From d253c95b6a4c488fd33bfed692c00cf7a82ddfca Mon Sep 17 00:00:00 2001 From: Ben Ash <32777270+benashz@users.noreply.github.com> Date: Tue, 8 Oct 2024 22:36:40 +0000 Subject: [PATCH] backport of commit 0f296522c3ad04e86bebae0993ef2a8eac2fb237 --- .../docs/platform/k8s/vso/api-reference.mdx | 73 ++++++++++++++++--- .../content/docs/platform/k8s/vso/helm.mdx | 8 +- .../docs/platform/k8s/vso/installation.mdx | 10 +-- .../docs/platform/k8s/vso/openshift.mdx | 4 +- 4 files changed, 74 insertions(+), 21 deletions(-) diff --git a/website/content/docs/platform/k8s/vso/api-reference.mdx b/website/content/docs/platform/k8s/vso/api-reference.mdx index 3f2e9f44b478..d71bb5ebc53f 100644 --- a/website/content/docs/platform/k8s/vso/api-reference.mdx +++ b/website/content/docs/platform/k8s/vso/api-reference.mdx @@ -7,7 +7,7 @@ description: >- # API Reference @@ -198,10 +198,63 @@ _Appears in:_ | `refreshAfter` _string_ | RefreshAfter a period of time, in duration notation e.g. 30s, 1m, 24h | 600s | Pattern: `^([0-9]+(\.[0-9]+)?(s|m|h))$`
Type: string
| | `rolloutRestartTargets` _[RolloutRestartTarget](#rolloutrestarttarget) array_ | RolloutRestartTargets should be configured whenever the application(s)
consuming the HCP Vault Secrets App does not support dynamically reloading a
rotated secret. In that case one, or more RolloutRestartTarget(s) can be
configured here. The Operator will trigger a "rollout-restart" for each target
whenever the Vault secret changes between reconciliation events. See
RolloutRestartTarget for more details. | | | | `destination` _[Destination](#destination)_ | Destination provides configuration necessary for syncing the HCP Vault
Application secrets to Kubernetes. | | | +| `syncConfig` _[HVSSyncConfig](#hvssyncconfig)_ | SyncConfig configures sync behavior from HVS to VSO | | | +#### HVSDynamicStatus + + + +HVSDynamicStatus defines the observed state of a dynamic secret within an HCP +Vault Secrets App + + + +_Appears in:_ +- [HCPVaultSecretsAppStatus](#hcpvaultsecretsappstatus) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `name` _string_ | Name of the dynamic secret | | | +| `createdAt` _string_ | CreatedAt is the timestamp string of when the dynamic secret was created | | | +| `expiresAt` _string_ | ExpiresAt is the timestamp string of when the dynamic secret will expire | | | +| `ttl` _string_ | TTL is the time-to-live of the dynamic secret in seconds | | | + + +#### HVSDynamicSyncConfig + + + +HVSDynamicSyncConfig configures sync behavior for HVS dynamic secrets. + + + +_Appears in:_ +- [HVSSyncConfig](#hvssyncconfig) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `renewalPercent` _integer_ | RenewalPercent is the percent out of 100 of a dynamic secret's TTL when
new secrets are generated. Defaults to 67 percent plus up to 10% jitter. | 67 | Maximum: 90
Minimum: 0
| + + +#### HVSSyncConfig + + + +HVSSyncConfig configures sync behavior from HVS to VSO + + + +_Appears in:_ +- [HCPVaultSecretsAppSpec](#hcpvaultsecretsappspec) + +| Field | Description | Default | Validation | +| --- | --- | --- | --- | +| `dynamic` _[HVSDynamicSyncConfig](#hvsdynamicsyncconfig)_ | Dynamic configures sync behavior for dynamic secrets. | | | + + #### MergeStrategy @@ -757,7 +810,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | | `allowedNamespaces` _string array_ | AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with
this VaultAuthGlobal. This field allows administrators to customize which
Kubernetes namespaces are authorized to reference this resource. While Vault
will still enforce its own rules, this has the added configurability of
restricting which VaultAuthMethods can be used by which namespaces. Accepted
values: []{"*"} - wildcard, all namespaces. []{"a", "b"} - list of namespaces.
