + type: string + type: object + type: object + required: + - secretStoreRef + - target + type: object + status: + properties: + binding: + description: Binding represents a servicebinding.io Provisioned Service + reference to the secret + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + refreshTime: + description: refreshTime is the time and date the external secret + was fetched and the target secret updated + format: date-time + nullable: true + type: string + syncedResourceVersion: + description: SyncedResourceVersion keeps track of the last synced + version + type: string + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .spec.secretStoreRef.name + name: Store + type: string + - jsonPath: .spec.refreshInterval + name: Refresh Interval + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].reason + name: Status + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: ExternalSecret is the Schema for the external-secrets API. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: ExternalSecretSpec defines the desired state of ExternalSecret. + properties: + data: + description: Data defines the connection between the Kubernetes Secret + keys and the Provider data + items: + description: ExternalSecretData defines the connection between the + Kubernetes Secret key (spec.data.) and the Provider data. + properties: + remoteRef: + description: RemoteRef points to the remote secret and defines + which secret (version/property/..) to fetch. + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + metadataPolicy: + description: Policy for fetching tags/labels from provider + secrets, possible options are Fetch, None. Defaults to + None + type: string + property: + description: Used to select a specific property of the Provider + value (if a map), if supported + type: string + version: + description: Used to select a specific version of the Provider + value, if supported + type: string + required: + - key + type: object + secretKey: + description: SecretKey defines the key in which the controller + stores the value. This is the key in the Kind=Secret + type: string + sourceRef: + description: SourceRef allows you to override the source from + which the value will pulled from. + maxProperties: 1 + properties: + generatorRef: + description: GeneratorRef points to a generator custom resource + in + properties: + apiVersion: + default: generators.external-secrets.io/v1alpha1 + description: Specify the apiVersion of the generator + resource + type: string + kind: + description: Specify the Kind of the resource, e.g. + Password, ACRAccessToken etc. + type: string + name: + description: Specify the name of the generator resource + type: string + required: + - kind + - name + type: object + storeRef: + description: SecretStoreRef defines which SecretStore to + fetch the ExternalSecret data. + properties: + kind: + description: Kind of the SecretStore resource (SecretStore + or ClusterSecretStore) Defaults to `SecretStore` + type: string + name: + description: Name of the SecretStore resource + type: string + required: + - name + type: object + type: object + required: + - remoteRef + - secretKey + type: object + type: array + dataFrom: + description: DataFrom is used to fetch all properties from a specific + Provider data If multiple entries are specified, the Secret keys + are merged in the specified order + items: + properties: + extract: + description: 'Used to extract multiple key/value pairs from + one secret Note: Extract does not support sourceRef.Generator + or sourceRef.GeneratorRef.' + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + type: string + key: + description: Key is the key used in the Provider, mandatory + type: string + metadataPolicy: + description: Policy for fetching tags/labels from provider + secrets, possible options are Fetch, None. Defaults to + None + type: string + property: + description: Used to select a specific property of the Provider + value (if a map), if supported + type: string + version: + description: Used to select a specific version of the Provider + value, if supported + type: string + required: + - key + type: object + find: + description: 'Used to find secrets based on tags or regular + expressions Note: Find does not support sourceRef.Generator + or sourceRef.GeneratorRef.' + properties: + conversionStrategy: + default: Default + description: Used to define a conversion Strategy + type: string + decodingStrategy: + default: None + description: Used to define a decoding Strategy + type: string + name: + description: Finds secrets based on the name. + properties: + regexp: + description: Finds secrets base + type: string + type: object + path: + description: A root path to start the find operations. + type: string + tags: + additionalProperties: + type: string + description: Find secrets based on tags. + type: object + type: object + rewrite: + description: Used to rewrite secret Keys after getting them + from the secret Provider Multiple Rewrite operations can be + provided. They are applied in a layered order (first to last) + items: + properties: + regexp: + description: Used to rewrite with regular expressions. + The resulting key will be the output of a regexp.ReplaceAll + operation. + properties: + source: + description: Used to define the regular expression + of a re.Compiler. + type: string + target: + description: Used to define the target pattern of + a ReplaceAll operation. + type: string + required: + - source + - target + type: object + type: object + type: array + sourceRef: + description: SourceRef points to a store or generator which + contains secret values ready to use. Use this in combination + with Extract or Find pull values out of a specific SecretStore. + When sourceRef points to a generator Extract or Find is not + supported. The generator returns a static map of values + maxProperties: 1 + properties: + generatorRef: + description: GeneratorRef points to a generator custom resource + in + properties: + apiVersion: + default: generators.external-secrets.io/v1alpha1 + description: Specify the apiVersion of the generator + resource + type: string + kind: + description: Specify the Kind of the resource, e.g. + Password, ACRAccessToken etc. + type: string + name: + description: Specify the name of the generator resource + type: string + required: + - kind + - name + type: object + storeRef: + description: SecretStoreRef defines which SecretStore to + fetch the ExternalSecret data. + properties: + kind: + description: Kind of the SecretStore resource (SecretStore + or ClusterSecretStore) Defaults to `SecretStore` + type: string + name: + description: Name of the SecretStore resource + type: string + required: + - name + type: object + type: object + type: object + type: array + refreshInterval: + default: 1h + description: RefreshInterval is the amount of time before the values + are read again from the SecretStore provider Valid time units are + "ns", "us" (or "µs"), "ms", "s", "m", "h" May be set to zero to + fetch and create it once. Defaults to 1h. + type: string + secretStoreRef: + description: SecretStoreRef defines which SecretStore to fetch the + ExternalSecret data. + properties: + kind: + description: Kind of the SecretStore resource (SecretStore or + ClusterSecretStore) Defaults to `SecretStore` + type: string + name: + description: Name of the SecretStore resource + type: string + required: + - name + type: object + target: + default: + creationPolicy: Owner + deletionPolicy: Retain + description: ExternalSecretTarget defines the Kubernetes Secret to + be created There can be only one target per ExternalSecret. + properties: + creationPolicy: + default: Owner + description: CreationPolicy defines rules on how to create the + resulting Secret Defaults to 'Owner' + enum: + - Owner + - Orphan + - Merge + - None + type: string + deletionPolicy: + default: Retain + description: DeletionPolicy defines rules on how to delete the + resulting Secret Defaults to 'Retain' + enum: + - Delete + - Merge + - Retain + type: string + immutable: + description: Immutable defines if the final secret will be immutable + type: boolean + name: + description: Name defines the name of the Secret resource to be + managed This field is immutable Defaults to the .metadata.name + of the ExternalSecret resource + type: string + template: + description: Template defines a blueprint for the created Secret + resource. + properties: + data: + additionalProperties: + type: string + type: object + engineVersion: + default: v2 + type: string + mergePolicy: + default: Replace + type: string + metadata: + description: ExternalSecretTemplateMetadata defines metadata + fields for the Secret blueprint. + properties: + annotations: + additionalProperties: + type: string + type: object + labels: + additionalProperties: + type: string + type: object + type: object + templateFrom: + items: + properties: + configMap: + properties: + items: + items: + properties: + key: + type: string + templateAs: + default: Values + type: string + required: + - key + type: object + type: array + name: + type: string + required: + - items + - name + type: object + literal: + type: string + secret: + properties: + items: + items: + properties: + key: + type: string + templateAs: + default: Values + type: string + required: + - key + type: object + type: array + name: + type: string + required: + - items + - name + type: object + target: + default: Data + type: string + type: object + type: array + type: + type: string + type: object + type: object + type: object + status: + properties: + binding: + description: Binding represents a servicebinding.io Provisioned Service + reference to the secret + properties: + name: + description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + TODO: Add other useful fields. apiVersion, kind, uid?' + type: string + type: object + x-kubernetes-map-type: atomic + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + refreshTime: + description: refreshTime is the time and date the external secret + was fetched and the target secret updated + format: date-time + nullable: true + type: string + syncedResourceVersion: + description: SyncedResourceVersion keeps track of the last synced + version + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_pushsecrets.yaml b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_pushsecrets.yaml new file mode 100644 index 00000000000..9c979563afa --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_pushsecrets.yaml @@ -0,0 +1,255 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: pushsecrets.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: external-secrets.io + names: + categories: + - pushsecrets + kind: PushSecret + listKind: PushSecretList + plural: pushsecrets + singular: pushsecret + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].reason + name: Status + type: string + name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: PushSecretSpec configures the behavior of the PushSecret. + properties: + data: + description: Secret Data that should be pushed to providers + items: + properties: + match: + description: Match a given Secret Key to be pushed to the provider. + properties: + remoteRef: + description: Remote Refs to push to providers. + properties: + property: + description: Name of the property in the resulting secret + type: string + remoteKey: + description: Name of the resulting provider secret. + type: string + required: + - remoteKey + type: object + secretKey: + description: Secret Key to be pushed + type: string + required: + - remoteRef + - secretKey + type: object + required: + - match + type: object + type: array + deletionPolicy: + default: None + description: 'Deletion Policy to handle Secrets in the provider. Possible + Values: "Delete/None". Defaults to "None".' + type: string + refreshInterval: + description: The Interval to which External Secrets will try to push + a secret definition + type: string + secretStoreRefs: + items: + properties: + kind: + default: SecretStore + description: Kind of the SecretStore resource (SecretStore or + ClusterSecretStore) Defaults to `SecretStore` + type: string + labelSelector: + description: Optionally, sync to secret stores with label selector + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. + If the operator is In or NotIn, the values array + must be non-empty. If the operator is Exists or + DoesNotExist, the values array must be empty. This + array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + name: + description: Optionally, sync to the SecretStore of the given + name + type: string + type: object + type: array + selector: + description: The Secret Selector (k8s source) for the Push Secret + properties: + secret: + description: Select a Secret to Push. + properties: + name: + description: Name of the Secret. The Secret must exist in + the same namespace as the PushSecret manifest. + type: string + required: + - name + type: object + required: + - secret + type: object + required: + - secretStoreRefs + - selector + type: object + status: + description: PushSecretStatus indicates the history of the status of PushSecret. + properties: + conditions: + items: + description: PushSecretStatusCondition indicates the status of the + PushSecret. + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + description: PushSecretConditionType indicates the condition + of the PushSecret. + type: string + required: + - status + - type + type: object + type: array + refreshTime: + description: refreshTime is the time and date the external secret + was fetched and the target secret updated + format: date-time + nullable: true + type: string + syncedPushSecrets: + additionalProperties: + additionalProperties: + properties: + match: + description: Match a given Secret Key to be pushed to the + provider. + properties: + remoteRef: + description: Remote Refs to push to providers. + properties: + property: + description: Name of the property in the resulting + secret + type: string + remoteKey: + description: Name of the resulting provider secret. + type: string + required: + - remoteKey + type: object + secretKey: + description: Secret Key to be pushed + type: string + required: + - remoteRef + - secretKey + type: object + required: + - match + type: object + type: object + description: Synced Push Secrets for later deletion. Matches Secret + Stores to PushSecretData that was stored to that secretStore. + type: object + syncedResourceVersion: + description: SyncedResourceVersion keeps track of the last synced + version. + type: string + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_secretstores.yaml b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_secretstores.yaml new file mode 100644 index 00000000000..9235edaad4e --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/external-secrets.io_secretstores.yaml @@ -0,0 +1,3940 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: secretstores.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: external-secrets.io + names: + categories: + - externalsecrets + kind: SecretStore + listKind: SecretStoreList + plural: secretstores + shortNames: + - ss + singular: secretstore + scope: Namespaced + versions: + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].reason + name: Status + type: string + deprecated: true + name: v1alpha1 + schema: + openAPIV3Schema: + description: SecretStore represents a secure external location for storing + secrets, which can be referenced as part of `storeRef` fields. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: SecretStoreSpec defines the desired state of SecretStore. + properties: + controller: + description: 'Used to select the correct ESO controller (think: ingress.ingressClassName) + The ESO controller is instantiated with a specific controller name + and filters ES based on this property' + type: string + provider: + description: Used to configure the provider. Only one provider may + be set + maxProperties: 1 + minProperties: 1 + properties: + akeyless: + description: Akeyless configures this store to sync secrets using + Akeyless Vault provider + properties: + akeylessGWApiURL: + description: Akeyless GW API Url from which the secrets to + be fetched from. + type: string + authSecretRef: + description: Auth configures how the operator authenticates + with Akeyless. + properties: + kubernetesAuth: + description: Kubernetes authenticates with Akeyless by + passing the ServiceAccount token stored in the named + Secret resource. + properties: + accessID: + description: the Akeyless Kubernetes auth-method access-id + type: string + k8sConfName: + description: Kubernetes-auth configuration name in + Akeyless-Gateway + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Akeyless. If a name is specified without a key, + `token` is the default. If one is not specified, + the one bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Akeyless. If the service account selector is + not supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - accessID + - k8sConfName + type: object + secretRef: + description: Reference to a Secret that contains the details + to authenticate with Akeyless. + properties: + accessID: + description: The SecretAccessID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessType: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessTypeParam: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + caBundle: + description: PEM/base64 encoded CA bundle used to validate + Akeyless Gateway certificate. Only used if the AkeylessGWApiURL + URL is using HTTPS protocol. If not set the system root + certificates are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Akeyless Gateway certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + required: + - akeylessGWApiURL + - authSecretRef + type: object + alibaba: + description: Alibaba configures this store to sync secrets using + Alibaba Cloud provider + properties: + auth: + description: AlibabaAuth contains a secretRef for credentials. + properties: + rrsa: + description: Authenticate against Alibaba using RRSA. + properties: + oidcProviderArn: + type: string + oidcTokenFilePath: + type: string + roleArn: + type: string + sessionName: + type: string + required: + - oidcProviderArn + - oidcTokenFilePath + - roleArn + - sessionName + type: object + secretRef: + description: AlibabaAuthSecretRef holds secret references + for Alibaba credentials. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessKeySecretSecretRef: + description: The AccessKeySecret is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - accessKeyIDSecretRef + - accessKeySecretSecretRef + type: object + type: object + regionID: + description: Alibaba Region to be used for the provider + type: string + required: + - auth + - regionID + type: object + aws: + description: AWS configures this store to sync secrets using AWS + Secret Manager provider + properties: + auth: + description: 'Auth defines the information necessary to authenticate + against AWS if not set aws sdk will infer credentials from + your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + properties: + jwt: + description: Authenticate against AWS using service account + tokens. + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + type: object + secretRef: + description: AWSAuthSecretRef holds secret references + for AWS credentials both AccessKeyID and SecretAccessKey + must be defined in order to properly authenticate. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + region: + description: AWS Region to be used for the provider + type: string + role: + description: Role is a Role ARN which the SecretManager provider + will assume + type: string + service: + description: Service defines which service should be used + to fetch the secrets + enum: + - SecretsManager + - ParameterStore + type: string + required: + - region + - service + type: object + azurekv: + description: AzureKV configures this store to sync secrets using + Azure Key Vault provider + properties: + authSecretRef: + description: Auth configures how the operator authenticates + with Azure. Required for ServicePrincipal auth type. + properties: + clientId: + description: The Azure clientId of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + clientSecret: + description: The Azure ClientSecret of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + authType: + default: ServicePrincipal + description: 'Auth type defines how to authenticate to the + keyvault service. Valid values are: - "ServicePrincipal" + (default): Using a service principal (tenantId, clientId, + clientSecret) - "ManagedIdentity": Using Managed Identity + assigned to the pod (see aad-pod-identity)' + enum: + - ServicePrincipal + - ManagedIdentity + - WorkloadIdentity + type: string + identityId: + description: If multiple Managed Identity is assigned to the + pod, you can select the one to be used + type: string + serviceAccountRef: + description: ServiceAccountRef specified the service account + that should be used when authenticating with WorkloadIdentity. + properties: + audiences: + description: Audience specifies the `aud` claim for the + service account token If the service account uses a + well-known annotation for e.g. IRSA or GCP Workload + Identity then this audiences will be appended to the + list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + tenantId: + description: TenantID configures the Azure Tenant to send + requests to. Required for ServicePrincipal auth type. + type: string + vaultUrl: + description: Vault Url from which the secrets to be fetched + from. + type: string + required: + - vaultUrl + type: object + fake: + description: Fake configures a store with static key/value pairs + properties: + data: + items: + properties: + key: + type: string + value: + type: string + valueMap: + additionalProperties: + type: string + type: object + version: + type: string + required: + - key + type: object + type: array + required: + - data + type: object + gcpsm: + description: GCPSM configures this store to sync secrets using + Google Cloud Platform Secret Manager provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against GCP + properties: + secretRef: + properties: + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + workloadIdentity: + properties: + clusterLocation: + type: string + clusterName: + type: string + clusterProjectID: + type: string + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - clusterLocation + - clusterName + - serviceAccountRef + type: object + type: object + projectID: + description: ProjectID project where secret is located + type: string + type: object + gitlab: + description: GitLab configures this store to sync secrets using + GitLab Variables provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a GitLab instance. + properties: + SecretRef: + properties: + accessToken: + description: AccessToken is used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + required: + - SecretRef + type: object + projectID: + description: ProjectID specifies a project where secrets are + located. + type: string + url: + description: URL configures the GitLab instance URL. Defaults + to https://gitlab.com/. + type: string + required: + - auth + type: object + ibm: + description: IBM configures this store to sync secrets using IBM + Cloud provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the IBM secrets manager. + properties: + secretRef: + properties: + secretApiKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + required: + - secretRef + type: object + serviceUrl: + description: ServiceURL is the Endpoint URL that is specific + to the Secrets Manager service instance + type: string + required: + - auth + type: object + kubernetes: + description: Kubernetes configures this store to sync secrets + using a Kubernetes cluster provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a Kubernetes instance. + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + clientKey: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + serviceAccount: + description: points to a service account that should be + used for authentication + properties: + serviceAccount: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + remoteNamespace: + default: default + description: Remote namespace to fetch the secrets from + type: string + server: + description: configures the Kubernetes server Address. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the + provider type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + required: + - auth + type: object + oracle: + description: Oracle configures this store to sync secrets using + Oracle Vault provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Oracle Vault. If empty, use the instance principal, + otherwise the user credentials specified in Auth. + properties: + secretRef: + description: SecretRef to pass through sensitive information. + properties: + fingerprint: + description: Fingerprint is the fingerprint of the + API private key. