API Reference
Packages
vault.banzaicloud.com/v1alpha1
Package v1alpha1 contains API Schema definitions for the vault.banzaicloud.com v1alpha1 API group
AWSUnsealConfig
AWSUnsealConfig holds the parameters for AWS KMS based unsealing
Appears in:
kmsKeyId (string)
kmsRegion (string)
kmsEncryptionContext (string)
s3Bucket (string)
s3Prefix (string)
s3Region (string)
s3SSE (string)
AlibabaUnsealConfig
AlibabaUnsealConfig holds the parameters for Alibaba Cloud KMS based unsealing –alibaba-kms-region eu-central-1 –alibaba-kms-key-id 9d8063eb-f9dc-421b-be80-15d195c9f148 –alibaba-oss-endpoint oss-eu-central-1.aliyuncs.com –alibaba-oss-bucket bank-vaults
Appears in:
kmsRegion (string)
kmsKeyId (string)
ossEndpoint (string)
ossBucket (string)
ossPrefix (string)
AzureUnsealConfig
AzureUnsealConfig holds the parameters for Azure Key Vault based unsealing
Appears in:
keyVaultName (string)
CredentialsConfig
CredentialsConfig configuration for a credentials file provided as a secret
Appears in:
env (string)
path (string)
secretName (string)
EmbeddedObjectMetadata
EmbeddedObjectMetadata contains a subset of the fields included in k8s.io/apimachinery/pkg/apis/meta/v1.ObjectMeta Only fields which are relevant to embedded resources are included. controller-gen discards embedded ObjectMetadata type fields, so we have to overcome this.
Appears in:
name (string)
Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names
labels (object (keys:string, values:string))
Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: http://kubernetes.io/docs/user-guide/labels
annotations (object (keys:string, values:string))
Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: http://kubernetes.io/docs/user-guide/annotations
EmbeddedPersistentVolumeClaim
EmbeddedPersistentVolumeClaim is an embeddable and controller-gen friendly version of k8s.io/api/core/v1.PersistentVolumeClaim. It contains TypeMeta and a reduced ObjectMeta.
Appears in:
metadata (EmbeddedObjectMetadata)
Refer to Kubernetes API documentation for fields of metadata.
spec (PersistentVolumeClaimSpec)
Spec defines the desired characteristics of a volume requested by a pod author. More info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims
EmbeddedPodSpec
EmbeddedPodSpec is a description of a pod, which allows containers to be missing, almost as k8s.io/api/core/v1.PodSpec.
Appears in:
volumes (Volume array)
List of volumes that can be mounted by containers belonging to the pod. More info: https://kubernetes.io/docs/concepts/storage/volumes
initContainers (Container array)
List of initialization containers belonging to the pod. Init containers are executed in order prior to containers being started. If any init container fails, the pod is considered to have failed and is handled according to its restartPolicy. The name for an init container or normal container must be unique among all containers. Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes. The resourceRequirements of an init container are taken into account during scheduling by finding the highest request/limit for each resource type, and then using the max of of that value or the sum of the normal containers. Limits are applied to init containers in a similar fashion. Init containers cannot currently be added or removed. Cannot be updated. More info: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/
containers (Container array)
List of containers belonging to the pod. Containers cannot currently be added or removed. There must be at least one container in a Pod. Cannot be updated.
ephemeralContainers (EphemeralContainer array)
List of ephemeral containers run in this pod. Ephemeral containers may be run in an existing pod to perform user-initiated actions such as debugging. This list cannot be specified when creating a pod, and it cannot be modified by updating the pod spec. In order to add an ephemeral container to an existing pod, use the pod’s ephemeralcontainers subresource.
restartPolicy (RestartPolicy)
Restart policy for all containers within the pod. One of Always, OnFailure, Never. Default to Always. More info: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#restart-policy
terminationGracePeriodSeconds (integer)
Optional duration in seconds the pod needs to terminate gracefully. May be decreased in delete request. Value must be non-negative integer. The value zero indicates stop immediately via the kill signal (no opportunity to shut down). If this value is nil, the default grace period will be used instead. The grace period is the duration in seconds after the processes running in the pod are sent a termination signal and the time when the processes are forcibly halted with a kill signal. Set this value longer than the expected cleanup time for your process. Defaults to 30 seconds.
activeDeadlineSeconds (integer)
Optional duration in seconds the pod may be active on the node relative to StartTime before the system will actively try to mark it failed and kill associated containers. Value must be a positive integer.
