Documentation ¶
Overview ¶
+kcc:proto=google.cloud.secretmanager.v1
+kubebuilder:object:generate=true +groupName=secretmanager.cnrm.cloud.google.com
Index ¶
- Variables
- type CustomerManagedEncryption
- type Replication
- type Replication_Automatic
- type Replication_UserManaged
- type Replication_UserManaged_Replica
- type Rotation
- type Secret
- type SecretManagerSecret
- type SecretManagerSecretList
- type SecretManagerSecretObservedState
- type SecretManagerSecretParent
- type SecretManagerSecretRef
- func (in *SecretManagerSecretRef) DeepCopy() *SecretManagerSecretRef
- func (in *SecretManagerSecretRef) DeepCopyInto(out *SecretManagerSecretRef)
- func (r *SecretManagerSecretRef) NormalizedExternal(ctx context.Context, reader client.Reader, otherNamespace string) (string, error)
- func (r *SecretManagerSecretRef) Parent() (*SecretManagerSecretParent, error)
- type SecretManagerSecretSpec
- type SecretManagerSecretStatus
- type Topic
- type TopicRef
Constants ¶
This section is empty.
Variables ¶
var ( // GroupVersion is group version used to register these objects GroupVersion = schema.GroupVersion{Group: "secretmanager.cnrm.cloud.google.com", Version: "v1beta1"} // SchemeBuilder is used to add go types to the GroupVersionKind scheme SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion} // AddToScheme adds the types in this group-version to the given scheme. AddToScheme = SchemeBuilder.AddToScheme )
var SecretManagerSecretGVK = GroupVersion.WithKind("SecretManagerSecret")
Functions ¶
This section is empty.
Types ¶
type CustomerManagedEncryption ¶
type CustomerManagedEncryption struct { // +required // Required. The resource name of the Cloud KMS CryptoKey used to encrypt // secret payloads. // // For secrets using the // [UserManaged][google.cloud.secretmanager.v1.Replication.UserManaged] // replication policy type, Cloud KMS CryptoKeys must reside in the same // location as the [replica location][Secret.UserManaged.Replica.location]. // // For secrets using the // [Automatic][google.cloud.secretmanager.v1.Replication.Automatic] // replication policy type, Cloud KMS CryptoKeys must reside in `global`. // // The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`. KmsKeyRef *refv1beta1.KMSCryptoKeyRef `json:"kmsKeyRef,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.CustomerManagedEncryption
func (*CustomerManagedEncryption) DeepCopy ¶
func (in *CustomerManagedEncryption) DeepCopy() *CustomerManagedEncryption
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CustomerManagedEncryption.
func (*CustomerManagedEncryption) DeepCopyInto ¶
func (in *CustomerManagedEncryption) DeepCopyInto(out *CustomerManagedEncryption)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Replication ¶
type Replication struct { // The Secret will automatically be replicated without any restrictions. LegacyAuto *bool `json:"automatic,omitempty"` // The [Secret][google.cloud.secretmanager.v1.Secret] will automatically be // replicated without any restrictions. LegacyAutomatic *Replication_Automatic `json:"auto,omitempty"` // The [Secret][google.cloud.secretmanager.v1.Secret] will only be // replicated into the locations specified. UserManaged *Replication_UserManaged `json:"userManaged,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.Replication
func (*Replication) DeepCopy ¶
func (in *Replication) DeepCopy() *Replication
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Replication.
func (*Replication) DeepCopyInto ¶
func (in *Replication) DeepCopyInto(out *Replication)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Replication_Automatic ¶
type Replication_Automatic struct { // Optional. The customer-managed encryption configuration of the // [Secret][google.cloud.secretmanager.v1.Secret]. If no configuration is // provided, Google-managed default encryption is used. // // Updates to the [Secret][google.cloud.secretmanager.v1.Secret] encryption // configuration only apply to // [SecretVersions][google.cloud.secretmanager.v1.SecretVersion] added // afterwards. They do not apply retroactively to existing // [SecretVersions][google.cloud.secretmanager.v1.SecretVersion]. CustomerManagedEncryption *CustomerManagedEncryption `json:"customerManagedEncryption,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.Replication.Automatic
func (*Replication_Automatic) DeepCopy ¶
func (in *Replication_Automatic) DeepCopy() *Replication_Automatic
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Replication_Automatic.