unset - disallow all namespaces except the Operator's and the referring
VaultAuthMethod's namespace, this is the default behavior. | | | -| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,
eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to
namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the
Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | | +| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,
eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to
the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the
Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | | | `defaultVaultNamespace` _string_ | DefaultVaultNamespace to auth to in Vault, if not specified the namespace of the auth
method will be used. This can be used as a default Vault namespace for all
auth methods. | | | | `defaultAuthMethod` _string_ | DefaultAuthMethod to use when authenticating to Vault. | | Enum: [kubernetes jwt appRole aws gcp]
| | `defaultMount` _string_ | DefaultMount to use when authenticating to auth method. If not specified the mount of
the auth method configured in Vault will be used. | | | @@ -803,7 +856,7 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,
eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to
namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the
Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | | +| `vaultConnectionRef` _string_ | VaultConnectionRef to the VaultConnection resource, can be prefixed with a namespace,
eg: `namespaceA/vaultConnectionRefB`. If no namespace prefix is provided it will default to
the namespace of the VaultConnection CR. If no value is specified for VaultConnectionRef the
Operator will default to the `default` VaultConnection, configured in the operator's namespace. | | | | `vaultAuthGlobalRef` _[VaultAuthGlobalRef](#vaultauthglobalref)_ | VaultAuthGlobalRef. | | | | `namespace` _string_ | Namespace to auth to in Vault | | | | `allowedNamespaces` _string array_ | AllowedNamespaces Kubernetes Namespaces which are allow-listed for use with this AuthMethod.
This field allows administrators to customize which Kubernetes namespaces are authorized to
use with this AuthMethod. While Vault will still enforce its own rules, this has the added
configurability of restricting which VaultAuthMethods can be used by which namespaces.
Accepted values:
[]{"*"} - wildcard, all namespaces.
[]{"a", "b"} - list of namespaces.
unset - disallow all namespaces except the Operator's the VaultAuthMethod's namespace, this
is the default behavior. | | | @@ -894,7 +947,7 @@ _Appears in:_ | `tlsServerName` _string_ | TLSServerName to use as the SNI host for TLS connections. | | | | `caCertSecretRef` _string_ | CACertSecretRef is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as `ca.crt`. | | | | `skipTLSVerify` _boolean_ | SkipTLSVerify for TLS connections. | false | | -| `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#duration-v1-meta)_ | Timeout applied to all Vault requests for this connection. If not set, the
default timeout from the Vault API client config is used. | | Pattern: `^([0-9]+(\.[0-9]+)?(s|m|h))$`
Type: string
| +| `timeout` _string_ | Timeout applied to all Vault requests for this connection. If not set, the
default timeout from the Vault API client config is used. | | Pattern: `^([0-9]+(\.[0-9]+)?(s|m|h))$`
Type: string
| @@ -949,8 +1002,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to
namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will
default to the `default` VaultAuth, configured in the operator's namespace. | | | -| `namespace` _string_ | Namespace where the secrets engine is mounted in Vault. | | | +| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to
the namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator
will default to the `default` VaultAuth, configured in the operator's namespace. | | | +| `namespace` _string_ | Namespace of the secrets engine mount in Vault. If not set, the namespace that's
part of VaultAuth resource will be inferred. | | | | `mount` _string_ | Mount path of the secret's engine in Vault. | | | | `requestHTTPMethod` _string_ | RequestHTTPMethod to use when syncing Secrets from Vault.
Setting a value here is not typically required.
If left unset the Operator will make requests using the GET method.
In the case where Params are specified the Operator will use the PUT method.
Please consult [secrets](/vault/docs/secrets) if you are
uncertain about what method to use.
Of note, the Vault client treats PUT and POST as being equivalent.
The underlying Vault client implementation will always use the PUT method. | | Enum: [GET POST PUT]
| | `path` _string_ | Path in Vault to get the credentials for, and is relative to Mount.
Please consult [secrets](/vault/docs/secrets) if you are
uncertain about what 'path' should be set to. | | | @@ -1015,8 +1068,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to
namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will
default to the `default` VaultAuth, configured in the operator's namespace. | | | -| `namespace` _string_ | Namespace to get the secret from in Vault | | | +| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to
the namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator
will default to the `default` VaultAuth, configured in the operator's namespace. | | | +| `namespace` _string_ | Namespace of the secrets engine mount in Vault. If not set, the namespace that's