dnsPolicy (DNSPolicy)
Set DNS policy for the pod. Defaults to “ClusterFirst”. Valid values are ‘ClusterFirstWithHostNet’, ‘ClusterFirst’, ‘Default’ or ‘None’. DNS parameters given in DNSConfig will be merged with the policy selected with DNSPolicy. To have DNS options set along with hostNetwork, you have to specify DNS policy explicitly to ‘ClusterFirstWithHostNet’.
nodeSelector (object (keys:string, values:string))
NodeSelector is a selector which must be true for the pod to fit on a node. Selector which must match a node’s labels for the pod to be scheduled on that node. More info: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/
serviceAccountName (string)
ServiceAccountName is the name of the ServiceAccount to use to run this pod. More info: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
serviceAccount (string)
DeprecatedServiceAccount is a depreciated alias for ServiceAccountName. Deprecated: Use serviceAccountName instead.
automountServiceAccountToken (boolean)
AutomountServiceAccountToken indicates whether a service account token should be automatically mounted.
nodeName (string)
NodeName is a request to schedule this pod onto a specific node. If it is non-empty, the scheduler simply schedules this pod onto that node, assuming that it fits resource requirements.
hostNetwork (boolean)
Host networking requested for this pod. Use the host’s network namespace. If this option is set, the ports that will be used must be specified. Default to false.
hostPID (boolean)
Use the host’s pid namespace. Optional: Default to false.
hostIPC (boolean)
Use the host’s ipc namespace. Optional: Default to false.
shareProcessNamespace (boolean)
Share a single process namespace between all of the containers in a pod. When this is set containers will be able to view and signal processes from other containers in the same pod, and the first process in each container will not be assigned PID 1. HostPID and ShareProcessNamespace cannot both be set. Optional: Default to false.
securityContext (PodSecurityContext)
SecurityContext holds pod-level security attributes and common container settings. Optional: Defaults to empty. See type description for default values of each field.
imagePullSecrets (LocalObjectReference array)
ImagePullSecrets is an optional list of references to secrets in the same namespace to use for pulling any of the images used by this PodSpec. If specified, these secrets will be passed to individual puller implementations for them to use. More info: https://kubernetes.io/docs/concepts/containers/images#specifying-imagepullsecrets-on-a-pod
hostname (string)
Specifies the hostname of the Pod If not specified, the pod’s hostname will be set to a system-defined value.
subdomain (string)
If specified, the fully qualified Pod hostname will be “
affinity (Affinity)
If specified, the pod’s scheduling constraints
schedulerName (string)
If specified, the pod will be dispatched by specified scheduler. If not specified, the pod will be dispatched by default scheduler.
tolerations (Toleration array)
If specified, the pod’s tolerations.
hostAliases (HostAlias array)
HostAliases is an optional list of hosts and IPs that will be injected into the pod’s hosts file if specified. This is only valid for non-hostNetwork pods.
priorityClassName (string)
If specified, indicates the pod’s priority. “system-node-critical” and “system-cluster-critical” are two special keywords which indicate the highest priorities with the former being the highest priority. Any other name must be defined by creating a PriorityClass object with that name. If not specified, the pod priority will be default or zero if there is no default.
priority (integer)
The priority value. Various system components use this field to find the priority of the pod. When Priority Admission Controller is enabled, it prevents users from setting this field. The admission controller populates this field from PriorityClassName. The higher the value, the higher the priority.
dnsConfig (PodDNSConfig)
Specifies the DNS parameters of a pod. Parameters specified here will be merged to the generated DNS configuration based on DNSPolicy.
readinessGates (PodReadinessGate array)
If specified, all readiness gates will be evaluated for pod readiness. A pod is ready when all its containers are ready AND all conditions specified in the readiness gates have status equal to “True” More info: https://git.k8s.io/enhancements/keps/sig-network/580-pod-readiness-gates
runtimeClassName (string)
RuntimeClassName refers to a RuntimeClass object in the node.k8s.io group, which should be used to run this pod. If no RuntimeClass resource matches the named class, the pod will not be run. If unset or empty, the “legacy” RuntimeClass will be used, which is an implicit class with an empty definition that uses the default runtime handler. More info: https://git.k8s.io/enhancements/keps/sig-node/585-runtime-class
enableServiceLinks (boolean)
EnableServiceLinks indicates whether information about services should be injected into pod’s environment variables, matching the syntax of Docker links. Optional: Defaults to true.