func (*Replication_Automatic) DeepCopyInto ¶
func (in *Replication_Automatic) DeepCopyInto(out *Replication_Automatic)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Replication_UserManaged ¶
type Replication_UserManaged struct { // +required // Required. The list of Replicas for this // [Secret][google.cloud.secretmanager.v1.Secret]. // // Cannot be empty. Replicas []Replication_UserManaged_Replica `json:"replicas,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.Replication.UserManaged
func (*Replication_UserManaged) DeepCopy ¶
func (in *Replication_UserManaged) DeepCopy() *Replication_UserManaged
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Replication_UserManaged.
func (*Replication_UserManaged) DeepCopyInto ¶
func (in *Replication_UserManaged) DeepCopyInto(out *Replication_UserManaged)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Replication_UserManaged_Replica ¶
type Replication_UserManaged_Replica struct { // +required // The canonical IDs of the location to replicate data. // For example: `"us-east1"`. Location *string `json:"location,omitempty"` // Optional. The customer-managed encryption configuration of the // [User-Managed Replica][Replication.UserManaged.Replica]. If no // configuration is provided, Google-managed default encryption is used. // // Updates to the [Secret][google.cloud.secretmanager.v1.Secret] // encryption configuration only apply to // [SecretVersions][google.cloud.secretmanager.v1.SecretVersion] added // afterwards. They do not apply retroactively to existing // [SecretVersions][google.cloud.secretmanager.v1.SecretVersion]. CustomerManagedEncryption *CustomerManagedEncryption `json:"customerManagedEncryption,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.Replication.UserManaged.Replica
func (*Replication_UserManaged_Replica) DeepCopy ¶
func (in *Replication_UserManaged_Replica) DeepCopy() *Replication_UserManaged_Replica
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Replication_UserManaged_Replica.
func (*Replication_UserManaged_Replica) DeepCopyInto ¶
func (in *Replication_UserManaged_Replica) DeepCopyInto(out *Replication_UserManaged_Replica)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Rotation ¶
type Rotation struct { // Optional. Timestamp in UTC at which the // [Secret][google.cloud.secretmanager.v1.Secret] is scheduled to rotate. // Cannot be set to less than 300s (5 min) in the future and at most // 3153600000s (100 years). // // [next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time] // MUST be set if // [rotation_period][google.cloud.secretmanager.v1.Rotation.rotation_period] // is set. NextRotationTime *string `json:"nextRotationTime,omitempty"` // Input only. The Duration between rotation notifications. Must be in seconds // and at least 3600s (1h) and at most 3153600000s (100 years). // // If // [rotation_period][google.cloud.secretmanager.v1.Rotation.rotation_period] // is set, // [next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time] // must be set. // [next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time] // will be advanced by this period when the service automatically sends // rotation notifications. RotationPeriod *string `json:"rotationPeriod,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.Rotation
func (*Rotation) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Rotation.
