Gcraccesstoken v1alpha1 — generators.external-secrets.io

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object

GCRAccessTokenSpec defines the desired state to generate a Google Container Registry access token.

auth object required

Auth defines the means for authenticating with GCP

secretRef object

GCPSMAuthSecretRef defines the reference to a secret containing Google Cloud Platform credentials.

secretAccessKeySecretRef object

The SecretAccessKey is used for authentication

key string

A key in the referenced Secret. Some instances of this field may be defaulted, in others it may be required.

pattern: ^[-._a-zA-Z0-9]+$

minLength: 1

maxLength: 253

name string

The name of the Secret resource being referred to.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

minLength: 1

maxLength: 253

namespace string

The namespace of the Secret resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

minLength: 1

maxLength: 63

workloadIdentity object

GCPWorkloadIdentity defines the configuration for using GCP Workload Identity authentication.

clusterLocation string required

clusterName string required

clusterProjectID string

serviceAccountRef object required

ServiceAccountSelector is a reference to a ServiceAccount resource.

audiences []string

Audience specifies the `aud` claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list

name string required

The name of the ServiceAccount resource being referred to.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

minLength: 1

maxLength: 253

namespace string

Namespace of the resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

minLength: 1

maxLength: 63

workloadIdentityFederation object

GCPWorkloadIdentityFederation holds the configurations required for generating federated access tokens.

audience string

audience is the Secure Token Service (STS) audience which contains the resource name for the workload identity pool and the provider identifier in that pool. If specified, Audience found in the external account credential config will be overridden with the configured value. audience must be provided when serviceAccountRef or awsSecurityCredentials is configured.

awsSecurityCredentials object

awsSecurityCredentials is for configuring AWS region and credentials to use for obtaining the access token, when using the AWS metadata server is not an option.

awsCredentialsSecretRef object required

awsCredentialsSecretRef is the reference to the secret which holds the AWS credentials. Secret should be created with below names for keys - aws_access_key_id: Access Key ID, which is the unique identifier for the AWS account or the IAM user. - aws_secret_access_key: Secret Access Key, which is used to authenticate requests made to AWS services. - aws_session_token: Session Token, is the short-lived token to authenticate requests made to AWS services.

name string required

name of the secret.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

minLength: 1

maxLength: 253

namespace string

namespace in which the secret exists. If empty, secret will looked up in local namespace.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

minLength: 1

maxLength: 63

region string required

region is for configuring the AWS region to be used.

pattern: ^[a-z0-9-]+$

minLength: 1

maxLength: 50

credConfig object

credConfig holds the configmap reference containing the GCP external account credential configuration in JSON format and the key name containing the json data. For using Kubernetes cluster as the identity provider, use serviceAccountRef instead. Operators mounted serviceaccount token cannot be used as the token source, instead serviceAccountRef must be used by providing operators service account details.

key string required

key name holding the external account credential config.

pattern: ^[-._a-zA-Z0-9]+$

minLength: 1

maxLength: 253

name string required

name of the configmap.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

minLength: 1

maxLength: 253

namespace string

namespace in which the configmap exists. If empty, configmap will looked up in local namespace.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

minLength: 1

maxLength: 63

externalTokenEndpoint string

externalTokenEndpoint is the endpoint explicitly set up to provide tokens, which will be matched against the credential_source.url in the provided credConfig. This field is merely to double-check the external token source URL is having the expected value.

serviceAccountRef object

serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens, when Kubernetes is configured as provider in workload identity pool.

audiences []string

name string required

The name of the ServiceAccount resource being referred to.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$

minLength: 1

maxLength: 253

namespace string

Namespace of the resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.

pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$

minLength: 1

maxLength: 63

projectID string required

ProjectID defines which project to use to authenticate with