preemptionPolicy (PreemptionPolicy)
PreemptionPolicy is the Policy for preempting pods with lower priority. One of Never, PreemptLowerPriority. Defaults to PreemptLowerPriority if unset.
overhead (ResourceList)
Overhead represents the resource overhead associated with running a pod for a given RuntimeClass. This field will be autopopulated at admission time by the RuntimeClass admission controller. If the RuntimeClass admission controller is enabled, overhead must not be set in Pod create requests. The RuntimeClass admission controller will reject Pod create requests which have the overhead already set. If RuntimeClass is configured and selected in the PodSpec, Overhead will be set to the value defined in the corresponding RuntimeClass, otherwise it will remain unset and treated as zero. More info: https://git.k8s.io/enhancements/keps/sig-node/688-pod-overhead/README.md
topologySpreadConstraints (TopologySpreadConstraint array)
TopologySpreadConstraints describes how a group of pods ought to spread across topology domains. Scheduler will schedule pods in a way which abides by the constraints. All topologySpreadConstraints are ANDed.
setHostnameAsFQDN (boolean)
If true the pod’s hostname will be configured as the pod’s FQDN, rather than the leaf name (the default). In Linux containers, this means setting the FQDN in the hostname field of the kernel (the nodename field of struct utsname). In Windows containers, this means setting the registry value of hostname for the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters to FQDN. If a pod does not have FQDN, this has no effect. Default to false.
os (PodOS)
Specifies the OS of the containers in the pod. Some pod and container fields are restricted if this is set. If the OS field is set to linux, the following fields must be unset: -securityContext.windowsOptions If the OS field is set to windows, following fields must be unset: - spec.hostPID - spec.hostIPC - spec.hostUsers - spec.securityContext.seLinuxOptions - spec.securityContext.seccompProfile - spec.securityContext.fsGroup - spec.securityContext.fsGroupChangePolicy - spec.securityContext.sysctls - spec.shareProcessNamespace - spec.securityContext.runAsUser - spec.securityContext.runAsGroup - spec.securityContext.supplementalGroups - spec.containers[].securityContext.seLinuxOptions - spec.containers[].securityContext.seccompProfile - spec.containers[].securityContext.capabilities - spec.containers[].securityContext.readOnlyRootFilesystem - spec.containers[].securityContext.privileged - spec.containers[].securityContext.allowPrivilegeEscalation - spec.containers[].securityContext.procMount - spec.containers[].securityContext.runAsUser - spec.containers[*].securityContext.runAsGroup
hostUsers (boolean)
Use the host’s user namespace. Optional: Default to true. If set to true or not present, the pod will be run in the host user namespace, useful for when the pod needs a feature only available to the host user namespace, such as loading a kernel module with CAP_SYS_MODULE. When set to false, a new userns is created for the pod. Setting false is useful for mitigating container breakout vulnerabilities even allowing users to run their containers as root without actually having root privileges on the host. This field is alpha-level and is only honored by servers that enable the UserNamespacesSupport feature.
schedulingGates (PodSchedulingGate array)
SchedulingGates is an opaque list of values that if specified will block scheduling the pod. More info: https://git.k8s.io/enhancements/keps/sig-scheduling/3521-pod-scheduling-readiness. This is an alpha-level feature enabled by PodSchedulingReadiness feature gate.
resourceClaims (PodResourceClaim array)
ResourceClaims defines which ResourceClaims must be allocated and reserved before the Pod is allowed to start. The resources will be made available to those containers which consume them by name. This is an alpha field and requires enabling the DynamicResourceAllocation feature gate. This field is immutable.