func (*Rotation) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Secret ¶
type Secret struct { // Output only. The resource name of the // [Secret][google.cloud.secretmanager.v1.Secret] in the format // `projects/*/secrets/*`. Name *string `json:"name,omitempty"` // Optional. Immutable. The replication policy of the secret data attached to // the [Secret][google.cloud.secretmanager.v1.Secret]. // // The replication policy cannot be changed after the Secret has been created. Replication *Replication `json:"replication,omitempty"` // Output only. The time at which the // [Secret][google.cloud.secretmanager.v1.Secret] was created. CreateTime *string `json:"createTime,omitempty"` // The labels assigned to this Secret. // // Label keys must be between 1 and 63 characters long, have a UTF-8 encoding // of maximum 128 bytes, and must conform to the following PCRE regular // expression: `[\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}` // // Label values must be between 0 and 63 characters long, have a UTF-8 // encoding of maximum 128 bytes, and must conform to the following PCRE // regular expression: `[\p{Ll}\p{Lo}\p{N}_-]{0,63}` // // No more than 64 labels can be assigned to a given resource. Labels map[string]string `json:"labels,omitempty"` // Optional. A list of up to 10 Pub/Sub topics to which messages are published // when control plane operations are called on the secret or its versions. Topics []Topic `json:"topics,omitempty"` // Optional. Timestamp in UTC when the // [Secret][google.cloud.secretmanager.v1.Secret] is scheduled to expire. // This is always provided on output, regardless of what was sent on input. ExpireTime *string `json:"expireTime,omitempty"` // Input only. The TTL for the // [Secret][google.cloud.secretmanager.v1.Secret]. Ttl *string `json:"ttl,omitempty"` // Optional. Etag of the currently stored // [Secret][google.cloud.secretmanager.v1.Secret]. Etag *string `json:"etag,omitempty"` // Optional. Rotation policy attached to the // [Secret][google.cloud.secretmanager.v1.Secret]. May be excluded if there is // no rotation policy. Rotation *Rotation `json:"rotation,omitempty"` // Optional. Mapping from version alias to version name. // // A version alias is a string with a maximum length of 63 characters and can // contain uppercase and lowercase letters, numerals, and the hyphen (`-`) // and underscore ('_') characters. An alias string must start with a // letter and cannot be the string 'latest' or 'NEW'. // No more than 50 aliases can be assigned to a given secret. // // Version-Alias pairs will be viewable via GetSecret and modifiable via // UpdateSecret. Access by alias is only be supported on // GetSecretVersion and AccessSecretVersion. VersionAliases map[string]int64 `json:"versionAliases,omitempty"` // Optional. Custom metadata about the secret. // // Annotations are distinct from various forms of labels. // Annotations exist to allow client tools to store their own state // information without requiring a database. // // Annotation keys must be between 1 and 63 characters long, have a UTF-8 // encoding of maximum 128 bytes, begin and end with an alphanumeric character // ([a-z0-9A-Z]), and may have dashes (-), underscores (_), dots (.), and // alphanumerics in between these symbols. // // The total size of annotation keys and values must be less than 16KiB. Annotations map[string]string `json:"annotations,omitempty"` // Optional. The customer-managed encryption configuration of the Regionalised // Secrets. If no configuration is provided, Google-managed default encryption // is used. // // Updates to the [Secret][google.cloud.secretmanager.v1.Secret] encryption // configuration only apply to // [SecretVersions][google.cloud.secretmanager.v1.SecretVersion] added // afterwards. They do not apply retroactively to existing // [SecretVersions][google.cloud.secretmanager.v1.SecretVersion]. CustomerManagedEncryption *CustomerManagedEncryption `json:"customerManagedEncryption,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.Secret
func (*Secret) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Secret.
func (*Secret) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecretManagerSecret ¶
type SecretManagerSecret struct { metav1.TypeMeta `json:",inline"` metav1.ObjectMeta `json:"metadata,omitempty"` Spec SecretManagerSecretSpec `json:"spec,omitempty"` Status SecretManagerSecretStatus `json:"status,omitempty"` }
SecretManagerSecret is the Schema for the SecretManagerSecret API +k8s:openapi-gen=true
func (*SecretManagerSecret) DeepCopy ¶
func (in *SecretManagerSecret) DeepCopy() *SecretManagerSecret
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretManagerSecret.
func (*SecretManagerSecret) DeepCopyInto ¶
func (in *SecretManagerSecret) DeepCopyInto(out *SecretManagerSecret)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*SecretManagerSecret) DeepCopyObject ¶
func (in *SecretManagerSecret) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type SecretManagerSecretList ¶
type SecretManagerSecretList struct { metav1.TypeMeta `json:",inline"` metav1.ListMeta `json:"metadata,omitempty"` Items []SecretManagerSecret `json:"items"` }
+k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object SecretManagerSecretList contains a list of SecretManagerSecret
func (*SecretManagerSecretList) DeepCopy ¶
func (in *SecretManagerSecretList) DeepCopy() *SecretManagerSecretList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretManagerSecretList.
