Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Backport of Update VSO docs for v0.9.0 into release/1.17.x #28640

Merged
merged 1 commit into from
Oct 9, 2024
Merged

Backport of Update VSO docs for v0.9.0 into release/1.17.x #28640

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 63 additions & 10 deletions website/content/docs/platform/k8s/vso/api-reference.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@ description: >-

<!--
copied from docs/api/api-reference.md in the vault-secrets-operator repo.
commit SHA=98556e448df1eec4edec6d3f43e403f87fff313a
commit SHA=08a6e5071ffa4faa486bd4b2c53b27585da4680c
-->
# API Reference

Expand Down Expand Up @@ -198,10 +198,63 @@ _Appears in:_
| `refreshAfter` _string_ | RefreshAfter a period of time, in duration notation e.g. 30s, 1m, 24h | 600s | Pattern: `^([0-9]+(\.[0-9]+)?(s|m|h))$` <br />Type: string <br /> |
| `rolloutRestartTargets` _[RolloutRestartTarget](#rolloutrestarttarget) array_ | RolloutRestartTargets should be configured whenever the application(s)<br />consuming the HCP Vault Secrets App does not support dynamically reloading a<br />rotated secret. In that case one, or more RolloutRestartTarget(s) can be<br />configured here. The Operator will trigger a "rollout-restart" for each target<br />whenever the Vault secret changes between reconciliation events. See<br />RolloutRestartTarget for more details. | | |
| `destination` _[Destination](#destination)_ | Destination provides configuration necessary for syncing the HCP Vault<br />Application secrets to Kubernetes. | | |
| `syncConfig` _[HVSSyncConfig](#hvssyncconfig)_ | SyncConfig configures sync behavior from HVS to VSO | | |




#### HVSDynamicStatus



HVSDynamicStatus defines the observed state of a dynamic secret within an HCP
Vault Secrets App



_Appears in:_
- [HCPVaultSecretsAppStatus](#hcpvaultsecretsappstatus)

| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `name` _string_ | Name of the dynamic secret | | |
| `createdAt` _string_ | CreatedAt is the timestamp string of when the dynamic secret was created | | |
| `expiresAt` _string_ | ExpiresAt is the timestamp string of when the dynamic secret will expire | | |
| `ttl` _string_ | TTL is the time-to-live of the dynamic secret in seconds | | |


#### HVSDynamicSyncConfig



HVSDynamicSyncConfig configures sync behavior for HVS dynamic secrets.



_Appears in:_
- [HVSSyncConfig](#hvssyncconfig)

| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `renewalPercent` _integer_ | RenewalPercent is the percent out of 100 of a dynamic secret's TTL when<br />new secrets are generated. Defaults to 67 percent plus up to 10% jitter. | 67 | Maximum: 90 <br />Minimum: 0 <br /> |


#### HVSSyncConfig



HVSSyncConfig configures sync behavior from HVS to VSO



_Appears in:_
- [HCPVaultSecretsAppSpec](#hcpvaultsecretsappspec)

| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `dynamic` _[HVSDynamicSyncConfig](#hvsdynamicsyncconfig)_ | Dynamic configures sync behavior for dynamic secrets. | | |


#### MergeStrategy


Expand Down Expand Up @@ -757,7 +810,7 @@ _Appears in:_
| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `allowedNamespaces` _string array_ | AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with<br />this VaultAuthGlobal. This field allows administrators to customize which<br />Kubernetes namespaces are authorized to reference this resource. While Vault<br />will still enforce its own rules, this has the added configurability of<br />restricting which VaultAuthMethods can be used by which namespaces. Accepted<br />values: []{"*"} - wildcard, all namespaces. []{"a", "b"} - list of namespaces.<br />unset - disallow all namespaces except the Operator's and the referring<br />VaultAuthMethod's namespace, this is the default behavior. | | |
| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to<br />namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the<br />Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | |
| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to<br />the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the<br />Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | |
| `defaultVaultNamespace` _string_ | DefaultVaultNamespace to auth to in Vault, if not specified the namespace of the auth<br />method will be used. This can be used as a default Vault namespace for all<br />auth methods. | | |
| `defaultAuthMethod` _string_ | DefaultAuthMethod to use when authenticating to Vault. | | Enum: [kubernetes jwt appRole aws gcp] <br /> |
| `defaultMount` _string_ | DefaultMount to use when authenticating to auth method. If not specified the mount of<br />the auth method configured in Vault will be used. | | |
Expand Down Expand Up @@ -803,7 +856,7 @@ _Appears in:_

| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to<br />namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the<br />Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | |
| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to<br />the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the<br />Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | |
| `vaultAuthGlobalRef` _[VaultAuthGlobalRef](#vaultauthglobalref)_ | VaultAuthGlobalRef. | | |
| `namespace` _string_ | Namespace to auth to in Vault | | |
| `allowedNamespaces` _string array_ | AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod.<br />This field allows administrators to customize which Kubernetes namespaces are authorized to<br />use with this AuthMethod. While Vault will still enforce its own rules, this has the added<br />configurability of restricting which VaultAuthMethods can be used by which namespaces.<br />Accepted values:<br />[]{"*"} - wildcard, all namespaces.<br />[]{"a", "b"} - list of namespaces.<br />unset - disallow all namespaces except the Operator's the VaultAuthMethod's namespace, this<br />is the default behavior. | | |
Expand Down Expand Up @@ -894,7 +947,7 @@ _Appears in:_
| `tlsServerName` _string_ | TLSServerName to use as the SNI host for TLS connections. | | |
| `caCertSecretRef` _string_ | CACertSecretRef is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as `ca.crt`. | | |
| `skipTLSVerify` _boolean_ | SkipTLSVerify for TLS connections. | false | |
| `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#duration-v1-meta)_ | Timeout applied to all Vault requests for this connection. If not set, the<br />default timeout from the Vault API client config is used. | | Pattern: `^([0-9]+(\.[0-9]+)?(s|m|h))$` <br />Type: string <br /> |
| `timeout` _string_ | Timeout applied to all Vault requests for this connection. If not set, the<br />default timeout from the Vault API client config is used. | | Pattern: `^([0-9]+(\.[0-9]+)?(s|m|h))$` <br />Type: string <br /> |



Expand Down Expand Up @@ -949,8 +1002,8 @@ _Appears in:_

| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to<br />namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will<br />default to the `default` VaultAuth, configured in the operator's namespace. | | |
| `namespace` _string_ | Namespace where the secrets engine is mounted in Vault. | | |
| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to<br />the namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator<br />will default to the `default` VaultAuth, configured in the operator's namespace. | | |
| `namespace` _string_ | Namespace of the secrets engine mount in Vault. If not set, the namespace that's<br />part of VaultAuth resource will be inferred. | | |
| `mount` _string_ | Mount path of the secret's engine in Vault. | | |
| `requestHTTPMethod` _string_ | RequestHTTPMethod to use when syncing Secrets from Vault.<br />Setting a value here is not typically required.<br />If left unset the Operator will make requests using the GET method.<br />In the case where Params are specified the Operator will use the PUT method.<br />Please consult [secrets](/vault/docs/secrets) if you are<br />uncertain about what method to use.<br />Of note, the Vault client treats PUT and POST as being equivalent.<br />The underlying Vault client implementation will always use the PUT method. | | Enum: [GET POST PUT] <br /> |
| `path` _string_ | Path in Vault to get the credentials for, and is relative to Mount.<br />Please consult [secrets](/vault/docs/secrets) if you are<br />uncertain about what 'path' should be set to. | | |
Expand Down Expand Up @@ -1015,8 +1068,8 @@ _Appears in:_

| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to<br />namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will<br />default to the `default` VaultAuth, configured in the operator's namespace. | | |
| `namespace` _string_ | Namespace to get the secret from in Vault | | |
| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to<br />the namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator<br />will default to the `default` VaultAuth, configured in the operator's namespace. | | |
| `namespace` _string_ | Namespace of the secrets engine mount in Vault. If not set, the namespace that's<br />part of VaultAuth resource will be inferred. | | |
| `mount` _string_ | Mount for the secret in Vault | | |
| `role` _string_ | Role in Vault to use when issuing TLS certificates. | | |
| `revoke` _boolean_ | Revoke the certificate when the resource is deleted. | | |
Expand Down Expand Up @@ -1128,8 +1181,8 @@ _Appears in:_

