GCRAccessToken generates an GCP access token that can be used to authenticate with GCR.
4 top-level fields · last changed in External Secrets Operator v0.20.0
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
Auth defines the means for authenticating with GCP
The SecretAccessKey is used for authentication
A key in the referenced Secret. Some instances of this field may be defaulted, in others it may be required.
The name of the Secret resource being referred to.
The namespace of the Secret resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
A reference to a ServiceAccount resource.
Audience specifies the `aud` claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list
The name of the ServiceAccount resource being referred to.
Namespace of the resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
GCPWorkloadIdentityFederation holds the configurations required for generating federated access tokens.
audience is the Secure Token Service (STS) audience which contains the resource name for the workload identity pool and the provider identifier in that pool. If specified, Audience found in the external account credential config will be overridden with the configured value. audience must be provided when serviceAccountRef or awsSecurityCredentials is configured.
awsSecurityCredentials is for configuring AWS region and credentials to use for obtaining the access token, when using the AWS metadata server is not an option.
awsCredentialsSecretRef is the reference to the secret which holds the AWS credentials. Secret should be created with below names for keys - aws_access_key_id: Access Key ID, which is the unique identifier for the AWS account or the IAM user. - aws_secret_access_key: Secret Access Key, which is used to authenticate requests made to AWS services. - aws_session_token: Session Token, is the short-lived token to authenticate requests made to AWS services.
name of the secret.
namespace in which the secret exists. If empty, secret will looked up in local namespace.
region is for configuring the AWS region to be used.
credConfig holds the configmap reference containing the GCP external account credential configuration in JSON format and the key name containing the json data. For using Kubernetes cluster as the identity provider, use serviceAccountRef instead. Operators mounted serviceaccount token cannot be used as the token source, instead serviceAccountRef must be used by providing operators service account details.
key name holding the external account credential config.
name of the configmap.
namespace in which the configmap exists. If empty, configmap will looked up in local namespace.
externalTokenEndpoint is the endpoint explicitly set up to provide tokens, which will be matched against the credential_source.url in the provided credConfig. This field is merely to double-check the external token source URL is having the expected value.
serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens, when Kubernetes is configured as provider in workload identity pool.
Audience specifies the `aud` claim for the service account token If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity then this audiences will be appended to the list
The name of the ServiceAccount resource being referred to.
Namespace of the resource being referred to. Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
ProjectID defines which project to use to authenticate with
Source: bundle.yaml
Changes to GCRAccessToken (generators.external-secrets.io/v1alpha1) in each External Secrets Operator version, compared to the version before it.
1 property has been added
Released · View GCRAccessToken in v0.20.0
3 properties have changed the description
Released · View GCRAccessToken in v0.11.0
The description of GCRAccessToken has changed
6 properties have changed the description
Released · View GCRAccessToken in v0.9.12
The description of GCRAccessToken has changed
6 properties have changed the description
Released · View GCRAccessToken in v0.9.0
The description of GCRAccessToken has changed
6 properties have changed the description
Released · View GCRAccessToken in v0.8.12
GCRAccessToken was first seen on this version of External Secrets Operator
Released · View GCRAccessToken in v0.7.0
No examples of GCRAccessToken yet. Contribute one on GitHub.
kubespec.dev