GoogleUnsealConfig
GoogleUnsealConfig holds the parameters for Google KMS based unsealing
Appears in:
kmsKeyRing (string)
kmsCryptoKey (string)
kmsLocation (string)
kmsProject (string)
storageBucket (string)
HSMUnsealConfig
HSMUnsealConfig holds the parameters for remote HSM based unsealing
Appears in:
daemon (boolean)
modulePath (string)
slotId (integer)
tokenLabel (string)
pin (string)
keyLabel (string)
Ingress
Ingress specification for the Vault cluster
Appears in:
annotations (object (keys:string, values:string))
spec (IngressSpec)
KubernetesUnsealConfig
KubernetesUnsealConfig holds the parameters for Kubernetes based unsealing
Appears in:
secretNamespace (string)
secretName (string)
Resources
Resources holds different container’s ResourceRequirements
Appears in:
vault (ResourceRequirements)
bankVaults (ResourceRequirements)
hsmDaemon (ResourceRequirements)
prometheusExporter (ResourceRequirements)
fluentd (ResourceRequirements)
UnsealConfig
UnsealConfig represents the UnsealConfig field of a VaultSpec Kubernetes object
Appears in:
options (UnsealOptions)
kubernetes (KubernetesUnsealConfig)
google (GoogleUnsealConfig)
alibaba (AlibabaUnsealConfig)
azure (AzureUnsealConfig)
aws (AWSUnsealConfig)
vault (VaultUnsealConfig)
hsm (HSMUnsealConfig)
UnsealOptions
UnsealOptions represents the common options to all unsealing backends
Appears in:
preFlightChecks (boolean)
storeRootToken (boolean)
secretThreshold (integer)
secretShares (integer)
Vault
Vault is the Schema for the vaults API
Appears in:
apiVersion string vault.banzaicloud.com/v1alpha1
kind string Vault
metadata (ObjectMeta)
Refer to Kubernetes API documentation for fields of metadata.
spec (VaultSpec)
VaultList
VaultList contains a list of Vault
apiVersion string vault.banzaicloud.com/v1alpha1
kind string VaultList
metadata (ListMeta)
Refer to Kubernetes API documentation for fields of metadata.
items (Vault array)
VaultSpec
VaultSpec defines the desired state of Vault
Appears in:
size (integer)
Size defines the number of Vault instances in the cluster (>= 1 means HA) default: 1
image (string)
Image specifies the Vault image to use for the Vault instances default: hashicorp/vault:latest
bankVaultsImage (string)
BankVaultsImage specifies the Bank Vaults image to use for Vault unsealing and configuration default: ghcr.io/bank-vaults/bank-vaults:latest
bankVaultsVolumeMounts (VolumeMount array)
BankVaultsVolumeMounts define some extra Kubernetes Volume mounts for the Bank Vaults Sidecar container. default:
statsdDisabled (boolean)
StatsDDisabled specifies if StatsD based metrics should be disabled default: false
statsdImage (string)
StatsDImage specifices the StatsD image to use for Vault metrics exportation default: prom/statsd-exporter:latest
statsdConfig (string)
StatsdConfig specifices the StatsD mapping configuration default:
fluentdEnabled (boolean)
FluentDEnabled specifies if FluentD based log exportation should be enabled default: false
fluentdImage (string)
FluentDImage specifices the FluentD image to use for Vault log exportation default: fluent/fluentd:edge
fluentdConfLocation (string)
FluentDConfLocation is the location of the fluent.conf file default: “/fluentd/etc”
fluentdConfFile (string)
FluentDConfFile specifices the FluentD configuration file name to use for Vault log exportation default:
fluentdConfig (string)
FluentDConfig specifices the FluentD configuration to use for Vault log exportation default:
watchedSecretsLabels (object array)
WatchedSecretsLabels specifices a set of Kubernetes label selectors which select Secrets to watch. If these Secrets change the Vault cluster gets restarted. For example a Secret that Cert-Manager is managing a public Certificate for Vault using let’s Encrypt. default:
watchedSecretsAnnotations (object array)
WatchedSecretsAnnotations specifices a set of Kubernetes annotations selectors which select Secrets to watch. If these Secrets change the Vault cluster gets restarted. For example a Secret that Cert-Manager is managing a public Certificate for Vault using let’s Encrypt. default:
annotations (object (keys:string, values:string))
Annotations define a set of common Kubernetes annotations that will be added to all operator managed resources. default:
vaultAnnotations (object (keys:string, values:string))
VaultAnnotations define a set of Kubernetes annotations that will be added to all Vault Pods. default:
vaultLabels (object (keys:string, values:string))
VaultLabels define a set of Kubernetes labels that will be added to all Vault Pods. default:
vaultPodSpec (EmbeddedPodSpec)
VaultPodSpec is a Kubernetes Pod specification snippet (spec: block) that will be merged into the operator generated Vault Pod specification. default:
vaultContainerSpec (Container)