func (*SecretManagerSecretList) DeepCopyInto ¶
func (in *SecretManagerSecretList) DeepCopyInto(out *SecretManagerSecretList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*SecretManagerSecretList) DeepCopyObject ¶
func (in *SecretManagerSecretList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type SecretManagerSecretObservedState ¶
type SecretManagerSecretObservedState struct { }
SecretManagerSecretSpec defines the desired state of SecretManagerSecret +kcc:proto=google.cloud.secretmanager.v1.Secret
func (*SecretManagerSecretObservedState) DeepCopy ¶
func (in *SecretManagerSecretObservedState) DeepCopy() *SecretManagerSecretObservedState
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretManagerSecretObservedState.
func (*SecretManagerSecretObservedState) DeepCopyInto ¶
func (in *SecretManagerSecretObservedState) DeepCopyInto(out *SecretManagerSecretObservedState)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecretManagerSecretParent ¶
type SecretManagerSecretParent struct {
ProjectID string
}
func ParseSecretManagerSecretExternal ¶
func ParseSecretManagerSecretExternal(external string) (parent *SecretManagerSecretParent, resourceID string, err error)
func (*SecretManagerSecretParent) DeepCopy ¶
func (in *SecretManagerSecretParent) DeepCopy() *SecretManagerSecretParent
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretManagerSecretParent.
func (*SecretManagerSecretParent) DeepCopyInto ¶
func (in *SecretManagerSecretParent) DeepCopyInto(out *SecretManagerSecretParent)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*SecretManagerSecretParent) String ¶
func (p *SecretManagerSecretParent) String() string
type SecretManagerSecretRef ¶
type SecretManagerSecretRef struct { // A reference to an externally managed SecretManagerSecret resource. // Should be in the format "projects/<projectID>/locations/<location>/secrets/<secretID>". External string `json:"external,omitempty"` // The name of a SecretManagerSecret resource. Name string `json:"name,omitempty"` // The namespace of a SecretManagerSecret resource. Namespace string `json:"namespace,omitempty"` // contains filtered or unexported fields }
SecretManagerSecretRef defines the resource reference to SecretManagerSecret, which "External" field holds the GCP identifier for the KRM object.
func NewSecretManagerSecretRef ¶
func NewSecretManagerSecretRef(ctx context.Context, reader client.Reader, obj *SecretManagerSecret, u *unstructured.Unstructured) (*SecretManagerSecretRef, error)
New builds a SecretManagerSecretRef from the Config Connector SecretManagerSecret object.
func (*SecretManagerSecretRef) DeepCopy ¶
func (in *SecretManagerSecretRef) DeepCopy() *SecretManagerSecretRef
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretManagerSecretRef.
func (*SecretManagerSecretRef) DeepCopyInto ¶
func (in *SecretManagerSecretRef) DeepCopyInto(out *SecretManagerSecretRef)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*SecretManagerSecretRef) NormalizedExternal ¶
func (r *SecretManagerSecretRef) NormalizedExternal(ctx context.Context, reader client.Reader, otherNamespace string) (string, error)
NormalizedExternal provision the "External" value for other resource that depends on SecretManagerSecret. If the "External" is given in the other resource's spec.SecretManagerSecretRef, the given value will be used. Otherwise, the "Name" and "Namespace" will be used to query the actual SecretManagerSecret object from the cluster.