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + privatekey: + description: PrivateKey is the user's API Signing + Key in PEM format, used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - fingerprint + - privatekey + type: object + tenancy: + description: Tenancy is the tenancy OCID where user is + located. + type: string + user: + description: User is an access OCID specific to the account. + type: string + required: + - secretRef + - tenancy + - user + type: object + region: + description: Region is the region where vault is located. + type: string + vault: + description: Vault is the vault's OCID of the specific vault + where secret is located. + type: string + required: + - region + - vault + type: object + vault: + description: Vault configures this store to sync secrets using + Hashi provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Vault server. + properties: + appRole: + description: AppRole authenticates with Vault using the + App Role auth mechanism, with the role and secret stored + in a Kubernetes Secret resource. + properties: + path: + default: approle + description: 'Path where the App Role authentication + backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication + backend when setting up the authentication backend + in Vault. + type: string + secretRef: + description: Reference to a key in a Secret that contains + the App Role secret used to authenticate with Vault. + The `key` field must be specified and denotes which + entry within the Secret resource is used as the + app role secret. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + - roleId + - secretRef + type: object + cert: + description: Cert authenticates with TLS Certificates + by passing client certificate, private key and ca certificate + Cert authentication method + properties: + clientCert: + description: ClientCert is a certificate to authenticate + using the Cert Vault authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretRef: + description: SecretRef to a key in a Secret resource + containing client private key to authenticate with + Vault using the Cert authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + jwt: + description: Jwt authenticates with Vault by passing role + and JWT token using the JWT/OIDC authentication method + properties: + kubernetesServiceAccountToken: + description: Optional ServiceAccountToken specifies + the Kubernetes service account for which to request + a token for with the `TokenRequest` API. + properties: + audiences: + description: Optional audiences field that will + be used to request a temporary Kubernetes service + account token for the service account referenced + by `serviceAccountRef`. Defaults to a single + audience `vault` it not specified. + items: + type: string + type: array + expirationSeconds: + description: Optional expiration time in seconds + that will be used to request a temporary Kubernetes + service account token for the service account + referenced by `serviceAccountRef`. Defaults + to 10 minutes. + format: int64 + type: integer + serviceAccountRef: + description: Service account field containing + the name of a kubernetes ServiceAccount. + properties: + audiences: + description: Audience specifies the `aud` + claim for the service account token If the + service account uses a well-known annotation + for e.g. IRSA or GCP Workload Identity then + this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + path: + default: jwt + description: 'Path where the JWT authentication backend + is mounted in Vault, e.g: "jwt"' + type: string + role: + description: Role is a JWT role to authenticate using + the JWT/OIDC Vault authentication method + type: string + secretRef: + description: Optional SecretRef that refers to a key + in a Secret resource containing JWT token to authenticate + with Vault using the JWT/OIDC authentication method. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + type: object + kubernetes: + description: Kubernetes authenticates with Vault by passing + the ServiceAccount token stored in the named Secret + resource to the Vault server. + properties: + mountPath: + default: kubernetes + description: 'Path where the Kubernetes authentication + backend is mounted in Vault, e.g: "kubernetes"' + type: string + role: + description: A required field containing the Vault + Role to assume. A Role binds a Kubernetes ServiceAccount + with a set of Vault policies. + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Vault. If a name is specified without a key, `token` + is the default. If one is not specified, the one + bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Vault. If the service account selector is not + supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - mountPath + - role + type: object + ldap: + description: Ldap authenticates with Vault by passing + username/password pair using the LDAP authentication + method + properties: + path: + default: ldap + description: 'Path where the LDAP authentication backend + is mounted in Vault, e.g: "ldap"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource + containing password for the LDAP user used to authenticate + with Vault using the LDAP authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + username: + description: Username is a LDAP user name used to + authenticate using the LDAP Vault authentication + method + type: string + required: + - path + - username + type: object + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by + presenting a token. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caBundle: + description: PEM encoded CA bundle used to validate Vault + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Vault server certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + forwardInconsistent: + description: ForwardInconsistent tells Vault to forward read-after-write + requests to the Vault leader instead of simply retrying + within a loop. This can increase performance if the option + is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header + type: boolean + namespace: + description: 'Name of the vault namespace. Namespaces is a + set of features within Vault Enterprise that allows Vault + environments to support Secure Multi-tenancy. e.g: "ns1". + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault KV backend + endpoint, e.g: "secret". The v2 KV secret engine version + specific "/data" path suffix for fetching secrets from Vault + is optional and will be appended if not present in specified + path.' + type: string + readYourWrites: + description: ReadYourWrites ensures isolated read-after-write + semantics by providing discovered cluster replication states + in each request. More information about eventual consistency + in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency + type: boolean + server: + description: 'Server is the connection address for the Vault + server, e.g: "https://vault.example.com:8200".' + type: string + version: + default: v2 + description: Version is the Vault KV secret engine version. + This can be either "v1" or "v2". Version defaults to "v2". + enum: + - v1 + - v2 + type: string + required: + - auth + - server + type: object + webhook: + description: Webhook configures this store to sync secrets using + a generic templated webhook + properties: + body: + description: Body + type: string + caBundle: + description: PEM encoded CA bundle used to validate webhook + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + webhook server certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + headers: + additionalProperties: + type: string + description: Headers + type: object + method: + description: Webhook Method + type: string + result: + description: Result formatting + properties: + jsonPath: + description: Json path of return value + type: string + type: object + secrets: + description: Secrets to fill in templates These secrets will + be passed to the templating function as key value pairs + under the given name + items: + properties: + name: + description: Name of this secret in templates + type: string + secretRef: + description: Secret ref to fill in credentials + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it may + be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of the + referent. + type: string + type: object + required: + - name + - secretRef + type: object + type: array + timeout: + description: Timeout + type: string + url: + description: Webhook url to call + type: string + required: + - result + - url + type: object + yandexlockbox: + description: YandexLockbox configures this store to sync secrets + using Yandex Lockbox provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Lockbox + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + required: + - auth + type: object + type: object + retrySettings: + description: Used to configure http retries if failed + properties: + maxRetries: + format: int32 + type: integer + retryInterval: + type: string + type: object + required: + - provider + type: object + status: + description: SecretStoreStatus defines the observed state of the SecretStore. + properties: + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + type: object + type: object + served: true + storage: false + subresources: + status: {} + - additionalPrinterColumns: + - jsonPath: .metadata.creationTimestamp + name: AGE + type: date + - jsonPath: .status.conditions[?(@.type=="Ready")].reason + name: Status + type: string + - jsonPath: .status.capabilities + name: Capabilities + type: string + - jsonPath: .status.conditions[?(@.type=="Ready")].status + name: Ready + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: SecretStore represents a secure external location for storing + secrets, which can be referenced as part of `storeRef` fields. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: SecretStoreSpec defines the desired state of SecretStore. + properties: + conditions: + description: Used to constraint a ClusterSecretStore to specific namespaces. + Relevant only to ClusterSecretStore + items: + description: ClusterSecretStoreCondition describes a condition by + which to choose namespaces to process ExternalSecrets in for a + ClusterSecretStore instance. + properties: + namespaceSelector: + description: Choose namespace using a labelSelector + properties: + matchExpressions: + description: matchExpressions is a list of label selector + requirements. The requirements are ANDed. + items: + description: A label selector requirement is a selector + that contains values, a key, and an operator that relates + the key and values. + properties: + key: + description: key is the label key that the selector + applies to. + type: string + operator: + description: operator represents a key's relationship + to a set of values. Valid operators are In, NotIn, + Exists and DoesNotExist. + type: string + values: + description: values is an array of string values. + If the operator is In or NotIn, the values array + must be non-empty. If the operator is Exists or + DoesNotExist, the values array must be empty. This + array is replaced during a strategic merge patch. + items: + type: string + type: array + required: + - key + - operator + type: object + type: array + matchLabels: + additionalProperties: + type: string + description: matchLabels is a map of {key,value} pairs. + A single {key,value} in the matchLabels map is equivalent + to an element of matchExpressions, whose key field is + "key", the operator is "In", and the values array contains + only "value". The requirements are ANDed. + type: object + type: object + x-kubernetes-map-type: atomic + namespaces: + description: Choose namespaces by name + items: + type: string + type: array + type: object + type: array + controller: + description: 'Used to select the correct ESO controller (think: ingress.ingressClassName) + The ESO controller is instantiated with a specific controller name + and filters ES based on this property' + type: string + provider: + description: Used to configure the provider. Only one provider may + be set + maxProperties: 1 + minProperties: 1 + properties: + akeyless: + description: Akeyless configures this store to sync secrets using + Akeyless Vault provider + properties: + akeylessGWApiURL: + description: Akeyless GW API Url from which the secrets to + be fetched from. + type: string + authSecretRef: + description: Auth configures how the operator authenticates + with Akeyless. + properties: + kubernetesAuth: + description: Kubernetes authenticates with Akeyless by + passing the ServiceAccount token stored in the named + Secret resource. + properties: + accessID: + description: the Akeyless Kubernetes auth-method access-id + type: string + k8sConfName: + description: Kubernetes-auth configuration name in + Akeyless-Gateway + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Akeyless. If a name is specified without a key, + `token` is the default. If one is not specified, + the one bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Akeyless. If the service account selector is + not supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - accessID + - k8sConfName + type: object + secretRef: + description: Reference to a Secret that contains the details + to authenticate with Akeyless. + properties: + accessID: + description: The SecretAccessID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessType: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessTypeParam: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + caBundle: + description: PEM/base64 encoded CA bundle used to validate + Akeyless Gateway certificate. Only used if the AkeylessGWApiURL + URL is using HTTPS protocol. If not set the system root + certificates are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Akeyless Gateway certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. Can + only be defined when used in a ClusterSecretStore. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + required: + - akeylessGWApiURL + - authSecretRef + type: object + alibaba: + description: Alibaba configures this store to sync secrets using + Alibaba Cloud provider + properties: + auth: + description: AlibabaAuth contains a secretRef for credentials. + properties: + rrsa: + description: Authenticate against Alibaba using RRSA. + properties: + oidcProviderArn: + type: string + oidcTokenFilePath: + type: string + roleArn: + type: string + sessionName: + type: string + required: + - oidcProviderArn + - oidcTokenFilePath + - roleArn + - sessionName + type: object + secretRef: + description: AlibabaAuthSecretRef holds secret references + for Alibaba credentials. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + accessKeySecretSecretRef: + description: The AccessKeySecret is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - accessKeyIDSecretRef + - accessKeySecretSecretRef + type: object + type: object + regionID: + description: Alibaba Region to be used for the provider + type: string + required: + - auth + - regionID + type: object + aws: + description: AWS configures this store to sync secrets using AWS + Secret Manager provider + properties: + additionalRoles: + description: AdditionalRoles is a chained list of Role ARNs + which the SecretManager provider will sequentially assume + before assuming Role + items: + type: string + type: array + auth: + description: 'Auth defines the information necessary to authenticate + against AWS if not set aws sdk will infer credentials from + your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials' + properties: + jwt: + description: Authenticate against AWS using service account + tokens. + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + type: object + secretRef: + description: AWSAuthSecretRef holds secret references + for AWS credentials both AccessKeyID and SecretAccessKey + must be defined in order to properly authenticate. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + sessionTokenSecretRef: + description: 'The SessionToken used for authentication + This must be defined if AccessKeyID and SecretAccessKey + are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html' + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + externalID: + description: AWS External ID set on assumed IAM roles + type: string + region: + description: AWS Region to be used for the provider + type: string + role: + description: Role is a Role ARN which the SecretManager provider + will assume + type: string + service: + description: Service defines which service should be used + to fetch the secrets + enum: + - SecretsManager + - ParameterStore + type: string + sessionTags: + description: AWS STS assume role session tags + items: + properties: + key: + type: string + value: + type: string + required: + - key + - value + type: object + type: array + transitiveTagKeys: + description: AWS STS assume role transitive session tags. + Required when multiple rules are used with SecretStore + items: + type: string + type: array + required: + - region + - service + type: object + azurekv: + description: AzureKV configures this store to sync secrets using + Azure Key Vault provider + properties: + authSecretRef: + description: Auth configures how the operator authenticates + with Azure. Required for ServicePrincipal auth type. + properties: + clientId: + description: The Azure clientId of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + clientSecret: + description: The Azure ClientSecret of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + authType: + default: ServicePrincipal + description: 'Auth type defines how to authenticate to the + keyvault service. Valid values are: - "ServicePrincipal" + (default): Using a service principal (tenantId, clientId, + clientSecret) - "ManagedIdentity": Using Managed Identity + assigned to the pod (see aad-pod-identity)' + enum: + - ServicePrincipal + - ManagedIdentity + - WorkloadIdentity + type: string + environmentType: + default: PublicCloud + description: 'EnvironmentType specifies the Azure cloud environment + endpoints to use for connecting and authenticating with + Azure. By default it points to the public cloud AAD endpoint. + The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 + PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud' + enum: + - PublicCloud + - USGovernmentCloud + - ChinaCloud + - GermanCloud + type: string + identityId: + description: If multiple Managed Identity is assigned to the + pod, you can select the one to be used + type: string + serviceAccountRef: + description: ServiceAccountRef specified the service account + that should be used when authenticating with WorkloadIdentity. + properties: + audiences: + description: Audience specifies the `aud` claim for the + service account token If the service account uses a + well-known annotation for e.g. IRSA or GCP Workload + Identity then this audiences will be appended to the + list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + tenantId: + description: TenantID configures the Azure Tenant to send + requests to. Required for ServicePrincipal auth type. + type: string + vaultUrl: + description: Vault Url from which the secrets to be fetched + from. + type: string + required: + - vaultUrl + type: object + conjur: + description: Conjur configures this store to sync secrets using + conjur provider + properties: + auth: + properties: + apikey: + properties: + account: + type: string + apiKeyRef: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + userRef: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - account + - apiKeyRef + - userRef + type: object + required: + - apikey + type: object + caBundle: + type: string + url: + type: string + required: + - auth + - url + type: object + delinea: + description: Delinea DevOps Secrets Vault https://docs.delinea.com/online-help/products/devops-secrets-vault/current + properties: + clientId: + description: ClientID is the non-secret part of the credential. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + clientSecret: + description: ClientSecret is the secret part of the credential. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + tenant: + description: Tenant is the chosen hostname / site name. + type: string + tld: + description: TLD is based on the server location that was + chosen during provisioning. If unset, defaults to "com". + type: string + urlTemplate: + description: URLTemplate If unset, defaults to "https://%s.secretsvaultcloud.%s/v1/%s%s". + type: string + required: + - clientId + - clientSecret + - tenant + type: object + doppler: + description: Doppler configures this store to sync secrets using + the Doppler provider + properties: + auth: + description: Auth configures how the Operator authenticates + with the Doppler API + properties: + secretRef: + properties: + dopplerToken: + description: The DopplerToken is used for authentication. + See https://docs.doppler.com/reference/api#authentication + for auth token types. The Key attribute defaults + to dopplerToken if not specified. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - dopplerToken + type: object + required: + - secretRef + type: object + config: + description: Doppler config (required if not using a Service + Token) + type: string + format: + description: Format enables the downloading of secrets as + a file (string) + enum: + - json + - dotnet-json + - env + - yaml + - docker + type: string + nameTransformer: + description: Environment variable compatible name transforms + that change secret names to a different format + enum: + - upper-camel + - camel + - lower-snake + - tf-var + - dotnet-env + - lower-kebab + type: string + project: + description: Doppler project (required if not using a Service + Token) + type: string + required: + - auth + type: object + fake: + description: Fake configures a store with static key/value pairs + properties: + data: + items: + properties: + key: + type: string + value: + type: string + valueMap: + additionalProperties: + type: string + type: object + version: + type: string + required: + - key + type: object + type: array + required: + - data + type: object + gcpsm: + description: GCPSM configures this store to sync secrets using + Google Cloud Platform Secret Manager provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against GCP + properties: + secretRef: + properties: + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + workloadIdentity: + properties: + clusterLocation: + type: string + clusterName: + type: string + clusterProjectID: + type: string + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - clusterLocation + - clusterName + - serviceAccountRef + type: object + type: object + projectID: + description: ProjectID project where secret is located + type: string + type: object + gitlab: + description: GitLab configures this store to sync secrets using + GitLab Variables provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a GitLab instance. + properties: + SecretRef: + properties: + accessToken: + description: AccessToken is used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + required: + - SecretRef + type: object + environment: + description: Environment environment_scope of gitlab CI/CD + variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment + on how to create environments) + type: string + groupIDs: + description: GroupIDs specify, which gitlab groups to pull + secrets from. Group secrets are read from left to right + followed by the project variables. + items: + type: string + type: array + inheritFromGroups: + description: InheritFromGroups specifies whether parent groups + should be discovered and checked for secrets. + type: boolean + projectID: + description: ProjectID specifies a project where secrets are + located. + type: string + url: + description: URL configures the GitLab instance URL. Defaults + to https://gitlab.com/. + type: string + required: + - auth + type: object + ibm: + description: IBM configures this store to sync secrets using IBM + Cloud provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the IBM secrets manager. + maxProperties: 1 + minProperties: 1 + properties: + containerAuth: + description: IBM Container-based auth with IAM Trusted + Profile. + properties: + iamEndpoint: + type: string + profile: + description: the IBM Trusted Profile + type: string + tokenLocation: + description: Location the token is mounted on the + pod + type: string + required: + - profile + type: object + secretRef: + properties: + secretApiKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + serviceUrl: + description: ServiceURL is the Endpoint URL that is specific + to the Secrets Manager service instance + type: string + required: + - auth + type: object + keepersecurity: + description: KeeperSecurity configures this store to sync secrets + using the KeeperSecurity provider + properties: + authRef: + description: A reference to a specific 'key' within a Secret + resource, In some instances, `key` is a required field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this field + may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being referred + to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + folderID: + type: string + required: + - authRef + - folderID + type: object + kubernetes: + description: Kubernetes configures this store to sync secrets + using a Kubernetes cluster provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with a Kubernetes instance. + maxProperties: 1 + minProperties: 1 + properties: + cert: + description: has both clientCert and clientKey as secretKeySelector + properties: + clientCert: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + clientKey: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + serviceAccount: + description: points to a service account that should be + used for authentication + properties: + audiences: + description: Audience specifies the `aud` claim for + the service account token If the service account + uses a well-known annotation for e.g. IRSA or GCP + Workload Identity then this audiences will be appended + to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + token: + description: use static token to authenticate with + properties: + bearerToken: + description: A reference to a specific 'key' within + a Secret resource, In some instances, `key` is a + required field. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + type: object + remoteNamespace: + default: default + description: Remote namespace to fetch the secrets from + type: string + server: + description: configures the Kubernetes server Address. + properties: + caBundle: + description: CABundle is a base64-encoded CA certificate + format: byte + type: string + caProvider: + description: 'see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider' + properties: + key: + description: The key where the CA certificate can + be found in the Secret or ConfigMap. + type: string + name: + description: The name of the object located at the + provider type. + type: string + namespace: + description: The namespace the Provider type is in. + Can only be defined when used in a ClusterSecretStore. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + url: + default: kubernetes.default + description: configures the Kubernetes server Address. + type: string + type: object + required: + - auth + type: object + onepassword: + description: OnePassword configures this store to sync secrets + using the 1Password Cloud provider + properties: + auth: + description: Auth defines the information necessary to authenticate + against OnePassword Connect Server + properties: + secretRef: + description: OnePasswordAuthSecretRef holds secret references + for 1Password credentials. + properties: + connectTokenSecretRef: + description: The ConnectToken is used for authentication + to a 1Password Connect Server. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - connectTokenSecretRef + type: object + required: + - secretRef + type: object + connectHost: + description: ConnectHost defines the OnePassword Connect Server + to connect to + type: string + vaults: + additionalProperties: + type: integer + description: Vaults defines which OnePassword vaults to search + in which order + type: object + required: + - auth + - connectHost + - vaults + type: object + oracle: + description: Oracle configures this store to sync secrets using + Oracle Vault provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Oracle Vault. If empty, use the instance principal, + otherwise the user credentials specified in Auth. + properties: + secretRef: + description: SecretRef to pass through sensitive information. + properties: + fingerprint: + description: Fingerprint is the fingerprint of the + API private key. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + privatekey: + description: PrivateKey is the user's API Signing + Key in PEM format, used for authentication. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - fingerprint + - privatekey + type: object + tenancy: + description: Tenancy is the tenancy OCID where user is + located. + type: string + user: + description: User is an access OCID specific to the account. + type: string + required: + - secretRef + - tenancy + - user + type: object + region: + description: Region is the region where vault is located. + type: string + vault: + description: Vault is the vault's OCID of the specific vault + where secret is located. + type: string + required: + - region + - vault + type: object + scaleway: + description: Scaleway + properties: + accessKey: + description: AccessKey is the non-secret part of the api key. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + apiUrl: + description: APIURL is the url of the api to use. Defaults + to https://api.scaleway.com + type: string + projectId: + description: 'ProjectID is the id of your project, which you + can find in the console: https://console.scaleway.com/project/settings' + type: string + region: + description: 'Region where your secrets are located: https://developers.scaleway.com/en/quickstart/#region-and-zone' + type: string + secretKey: + description: SecretKey is the non-secret part of the api key. + properties: + secretRef: + description: SecretRef references a key in a secret that + will be used as value. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + value: + description: Value can be specified directly to set a + value without using a secret. + type: string + type: object + required: + - accessKey + - projectId + - region + - secretKey + type: object + senhasegura: + description: Senhasegura configures this store to sync secrets + using senhasegura provider + properties: + auth: + description: Auth defines parameters to authenticate in senhasegura + properties: + clientId: + type: string + clientSecretSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + required: + - clientId + - clientSecretSecretRef + type: object + ignoreSslCertificate: + default: false + description: IgnoreSslCertificate defines if SSL certificate + must be ignored + type: boolean + module: + description: Module defines which senhasegura module should + be used to get secrets + type: string + url: + description: URL of senhasegura + type: string + required: + - auth + - module + - url + type: object + vault: + description: Vault configures this store to sync secrets using + Hashi provider + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Vault server. + properties: + appRole: + description: AppRole authenticates with Vault using the + App Role auth mechanism, with the role and secret stored + in a Kubernetes Secret resource. + properties: + path: + default: approle + description: 'Path where the App Role authentication + backend is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication + backend when setting up the authentication backend + in Vault. + type: string + roleRef: + description: Reference to a key in a Secret that contains + the App Role ID used to authenticate with Vault. + The `key` field must be specified and denotes which + entry within the Secret resource is used as the + app role id. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretRef: + description: Reference to a key in a Secret that contains + the App Role secret used to authenticate with Vault. + The `key` field must be specified and denotes which + entry within the Secret resource is used as the + app role secret. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + - secretRef + type: object + cert: + description: Cert authenticates with TLS Certificates + by passing client certificate, private key and ca certificate + Cert authentication method + properties: + clientCert: + description: ClientCert is a certificate to authenticate + using the Cert Vault authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretRef: + description: SecretRef to a key in a Secret resource + containing client private key to authenticate with + Vault using the Cert authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + iam: + description: Iam authenticates with vault by passing a + special AWS request signed with AWS IAM credentials + AWS IAM authentication method + properties: + externalID: + description: AWS External ID set on assumed IAM roles + type: string + jwt: + description: Specify a service account with IRSA enabled + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` + claim for the service account token If the + service account uses a well-known annotation + for e.g. IRSA or GCP Workload Identity then + this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + required: + - name + type: object + type: object + path: + description: 'Path where the AWS auth method is enabled + in Vault, e.g: "aws"' + type: string + region: + description: AWS region + type: string + role: + description: This is the AWS role to be assumed before + talking to vault + type: string + secretRef: + description: Specify credentials in a Secret object + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some + instances of this field may be defaulted, + in others it may be required. + type: string + name: + description: The name of the Secret resource + being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some + instances of this field may be defaulted, + in others it may be required. + type: string + name: + description: The name of the Secret resource + being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + type: object + sessionTokenSecretRef: + description: 'The SessionToken used for authentication + This must be defined if AccessKeyID and SecretAccessKey + are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html' + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some + instances of this field may be defaulted, + in others it may be required. + type: string + name: + description: The name of the Secret resource + being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + type: object + type: object + vaultAwsIamServerID: + description: 'X-Vault-AWS-IAM-Server-ID is an additional + header used by Vault IAM auth method to mitigate + against different types of replay attacks. More + details here: https://developer.hashicorp.com/vault/docs/auth/aws' + type: string + vaultRole: + description: Vault Role. In vault, a role describes + an identity with a set of permissions, groups, or + policies you want to attach a user of the secrets + engine + type: string + required: + - vaultRole + type: object + jwt: + description: Jwt authenticates with Vault by passing role + and JWT token using the JWT/OIDC authentication method + properties: + kubernetesServiceAccountToken: + description: Optional ServiceAccountToken specifies + the Kubernetes service account for which to request + a token for with the `TokenRequest` API. + properties: + audiences: + description: 'Optional audiences field that will + be used to request a temporary Kubernetes service + account token for the service account referenced + by `serviceAccountRef`. Defaults to a single + audience `vault` it not specified. Deprecated: + use serviceAccountRef.Audiences instead' + items: + type: string + type: array + expirationSeconds: + description: 'Optional expiration time in seconds + that will be used to request a temporary Kubernetes + service account token for the service account + referenced by `serviceAccountRef`. Deprecated: + this will be removed in the future. Defaults + to 10 minutes.' + format: int64 + type: integer + serviceAccountRef: + description: Service account field containing + the name of a kubernetes ServiceAccount. + properties: + audiences: + description: Audience specifies the `aud` + claim for the service account token If the + service account uses a well-known annotation + for e.g. IRSA or GCP Workload Identity then + this audiences will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount + resource being referred to. + type: string + namespace: + description: Namespace of the resource being + referred to. Ignored if referent is not + cluster-scoped. cluster-scoped defaults + to the namespace of the referent. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + path: + default: jwt + description: 'Path where the JWT authentication backend + is mounted in Vault, e.g: "jwt"' + type: string + role: + description: Role is a JWT role to authenticate using + the JWT/OIDC Vault authentication method + type: string + secretRef: + description: Optional SecretRef that refers to a key + in a Secret resource containing JWT token to authenticate + with Vault using the JWT/OIDC authentication method. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + required: + - path + type: object + kubernetes: + description: Kubernetes authenticates with Vault by passing + the ServiceAccount token stored in the named Secret + resource to the Vault server. + properties: + mountPath: + default: kubernetes + description: 'Path where the Kubernetes authentication + backend is mounted in Vault, e.g: "kubernetes"' + type: string + role: + description: A required field containing the Vault + Role to assume. A Role binds a Kubernetes ServiceAccount + with a set of Vault policies. + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with + Vault. If a name is specified without a key, `token` + is the default. If one is not specified, the one + bound to the controller will be used. + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the + service account is specified, the service account + secret token JWT will be used for authenticating + with Vault. If the service account selector is not + supplied, the secretRef will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - mountPath + - role + type: object + ldap: + description: Ldap authenticates with Vault by passing + username/password pair using the LDAP authentication + method + properties: + path: + default: ldap + description: 'Path where the LDAP authentication backend + is mounted in Vault, e.g: "ldap"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource + containing password for the LDAP user used to authenticate + with Vault using the LDAP authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + username: + description: Username is a LDAP user name used to + authenticate using the LDAP Vault authentication + method + type: string + required: + - path + - username + type: object + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by + presenting a token. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + userPass: + description: UserPass authenticates with Vault by passing + username/password pair + properties: + path: + default: user + description: 'Path where the UserPassword authentication + backend is mounted in Vault, e.g: "user"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource + containing password for the user used to authenticate + with Vault using the UserPass authentication method + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + username: + description: Username is a user name used to authenticate + using the UserPass Vault authentication method + type: string + required: + - path + - username + type: object + type: object + caBundle: + description: PEM encoded CA bundle used to validate Vault + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Vault server certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. Can + only be defined when used in a ClusterSecretStore. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + forwardInconsistent: + description: ForwardInconsistent tells Vault to forward read-after-write + requests to the Vault leader instead of simply retrying + within a loop. This can increase performance if the option + is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header + type: boolean + namespace: + description: 'Name of the vault namespace. Namespaces is a + set of features within Vault Enterprise that allows Vault + environments to support Secure Multi-tenancy. e.g: "ns1". + More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault KV backend + endpoint, e.g: "secret". The v2 KV secret engine version + specific "/data" path suffix for fetching secrets from Vault + is optional and will be appended if not present in specified + path.' + type: string + readYourWrites: + description: ReadYourWrites ensures isolated read-after-write + semantics by providing discovered cluster replication states + in each request. More information about eventual consistency + in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency + type: boolean + server: + description: 'Server is the connection address for the Vault + server, e.g: "https://vault.example.com:8200".' + type: string + version: + default: v2 + description: Version is the Vault KV secret engine version. + This can be either "v1" or "v2". Version defaults to "v2". + enum: + - v1 + - v2 + type: string + required: + - auth + - server + type: object + webhook: + description: Webhook configures this store to sync secrets using + a generic templated webhook + properties: + body: + description: Body + type: string + caBundle: + description: PEM encoded CA bundle used to validate webhook + server certificate. Only used if the Server URL is using + HTTPS protocol. This parameter is ignored for plain HTTP + protocol connection. If not set the system root certificates + are used to validate the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + webhook server certificate. + properties: + key: + description: The key the value inside of the provider + type to use, only used with "Secret" type + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + headers: + additionalProperties: + type: string + description: Headers + type: object + method: + description: Webhook Method + type: string + result: + description: Result formatting + properties: + jsonPath: + description: Json path of return value + type: string + type: object + secrets: + description: Secrets to fill in templates These secrets will + be passed to the templating function as key value pairs + under the given name + items: + properties: + name: + description: Name of this secret in templates + type: string + secretRef: + description: Secret ref to fill in credentials + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it may + be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of the + referent. + type: string + type: object + required: + - name + - secretRef + type: object + type: array + timeout: + description: Timeout + type: string + url: + description: Webhook url to call + type: string + required: + - result + - url + type: object + yandexcertificatemanager: + description: YandexCertificateManager configures this store to + sync secrets using Yandex Certificate Manager provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Certificate Manager + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + required: + - auth + type: object + yandexlockbox: + description: YandexLockbox configures this store to sync secrets + using Yandex Lockbox provider + properties: + apiEndpoint: + description: Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443') + type: string + auth: + description: Auth defines the information necessary to authenticate + against Yandex Lockbox + properties: + authorizedKeySecretRef: + description: The authorized key used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + caProvider: + description: The provider for the CA bundle to use to validate + Yandex.Cloud server certificate. + properties: + certSecretRef: + description: A reference to a specific 'key' within a + Secret resource, In some instances, `key` is a required + field. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + required: + - auth + type: object + type: object + refreshInterval: + description: Used to configure store refresh interval in seconds. + Empty or 0 will default to the controller config. + type: integer + retrySettings: + description: Used to configure http retries if failed + properties: + maxRetries: + format: int32 + type: integer + retryInterval: + type: string + type: object + required: + - provider + type: object + status: + description: SecretStoreStatus defines the observed state of the SecretStore. + properties: + capabilities: + description: SecretStoreCapabilities defines the possible operations + a SecretStore can do. + type: string + conditions: + items: + properties: + lastTransitionTime: + format: date-time + type: string + message: + type: string + reason: + type: string + status: + type: string + type: + type: string + required: + - status + - type + type: object + type: array + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_acraccesstokens.yaml b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_acraccesstokens.yaml new file mode 100644 index 00000000000..486b9cc1935 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_acraccesstokens.yaml @@ -0,0 +1,189 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: acraccesstokens.generators.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: generators.external-secrets.io + names: + categories: + - acraccesstoken + kind: ACRAccessToken + listKind: ACRAccessTokenList + plural: acraccesstokens + shortNames: + - acraccesstoken + singular: acraccesstoken + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: "ACRAccessToken returns a Azure Container Registry token that + can be used for pushing/pulling images. Note: by default it will return + an ACR Refresh Token with full access (depending on the identity). This + can be scoped down to the repository level using .spec.scope. In case scope + is defined it will return an ACR Access Token. \n See docs: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md" + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: 'ACRAccessTokenSpec defines how to generate the access token + e.g. how to authenticate and which registry to use. see: https://github.com/Azure/acr/blob/main/docs/AAD-OAuth.md#overview' + properties: + auth: + properties: + managedIdentity: + description: ManagedIdentity uses Azure Managed Identity to authenticate + with Azure. + properties: + identityId: + description: If multiple Managed Identity is assigned to the + pod, you can select the one to be used + type: string + type: object + servicePrincipal: + description: ServicePrincipal uses Azure Service Principal credentials + to authenticate with Azure. + properties: + secretRef: + description: Configuration used to authenticate with Azure + using static credentials stored in a Kind=Secret. + properties: + clientId: + description: The Azure clientId of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + clientSecret: + description: The Azure ClientSecret of the service principle + used for authentication. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + required: + - secretRef + type: object + workloadIdentity: + description: WorkloadIdentity uses Azure Workload Identity to + authenticate with Azure. + properties: + serviceAccountRef: + description: ServiceAccountRef specified the service account + that should be used when authenticating with WorkloadIdentity. + properties: + audiences: + description: Audience specifies the `aud` claim for the + service account token If the service account uses a + well-known annotation for e.g. IRSA or GCP Workload + Identity then this audiences will be appended to the + list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + type: object + type: object + environmentType: + default: PublicCloud + description: 'EnvironmentType specifies the Azure cloud environment + endpoints to use for connecting and authenticating with Azure. By + default it points to the public cloud AAD endpoint. The following + endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 + PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud' + enum: + - PublicCloud + - USGovernmentCloud + - ChinaCloud + - GermanCloud + type: string + registry: + description: the domain name of the ACR registry e.g. foobarexample.azurecr.io + type: string + scope: + description: "Define the scope for the access token, e.g. pull/push + access for a repository. if not provided it will return a refresh + token that has full scope. Note: you need to pin it down to the + repository level, there is no wildcard available. \n examples: repository:my-repository:pull,push + repository:my-repository:pull \n see docs for details: https://docs.docker.com/registry/spec/auth/scope/" + type: string + tenantId: + description: TenantID configures the Azure Tenant to send requests + to. Required for ServicePrincipal auth type. + type: string + required: + - auth + - registry + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_ecrauthorizationtokens.yaml b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_ecrauthorizationtokens.yaml new file mode 100644 index 00000000000..05219afedf4 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_ecrauthorizationtokens.yaml @@ -0,0 +1,169 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: ecrauthorizationtokens.generators.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: generators.external-secrets.io + names: + categories: + - ecrauthorizationtoken + kind: ECRAuthorizationToken + listKind: ECRAuthorizationTokenList + plural: ecrauthorizationtokens + shortNames: + - ecrauthorizationtoken + singular: ecrauthorizationtoken + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: ECRAuthorizationTokenSpec uses the GetAuthorizationToken API + to retrieve an authorization token. The authorization token is valid for + 12 hours. The authorizationToken returned is a base64 encoded string that + can be decoded and used in a docker login command to authenticate to a registry. + For more information, see Registry authentication (https://docs.aws.amazon.com/AmazonECR/latest/userguide/Registries.html#registry_auth) + in the Amazon Elastic Container Registry User Guide. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + auth: + description: Auth defines how to authenticate with AWS + properties: + jwt: + description: Authenticate against AWS using service account tokens. + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim for the + service account token If the service account uses a + well-known annotation for e.g. IRSA or GCP Workload + Identity then this audiences will be appended to the + list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + type: object + secretRef: + description: AWSAuthSecretRef holds secret references for AWS + credentials both AccessKeyID and SecretAccessKey must be defined + in order to properly authenticate. + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this field + may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being referred + to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this field + may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being referred + to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + sessionTokenSecretRef: + description: 'The SessionToken used for authentication This + must be defined if AccessKeyID and SecretAccessKey are temporary + credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html' + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this field + may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being referred + to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + type: object + region: + description: Region specifies the region to operate in. + type: string + role: + description: You can assume a role before making calls to the desired + AWS service. + type: string + required: + - region + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_fakes.yaml b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_fakes.yaml new file mode 100644 index 00000000000..61ce2195ea3 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_fakes.yaml @@ -0,0 +1,73 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: fakes.generators.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: generators.external-secrets.io + names: + categories: + - fake + kind: Fake + listKind: FakeList + plural: fakes + shortNames: + - fake + singular: fake + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Fake generator is used for testing. It lets you define a static + set of credentials that is always returned. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: FakeSpec contains the static data. + properties: + controller: + description: 'Used to select the correct ESO controller (think: ingress.ingressClassName) + The ESO controller is instantiated with a specific controller name + and filters VDS based on this property' + type: string + data: + additionalProperties: + type: string + description: Data defines the static data returned by this generator. + type: object + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_gcraccesstokens.yaml b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_gcraccesstokens.yaml new file mode 100644 index 00000000000..a8860f150ae --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_gcraccesstokens.yaml @@ -0,0 +1,131 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: gcraccesstokens.generators.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: generators.external-secrets.io + names: + categories: + - gcraccesstoken + kind: GCRAccessToken + listKind: GCRAccessTokenList + plural: gcraccesstokens + shortNames: + - gcraccesstoken + singular: gcraccesstoken + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: GCRAccessToken generates an GCP access token that can be used + to authenticate with GCR. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + auth: + description: Auth defines the means for authenticating with GCP + properties: + secretRef: + properties: + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this field + may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being referred + to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + workloadIdentity: + properties: + clusterLocation: + type: string + clusterName: + type: string + clusterProjectID: + type: string + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim for the + service account token If the service account uses a + well-known annotation for e.g. IRSA or GCP Workload + Identity then this audiences will be appended to the + list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + required: + - clusterLocation + - clusterName + - serviceAccountRef + type: object + type: object + projectID: + description: ProjectID defines which project to use to authenticate + with + type: string + required: + - auth + - projectID + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_passwords.yaml b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_passwords.yaml new file mode 100644 index 00000000000..1e64fc5dbf0 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_passwords.yaml @@ -0,0 +1,92 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: passwords.generators.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: generators.external-secrets.io + names: + categories: + - password + kind: Password + listKind: PasswordList + plural: passwords + shortNames: + - password + singular: password + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: Password generates a random password based on the configuration + parameters in spec. You can specify the length, characterset and other attributes. + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: PasswordSpec controls the behavior of the password generator. + properties: + allowRepeat: + default: false + description: set AllowRepeat to true to allow repeating characters. + type: boolean + digits: + description: Digits specifies the number of digits in the generated + password. If omitted it defaults to 25% of the length of the password + type: integer + length: + default: 24 + description: Length of the password to be generated. Defaults to 24 + type: integer + noUpper: + default: false + description: Set NoUpper to disable uppercase characters + type: boolean + symbolCharacters: + description: SymbolCharacters specifies the special characters that + should be used in the generated password. + type: string + symbols: + description: Symbols specifies the number of symbol characters in + the generated password. If omitted it defaults to 25% of the length + of the password + type: integer + required: + - allowRepeat + - length + - noUpper + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_vaultdynamicsecrets.yaml b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_vaultdynamicsecrets.yaml new file mode 100644 index 00000000000..8dced65591e --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/generators.external-secrets.io_vaultdynamicsecrets.yaml @@ -0,0 +1,653 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.12.1 + creationTimestamp: null + name: vaultdynamicsecrets.generators.external-secrets.io +spec: + conversion: + strategy: Webhook + webhook: + clientConfig: + service: + name: kubernetes + namespace: default + path: /convert + conversionReviewVersions: + - v1 + group: generators.external-secrets.io + names: + categories: + - vaultdynamicsecret + kind: VaultDynamicSecret + listKind: VaultDynamicSecretList + plural: vaultdynamicsecrets + shortNames: + - vaultdynamicsecret + singular: vaultdynamicsecret + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + properties: + controller: + description: 'Used to select the correct ESO controller (think: ingress.ingressClassName) + The ESO controller is instantiated with a specific controller name + and filters VDS based on this property' + type: string + method: + description: Vault API method to use (GET/POST/other) + type: string + parameters: + description: Parameters to pass to Vault write (for non-GET methods) + x-kubernetes-preserve-unknown-fields: true + path: + description: Vault path to obtain the dynamic secret from + type: string + provider: + description: Vault provider common spec + properties: + auth: + description: Auth configures how secret-manager authenticates + with the Vault server. + properties: + appRole: + description: AppRole authenticates with Vault using the App + Role auth mechanism, with the role and secret stored in + a Kubernetes Secret resource. + properties: + path: + default: approle + description: 'Path where the App Role authentication backend + is mounted in Vault, e.g: "approle"' + type: string + roleId: + description: RoleID configured in the App Role authentication + backend when setting up the authentication backend in + Vault. + type: string + roleRef: + description: Reference to a key in a Secret that contains + the App Role ID used to authenticate with Vault. The + `key` field must be specified and denotes which entry + within the Secret resource is used as the app role id. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + secretRef: + description: Reference to a key in a Secret that contains + the App Role secret used to authenticate with Vault. + The `key` field must be specified and denotes which + entry within the Secret resource is used as the app + role secret. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + required: + - path + - secretRef + type: object + cert: + description: Cert authenticates with TLS Certificates by passing + client certificate, private key and ca certificate Cert + authentication method + properties: + clientCert: + description: ClientCert is a certificate to authenticate + using the Cert Vault authentication method + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + secretRef: + description: SecretRef to a key in a Secret resource containing + client private key to authenticate with Vault using + the Cert authentication method + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + type: object + iam: + description: Iam authenticates with vault by passing a special + AWS request signed with AWS IAM credentials AWS IAM authentication + method + properties: + externalID: + description: AWS External ID set on assumed IAM roles + type: string + jwt: + description: Specify a service account with IRSA enabled + properties: + serviceAccountRef: + description: A reference to a ServiceAccount resource. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + type: object + path: + description: 'Path where the AWS auth method is enabled + in Vault, e.g: "aws"' + type: string + region: + description: AWS region + type: string + role: + description: This is the AWS role to be assumed before + talking to vault + type: string + secretRef: + description: Specify credentials in a Secret object + properties: + accessKeyIDSecretRef: + description: The AccessKeyID is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + secretAccessKeySecretRef: + description: The SecretAccessKey is used for authentication + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + sessionTokenSecretRef: + description: 'The SessionToken used for authentication + This must be defined if AccessKeyID and SecretAccessKey + are temporary credentials see: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html' + properties: + key: + description: The key of the entry in the Secret + resource's `data` field to be used. Some instances + of this field may be defaulted, in others it + may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + type: object + type: object + vaultAwsIamServerID: + description: 'X-Vault-AWS-IAM-Server-ID is an additional + header used by Vault IAM auth method to mitigate against + different types of replay attacks. More details here: + https://developer.hashicorp.com/vault/docs/auth/aws' + type: string + vaultRole: + description: Vault Role. In vault, a role describes an + identity with a set of permissions, groups, or policies + you want to attach a user of the secrets engine + type: string + required: + - vaultRole + type: object + jwt: + description: Jwt authenticates with Vault by passing role + and JWT token using the JWT/OIDC authentication method + properties: + kubernetesServiceAccountToken: + description: Optional ServiceAccountToken specifies the + Kubernetes service account for which to request a token + for with the `TokenRequest` API. + properties: + audiences: + description: 'Optional audiences field that will be + used to request a temporary Kubernetes service account + token for the service account referenced by `serviceAccountRef`. + Defaults to a single audience `vault` it not specified. + Deprecated: use serviceAccountRef.Audiences instead' + items: + type: string + type: array + expirationSeconds: + description: 'Optional expiration time in seconds + that will be used to request a temporary Kubernetes + service account token for the service account referenced + by `serviceAccountRef`. Deprecated: this will be + removed in the future. Defaults to 10 minutes.' + format: int64 + type: integer + serviceAccountRef: + description: Service account field containing the + name of a kubernetes ServiceAccount. + properties: + audiences: + description: Audience specifies the `aud` claim + for the service account token If the service + account uses a well-known annotation for e.g. + IRSA or GCP Workload Identity then this audiences + will be appended to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. + cluster-scoped defaults to the namespace of + the referent. + type: string + required: + - name + type: object + required: + - serviceAccountRef + type: object + path: + default: jwt + description: 'Path where the JWT authentication backend + is mounted in Vault, e.g: "jwt"' + type: string + role: + description: Role is a JWT role to authenticate using + the JWT/OIDC Vault authentication method + type: string + secretRef: + description: Optional SecretRef that refers to a key in + a Secret resource containing JWT token to authenticate + with Vault using the JWT/OIDC authentication method. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + required: + - path + type: object + kubernetes: + description: Kubernetes authenticates with Vault by passing + the ServiceAccount token stored in the named Secret resource + to the Vault server. + properties: + mountPath: + default: kubernetes + description: 'Path where the Kubernetes authentication + backend is mounted in Vault, e.g: "kubernetes"' + type: string + role: + description: A required field containing the Vault Role + to assume. A Role binds a Kubernetes ServiceAccount + with a set of Vault policies. + type: string + secretRef: + description: Optional secret field containing a Kubernetes + ServiceAccount JWT used for authenticating with Vault. + If a name is specified without a key, `token` is the + default. If one is not specified, the one bound to the + controller will be used. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + serviceAccountRef: + description: Optional service account field containing + the name of a kubernetes ServiceAccount. If the service + account is specified, the service account secret token + JWT will be used for authenticating with Vault. If the + service account selector is not supplied, the secretRef + will be used instead. + properties: + audiences: + description: Audience specifies the `aud` claim for + the service account token If the service account + uses a well-known annotation for e.g. IRSA or GCP + Workload Identity then this audiences will be appended + to the list + items: + type: string + type: array + name: + description: The name of the ServiceAccount resource + being referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + required: + - name + type: object + required: + - mountPath + - role + type: object + ldap: + description: Ldap authenticates with Vault by passing username/password + pair using the LDAP authentication method + properties: + path: + default: ldap + description: 'Path where the LDAP authentication backend + is mounted in Vault, e.g: "ldap"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource containing + password for the LDAP user used to authenticate with + Vault using the LDAP authentication method + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + username: + description: Username is a LDAP user name used to authenticate + using the LDAP Vault authentication method + type: string + required: + - path + - username + type: object + tokenSecretRef: + description: TokenSecretRef authenticates with Vault by presenting + a token. + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this field + may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being referred + to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + userPass: + description: UserPass authenticates with Vault by passing + username/password pair + properties: + path: + default: user + description: 'Path where the UserPassword authentication + backend is mounted in Vault, e.g: "user"' + type: string + secretRef: + description: SecretRef to a key in a Secret resource containing + password for the user used to authenticate with Vault + using the UserPass authentication method + properties: + key: + description: The key of the entry in the Secret resource's + `data` field to be used. Some instances of this + field may be defaulted, in others it may be required. + type: string + name: + description: The name of the Secret resource being + referred to. + type: string + namespace: + description: Namespace of the resource being referred + to. Ignored if referent is not cluster-scoped. cluster-scoped + defaults to the namespace of the referent. + type: string + type: object + username: + description: Username is a user name used to authenticate + using the UserPass Vault authentication method + type: string + required: + - path + - username + type: object + type: object + caBundle: + description: PEM encoded CA bundle used to validate Vault server + certificate. Only used if the Server URL is using HTTPS protocol. + This parameter is ignored for plain HTTP protocol connection. + If not set the system root certificates are used to validate + the TLS connection. + format: byte + type: string + caProvider: + description: The provider for the CA bundle to use to validate + Vault server certificate. + properties: + key: + description: The key where the CA certificate can be found + in the Secret or ConfigMap. + type: string + name: + description: The name of the object located at the provider + type. + type: string + namespace: + description: The namespace the Provider type is in. Can only + be defined when used in a ClusterSecretStore. + type: string + type: + description: The type of provider to use such as "Secret", + or "ConfigMap". + enum: + - Secret + - ConfigMap + type: string + required: + - name + - type + type: object + forwardInconsistent: + description: ForwardInconsistent tells Vault to forward read-after-write + requests to the Vault leader instead of simply retrying within + a loop. This can increase performance if the option is enabled + serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header + type: boolean + namespace: + description: 'Name of the vault namespace. Namespaces is a set + of features within Vault Enterprise that allows Vault environments + to support Secure Multi-tenancy. e.g: "ns1". More about namespaces + can be found here https://www.vaultproject.io/docs/enterprise/namespaces' + type: string + path: + description: 'Path is the mount path of the Vault KV backend endpoint, + e.g: "secret". The v2 KV secret engine version specific "/data" + path suffix for fetching secrets from Vault is optional and + will be appended if not present in specified path.' + type: string + readYourWrites: + description: ReadYourWrites ensures isolated read-after-write + semantics by providing discovered cluster replication states + in each request. More information about eventual consistency + in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency + type: boolean + server: + description: 'Server is the connection address for the Vault server, + e.g: "https://vault.example.com:8200".' + type: string + version: + default: v2 + description: Version is the Vault KV secret engine version. This + can be either "v1" or "v2". Version defaults to "v2". + enum: + - v1 + - v2 + type: string + required: + - auth + - server + type: object + resultType: + default: Data + description: Result type defines which data is returned from the generator. + By default it is the "data" section of the Vault API response. When + using e.g. /auth/token/create the "data" section is empty but the + "auth" section contains the generated token. Please refer to the + vault docs regarding the result data structure. + type: string + required: + - path + - provider + type: object + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/manifests/operator.external-secrets.io_operatorconfigs.yaml b/operators/external-secrets-operator/0.9.2/manifests/operator.external-secrets.io_operatorconfigs.yaml new file mode 100644 index 00000000000..4da1162aa9a --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/manifests/operator.external-secrets.io_operatorconfigs.yaml @@ -0,0 +1,50 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + creationTimestamp: null + name: operatorconfigs.operator.external-secrets.io +spec: + group: operator.external-secrets.io + names: + kind: OperatorConfig + listKind: OperatorConfigList + plural: operatorconfigs + singular: operatorconfig + scope: Namespaced + versions: + - name: v1alpha1 + schema: + openAPIV3Schema: + description: OperatorConfig is the Schema for the operatorconfigs API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: Spec defines the desired state of OperatorConfig + type: object + x-kubernetes-preserve-unknown-fields: true + status: + description: Status defines the observed state of OperatorConfig + type: object + x-kubernetes-preserve-unknown-fields: true + type: object + served: true + storage: true + subresources: + status: {} +status: + acceptedNames: + kind: "" + plural: "" + conditions: null + storedVersions: null diff --git a/operators/external-secrets-operator/0.9.2/metadata/annotations.yaml b/operators/external-secrets-operator/0.9.2/metadata/annotations.yaml new file mode 100644 index 00000000000..d6b99f7b755 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/metadata/annotations.yaml @@ -0,0 +1,15 @@ +annotations: + # Core bundle annotations. + operators.operatorframework.io.bundle.mediatype.v1: registry+v1 + operators.operatorframework.io.bundle.manifests.v1: manifests/ + operators.operatorframework.io.bundle.metadata.v1: metadata/ + operators.operatorframework.io.bundle.package.v1: external-secrets-operator + operators.operatorframework.io.bundle.channels.v1: alpha,stable + operators.operatorframework.io.bundle.channel.default.v1: alpha + operators.operatorframework.io.metrics.builder: operator-sdk-v1.18.0+git + operators.operatorframework.io.metrics.mediatype.v1: metrics+v1 + operators.operatorframework.io.metrics.project_layout: helm.sdk.operatorframework.io/v1 + + # Annotations for testing. + operators.operatorframework.io.test.mediatype.v1: scorecard+v1 + operators.operatorframework.io.test.config.v1: tests/scorecard/ diff --git a/operators/external-secrets-operator/0.9.2/tests/scorecard/config.yaml b/operators/external-secrets-operator/0.9.2/tests/scorecard/config.yaml new file mode 100644 index 00000000000..14c9f7c3919 --- /dev/null +++ b/operators/external-secrets-operator/0.9.2/tests/scorecard/config.yaml @@ -0,0 +1,70 @@ +apiVersion: scorecard.operatorframework.io/v1alpha3 +kind: Configuration +metadata: + name: config +stages: +- parallel: true + tests: + - entrypoint: + - scorecard-test + - basic-check-spec + image: quay.io/operator-framework/scorecard-test:v1.15.0 + labels: + suite: basic + test: basic-check-spec-test + storage: + spec: + mountPath: {} + - entrypoint: + - scorecard-test + - olm-bundle-validation + image: quay.io/operator-framework/scorecard-test:v1.15.0 + labels: + suite: olm + test: olm-bundle-validation-test + storage: + spec: + mountPath: {} + - entrypoint: + - scorecard-test + - olm-crds-have-validation + image: quay.io/operator-framework/scorecard-test:v1.15.0 + labels: + suite: olm + test: olm-crds-have-validation-test + storage: + spec: + mountPath: {} + - entrypoint: + - scorecard-test + - olm-crds-have-resources + image: quay.io/operator-framework/scorecard-test:v1.15.0 + labels: + suite: olm + test: olm-crds-have-resources-test + storage: + spec: + mountPath: {} + - entrypoint: + - scorecard-test + - olm-spec-descriptors + image: quay.io/operator-framework/scorecard-test:v1.15.0 + labels: + suite: olm + test: olm-spec-descriptors-test + storage: + spec: + mountPath: {} + - entrypoint: + - scorecard-test + - olm-status-descriptors + image: quay.io/operator-framework/scorecard-test:v1.15.0 + labels: + suite: olm + test: olm-status-descriptors-test + storage: + spec: + mountPath: {} +storage: + spec: + mountPath: {}