part of VaultAuth resource will be inferred. | | | | `mount` _string_ | Mount for the secret in Vault | | | | `role` _string_ | Role in Vault to use when issuing TLS certificates. | | | | `revoke` _boolean_ | Revoke the certificate when the resource is deleted. | | | @@ -1128,8 +1181,8 @@ _Appears in:_ | Field | Description | Default | Validation | | --- | --- | --- | --- | -| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to
namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will
default to the `default` VaultAuth, configured in the operator's namespace. | | | -| `namespace` _string_ | Namespace to get the secret from in Vault | | | +| `vaultAuthRef` _string_ | VaultAuthRef to the VaultAuth resource, can be prefixed with a namespace,
eg: `namespaceA/vaultAuthRefB`. If no namespace prefix is provided it will default to the
namespace of the VaultAuth CR. If no value is specified for VaultAuthRef the Operator will
default to the `default` VaultAuth, configured in the operator's namespace. | | | +| `namespace` _string_ | Namespace of the secrets engine mount in Vault. If not set, the namespace that's
part of VaultAuth resource will be inferred. | | | | `mount` _string_ | Mount for the secret in Vault | | | | `path` _string_ | Path of the secret in Vault, corresponds to the `path` parameter for,
[kv-v1](/vault/api-docs/secret/kv/kv-v1#read-secret) [kv-v2](/vault/api-docs/secret/kv/kv-v2#read-secret-version) | | | | `version` _integer_ | Version of the secret to fetch. Only valid for type kv-v2. Corresponds to version query parameter:
[version](/vault/api-docs/secret/kv/kv-v2#version) | | Minimum: 0
| diff --git a/website/content/docs/platform/k8s/vso/helm.mdx b/website/content/docs/platform/k8s/vso/helm.mdx index f3d97022219d..0fbe337b83a4 100644 --- a/website/content/docs/platform/k8s/vso/helm.mdx +++ b/website/content/docs/platform/k8s/vso/helm.mdx @@ -6,7 +6,7 @@ description: >- --- @@ -137,9 +137,9 @@ Use these links to navigate to a particular top-level stanza. - `pullPolicy` ((#v-controller-kuberbacproxy-image-pullpolicy)) (`string: IfNotPresent`) - - `repository` ((#v-controller-kuberbacproxy-image-repository)) (`string: gcr.io/kubebuilder/kube-rbac-proxy`) + - `repository` ((#v-controller-kuberbacproxy-image-repository)) (`string: quay.io/brancz/kube-rbac-proxy`) - - `tag` ((#v-controller-kuberbacproxy-image-tag)) (`string: v0.15.0`) + - `tag` ((#v-controller-kuberbacproxy-image-tag)) (`string: v0.18.1`) - `resources` ((#v-controller-kuberbacproxy-resources)) (`map`) - Configures the default resources for the kube rbac proxy container. For more information on configuring resources, see the K8s documentation: @@ -179,7 +179,7 @@ Use these links to navigate to a particular top-level stanza. - `repository` ((#v-controller-manager-image-repository)) (`string: hashicorp/vault-secrets-operator`) - - `tag` ((#v-controller-manager-image-tag)) (`string: 0.8.1`) + - `tag` ((#v-controller-manager-image-tag)) (`string: 0.9.0`) - `logging` ((#v-controller-manager-logging)) - logging diff --git a/website/content/docs/platform/k8s/vso/installation.mdx b/website/content/docs/platform/k8s/vso/installation.mdx index 969c61db7581..25d9e5148c3e 100644 --- a/website/content/docs/platform/k8s/vso/installation.mdx +++ b/website/content/docs/platform/k8s/vso/installation.mdx @@ -32,13 +32,13 @@ $ helm repo add hashicorp https://helm.releases.hashicorp.com ```shell-session $ helm search repo hashicorp/vault-secrets-operator NAME CHART VERSION APP VERSION DESCRIPTION -hashicorp/vault-secrets-operator 0.8.1 0.8.1 Official HashiCorp Vault Secrets Operator Chart +hashicorp/vault-secrets-operator 0.9.0 0.9.0 Official HashiCorp Vault Secrets Operator Chart ``` Then install the Operator: ```shell-session -$ helm install --version 0.8.1 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator +$ helm install --version 0.9.0 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator ``` ## Upgrading using Helm @@ -78,9 +78,9 @@ You can install and update your installation using `kustomize` which allows you To install using Kustomize, download and untar/unzip the latest release from the [Releases Page](https://github.com/hashicorp/vault-secrets-operator/releases). ```shell-session -$ wget -q https://github.com/hashicorp/vault-secrets-operator/archive/refs/tags/v0.8.1.tar.gz -$ tar -zxf v0.8.1.tar.gz -$ cd vault-secrets-operator-0.8.1/ +$ wget -q https://github.com/hashicorp/vault-secrets-operator/archive/refs/tags/v0.9.0.tar.gz +$ tar -zxf v0.9.0.tar.gz +$ cd vault-secrets-operator-0.9.0/ ``` Next install using `kustomize build`: diff --git a/website/content/docs/platform/k8s/vso/openshift.mdx b/website/content/docs/platform/k8s/vso/openshift.mdx index cb788609f948..b2a02ff21150 100644 --- a/website/content/docs/platform/k8s/vso/openshift.mdx +++ b/website/content/docs/platform/k8s/vso/openshift.mdx @@ -32,7 +32,7 @@ The Vault Secrets Operator may also be installed in OpenShift using the Helm cha $ helm install vault-secrets-operator hashicorp/vault-secrets-operator \ --create-namespace \ --namespace vault-secrets-operator \ - --version 0.8.1 \ + --version 0.9.0 \ --values values.yaml ``` @@ -65,7 +65,7 @@ controller: manager: image: repository: registry.connect.redhat.com/hashicorp/vault-secrets-operator - tag: 0.8.1-ubi + tag: 0.9.0-ubi resources: limits: memory: 256Mi