func (*SecretManagerSecretRef) Parent ¶
func (r *SecretManagerSecretRef) Parent() (*SecretManagerSecretParent, error)
type SecretManagerSecretSpec ¶
type SecretManagerSecretSpec struct { // +kubebuilder:validation:XValidation:rule="self == oldSelf",message="ResourceID field is immutable" // Immutable. // The SecretManagerSecret name. If not given, the metadata.name will be used. ResourceID *string `json:"resourceID,omitempty"` // Optional. Immutable. The replication policy of the secret data attached to // the [Secret][google.cloud.secretmanager.v1.Secret]. // // The replication policy cannot be changed after the Secret has been created. Replication *Replication `json:"replication,omitempty"` // Optional. A list of up to 10 Pub/Sub topics to which messages are published // when control plane operations are called on the secret or its versions. TopicRefs []*TopicRef `json:"topics,omitempty"` // Optional. Timestamp in UTC when the // [Secret][google.cloud.secretmanager.v1.Secret] is scheduled to expire. // This is always provided on output, regardless of what was sent on input. ExpireTime *string `json:"expireTime,omitempty"` // Input only. The TTL for the // [Secret][google.cloud.secretmanager.v1.Secret]. TTL *string `json:"ttl,omitempty"` // Optional. Rotation policy attached to the // [Secret][google.cloud.secretmanager.v1.Secret]. May be excluded if there is // no rotation policy. Rotation *Rotation `json:"rotation,omitempty"` // Optional. Mapping from version alias to version name. // // A version alias is a string with a maximum length of 63 characters and can // contain uppercase and lowercase letters, numerals, and the hyphen (`-`) // and underscore ('_') characters. An alias string must start with a // letter and cannot be the string 'latest' or 'NEW'. // No more than 50 aliases can be assigned to a given secret. // // Version-Alias pairs will be viewable via GetSecret and modifiable via // UpdateSecret. Access by alias is only be supported on // GetSecretVersion and AccessSecretVersion. VersionAliases map[string]string `json:"versionAliases,omitempty"` // Optional. Custom metadata about the secret. // // Annotations are distinct from various forms of labels. // Annotations exist to allow client tools to store their own state // information without requiring a database. // // Annotation keys must be between 1 and 63 characters long, have a UTF-8 // encoding of maximum 128 bytes, begin and end with an alphanumeric character // ([a-z0-9A-Z]), and may have dashes (-), underscores (_), dots (.), and // alphanumerics in between these symbols. // // The total size of annotation keys and values must be less than 16KiB. Annotations map[string]string `json:"annotations,omitempty"` }
SecretManagerSecretSpec defines the desired state of SecretManagerSecret +kcc:proto=google.cloud.secretmanager.v1.Secret
func (*SecretManagerSecretSpec) DeepCopy ¶
func (in *SecretManagerSecretSpec) DeepCopy() *SecretManagerSecretSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretManagerSecretSpec.
func (*SecretManagerSecretSpec) DeepCopyInto ¶
func (in *SecretManagerSecretSpec) DeepCopyInto(out *SecretManagerSecretSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type SecretManagerSecretStatus ¶
type SecretManagerSecretStatus struct { /* Conditions represent the latest available observations of the object's current state. */ Conditions []v1alpha1.Condition `json:"conditions,omitempty"` // ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource. ObservedGeneration *int64 `json:"observedGeneration,omitempty"` // A unique specifier for the SecretManagerSecret resource in GCP. ExternalRef *string `json:"externalRef,omitempty"` // ObservedState is the state of the resource as most recently observed in GCP. ObservedState *SecretManagerSecretObservedState `json:"observedState,omitempty"` // [DEPRECATED] Please read from `.status.externalRef` instead. Config Connector will remove the `.status.name` in v1 Version. Name string `json:"name,omitempty"` }
SecretManagerSecretStatus defines the config connector machine state of SecretManagerSecret
func (*SecretManagerSecretStatus) DeepCopy ¶
func (in *SecretManagerSecretStatus) DeepCopy() *SecretManagerSecretStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretManagerSecretStatus.
func (*SecretManagerSecretStatus) DeepCopyInto ¶
func (in *SecretManagerSecretStatus) DeepCopyInto(out *SecretManagerSecretStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type Topic ¶
type Topic struct { // Required. The resource name of the Pub/Sub topic that will be published to, // in the following format: `projects/*/topics/*`. For publication to succeed, // the Secret Manager service agent must have the `pubsub.topic.publish` // permission on the topic. The Pub/Sub Publisher role // (`roles/pubsub.publisher`) includes this permission. Name *string `json:"name,omitempty"` }
+kcc:proto=google.cloud.secretmanager.v1.Topic
func (*Topic) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Topic.
func (*Topic) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type TopicRef ¶
type TopicRef struct { // +required PubSubTopicRef *refv1beta1.PubSubTopicRef `json:"topicRef,omitempty"` }
func (*TopicRef) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TopicRef.
func (*TopicRef) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.