| Field | Description | Default | Validation |
| --- | --- | --- | --- |
| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to<br />namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will<br />default to the `default` VaultAuth, configured in the operator's namespace. | | |
| `namespace` _string_ | Namespace to get the secret from in Vault | | |
| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,<br />eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to the<br />namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will<br />default to the `default` VaultAuth, configured in the operator's namespace. | | |
| `namespace` _string_ | Namespace of the secrets engine mount in Vault. If not set, the namespace that's<br />part of VaultAuth resource will be inferred. | | |
| `mount` _string_ | Mount for the secret in Vault | | |
| `path` _string_ | Path of the secret in Vault, corresponds to the `path` parameter for,<br />[kv-v1](/vault/api-docs/secret/kv/kv-v1#read-secret) [kv-v2](/vault/api-docs/secret/kv/kv-v2#read-secret-version) | | |
| `version` _integer_ | Version of the secret to fetch. Only valid for type kv-v2. Corresponds to version query parameter:<br />[version](/vault/api-docs/secret/kv/kv-v2#version) | | Minimum: 0 <br /> |
Expand Down
8 changes: 4 additions & 4 deletions website/content/docs/platform/k8s/vso/helm.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ description: >-
---
<!-- DO NOT EDIT.
Generated from chart/values.yaml in the vault-secrets-operator repo.
commit SHA=c97a61487462dfc2ded7e7d80bb2061624cedc2a
commit SHA=08a6e5071ffa4faa486bd4b2c53b27585da4680c

To update run 'make gen-helm-docs' from the vault-secrets-operator repo.
-->
Expand Down Expand Up @@ -137,9 +137,9 @@ Use these links to navigate to a particular top-level stanza.

- `pullPolicy` ((#v-controller-kuberbacproxy-image-pullpolicy)) (`string: IfNotPresent`)

- `repository` ((#v-controller-kuberbacproxy-image-repository)) (`string: gcr.io/kubebuilder/kube-rbac-proxy`)
- `repository` ((#v-controller-kuberbacproxy-image-repository)) (`string: quay.io/brancz/kube-rbac-proxy`)

- `tag` ((#v-controller-kuberbacproxy-image-tag)) (`string: v0.15.0`)
- `tag` ((#v-controller-kuberbacproxy-image-tag)) (`string: v0.18.1`)

- `resources` ((#v-controller-kuberbacproxy-resources)) (`map`) - Configures the default resources for the kube rbac proxy container.
For more information on configuring resources, see the K8s documentation:
Expand Down Expand Up @@ -179,7 +179,7 @@ Use these links to navigate to a particular top-level stanza.

- `repository` ((#v-controller-manager-image-repository)) (`string: hashicorp/vault-secrets-operator`)

- `tag` ((#v-controller-manager-image-tag)) (`string: 0.8.1`)
- `tag` ((#v-controller-manager-image-tag)) (`string: 0.9.0`)

- `logging` ((#v-controller-manager-logging)) - logging

Expand Down
10 changes: 5 additions & 5 deletions website/content/docs/platform/k8s/vso/installation.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,13 +32,13 @@ $ helm repo add hashicorp https://helm.releases.hashicorp.com
```shell-session
$ helm search repo hashicorp/vault-secrets-operator
NAME CHART VERSION APP VERSION DESCRIPTION
hashicorp/vault-secrets-operator 0.8.1 0.8.1 Official HashiCorp Vault Secrets Operator Chart
hashicorp/vault-secrets-operator 0.9.0 0.9.0 Official HashiCorp Vault Secrets Operator Chart
```

Then install the Operator:

```shell-session
$ helm install --version 0.8.1 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator
$ helm install --version 0.9.0 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator
```

## Upgrading using Helm
Expand Down Expand Up @@ -78,9 +78,9 @@ You can install and update your installation using `kustomize` which allows you

To install using Kustomize, download and untar/unzip the latest release from the [Releases Page](https://github.com/hashicorp/vault-secrets-operator/releases).
```shell-session
$ wget -q https://github.com/hashicorp/vault-secrets-operator/archive/refs/tags/v0.8.1.tar.gz
$ tar -zxf v0.8.1.tar.gz
$ cd vault-secrets-operator-0.8.1/
$ wget -q https://github.com/hashicorp/vault-secrets-operator/archive/refs/tags/v0.9.0.tar.gz
$ tar -zxf v0.9.0.tar.gz
$ cd vault-secrets-operator-0.9.0/
```

Next install using `kustomize build`:
Expand Down
4 changes: 2 additions & 2 deletions website/content/docs/platform/k8s/vso/openshift.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,7 +32,7 @@ The Vault Secrets Operator may also be installed in OpenShift using the Helm cha
$ helm install vault-secrets-operator hashicorp/vault-secrets-operator \
--create-namespace \
--namespace vault-secrets-operator \
--version 0.8.1 \
--version 0.9.0 \
--values values.yaml
```

Expand Down Expand Up @@ -65,7 +65,7 @@ controller:
manager:
image:
repository: registry.connect.redhat.com/hashicorp/vault-secrets-operator
tag: 0.8.1-ubi
tag: 0.9.0-ubi
resources:
limits:
memory: 256Mi
Expand Down
Loading