From 15065d1496418b2496c52bda222fc1578e60e6cd Mon Sep 17 00:00:00 2001 From: Jim Martens Date: Sun, 5 Nov 2023 11:20:55 +0100 Subject: [PATCH] Added hcpauth as crd --- .../crds/secrets.hashicorp.com_hcpauths.yaml | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 argocd/vault-secrets-operator-config/test/crds/secrets.hashicorp.com_hcpauths.yaml diff --git a/argocd/vault-secrets-operator-config/test/crds/secrets.hashicorp.com_hcpauths.yaml b/argocd/vault-secrets-operator-config/test/crds/secrets.hashicorp.com_hcpauths.yaml new file mode 100644 index 0000000..0d639f9 --- /dev/null +++ b/argocd/vault-secrets-operator-config/test/crds/secrets.hashicorp.com_hcpauths.yaml @@ -0,0 +1,100 @@ +# Copyright (c) HashiCorp, Inc. +# SPDX-License-Identifier: BUSL-1.1 + +--- +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + controller-gen.kubebuilder.io/version: v0.13.0 + name: hcpauths.secrets.hashicorp.com +spec: + group: secrets.hashicorp.com + names: + kind: HCPAuth + listKind: HCPAuthList + plural: hcpauths + singular: hcpauth + scope: Namespaced + versions: + - name: v1beta1 + schema: + openAPIV3Schema: + description: HCPAuth is the Schema for the hcpauths API + properties: + apiVersion: + description: 'APIVersion defines the versioned schema of this representation + of an object. Servers should convert recognized schemas to the latest + internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources' + type: string + kind: + description: 'Kind is a string value representing the REST resource this + object represents. Servers may infer this from the endpoint the client + submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds' + type: string + metadata: + type: object + spec: + description: HCPAuthSpec defines the desired state of HCPAuth + properties: + allowedNamespaces: + description: 'AllowedNamespaces Kubernetes Namespaces which are allow-listed + for use with this AuthMethod. This field allows administrators to + customize which Kubernetes namespaces are authorized to use with + this AuthMethod. While Vault will still enforce its own rules, this + has the added configurability of restricting which HCPAuthMethods + can be used by which namespaces. Accepted values: []{"*"} - wildcard, + all namespaces. []{"a", "b"} - list of namespaces. unset - disallow + all namespaces except the Operator''s the HCPAuthMethod''s namespace, + this is the default behavior.' + items: + type: string + type: array + method: + default: servicePrincipal + description: Method to use when authenticating to Vault. + enum: + - servicePrincipal + type: string + organizationID: + description: OrganizationID of the HCP organization. + type: string + projectID: + description: ProjectID of the HCP project. + type: string + servicePrincipal: + description: ServicePrincipal provides the necessary configuration + for authenticating to HCP using a service principal. For security + reasons, only project-level service principals should ever be used. + properties: + secretRef: + description: 'SecretRef is the name of a Kubernetes secret in + the consumer''s (VDS/VSS/PKI/HCP) namespace which provides the + HCP ServicePrincipal clientID, and clientSecret. The secret + data must have the following structure { "clientID": "clientID", + "clientSecret": "clientSecret", }' + type: string + required: + - secretRef + type: object + required: + - organizationID + - projectID + type: object + status: + description: HCPAuthStatus defines the observed state of HCPAuth + properties: + error: + type: string + valid: + description: Valid auth mechanism. + type: boolean + required: + - error + - valid + type: object + type: object + served: true + storage: true + subresources: + status: {}