VaultContainerSpec is a Kubernetes Container specification snippet that will be merged into the operator generated Vault Container specification. default:
vaultConfigurerAnnotations (object (keys:string, values:string))
VaultConfigurerAnnotations define a set of Kubernetes annotations that will be added to the Vault Configurer Pod. default:
vaultConfigurerLabels (object (keys:string, values:string))
VaultConfigurerLabels define a set of Kubernetes labels that will be added to all Vault Configurer Pod. default:
vaultConfigurerPodSpec (EmbeddedPodSpec)
VaultConfigurerPodSpec is a Kubernetes Pod specification snippet (spec: block) that will be merged into the operator generated Vault Configurer Pod specification. default:
config (JSON)
Config is the Vault Server configuration. See https://www.vaultproject.io/docs/configuration/ for more details. default:
externalConfig (JSON)
ExternalConfig is higher level configuration block which instructs the Bank Vaults Configurer to configure Vault through its API, thus allows setting up: - Secret Engines - Auth Methods - Audit Devices - Plugin Backends - Policies - Startup Secrets (Bank Vaults feature) A documented example: https://github.com/bank-vaults/vault-operator/blob/main/vault-config.yml default:
unsealConfig (UnsealConfig)
UnsealConfig defines where the Vault cluster’s unseal keys and root token should be stored after initialization. See the type’s documentation for more details. Only one method may be specified. default: Kubernetes Secret based unsealing
credentialsConfig (CredentialsConfig)
CredentialsConfig defines a external Secret for Vault and how it should be mounted to the Vault Pod for example accessing Cloud resources. default:
envsConfig (EnvVar array)
EnvsConfig is a list of Kubernetes environment variable definitions that will be passed to all Bank-Vaults pods. default:
securityContext (PodSecurityContext)
SecurityContext is a Kubernetes PodSecurityContext that will be applied to all Pods created by the operator. default:
serviceType (string)
ServiceType is a Kubernetes Service type of the Vault Service. default: ClusterIP
loadBalancerIP (string)
LoadBalancerIP is an optional setting for allocating a specific address for the entry service object of type LoadBalancer default: ""
serviceRegistrationEnabled (boolean)
serviceRegistrationEnabled enables the injection of the service_registration Vault stanza. This requires elaborated RBAC privileges for updating Pod labels for the Vault Pod. default: false
raftLeaderAddress (string)
RaftLeaderAddress defines the leader address of the raft cluster in multi-cluster deployments. (In single cluster (namespace) deployments it is automatically detected). “self” is a special value which means that this instance should be the bootstrap leader instance. default: ""
servicePorts (object (keys:string, values:integer))
ServicePorts is an extra map of ports that should be exposed by the Vault Service. default:
affinity (Affinity)
Affinity is a group of affinity scheduling rules applied to all Vault Pods. default:
podAntiAffinity (string)
PodAntiAffinity is the TopologyKey in the Vault Pod’s PodAntiAffinity. No PodAntiAffinity is used if empty. Deprecated. Use Affinity. default:
nodeAffinity (NodeAffinity)
NodeAffinity is Kubernetees NodeAffinity definition that should be applied to all Vault Pods. Deprecated. Use Affinity. default:
nodeSelector (object (keys:string, values:string))
NodeSelector is Kubernetees NodeSelector definition that should be applied to all Vault Pods. default:
tolerations (Toleration array)
Tolerations is Kubernetes Tolerations definition that should be applied to all Vault Pods. default:
serviceAccount (string)
ServiceAccount is Kubernetes ServiceAccount in which the Vault Pods should be running in. default: default
volumes (Volume array)
Volumes define some extra Kubernetes Volumes for the Vault Pods. default:
volumeMounts (VolumeMount array)
VolumeMounts define some extra Kubernetes Volume mounts for the Vault Pods. default:
volumeClaimTemplates (EmbeddedPersistentVolumeClaim array)
VolumeClaimTemplates define some extra Kubernetes PersistentVolumeClaim templates for the Vault Statefulset. default:
vaultEnvsConfig (EnvVar array)
VaultEnvsConfig is a list of Kubernetes environment variable definitions that will be passed to the Vault container. default:
sidecarEnvsConfig (EnvVar array)
SidecarEnvsConfig is a list of Kubernetes environment variable definitions that will be passed to Vault sidecar containers. default:
resources (Resources)
Resources defines the resource limits for all the resources created by the operator. See the type for more details. default:
ingress (Ingress)
Ingress, if it is specified the operator will create an Ingress resource for the Vault Service and will annotate it with the correct Ingress annotations specific to the TLS settings in the configuration. See the type for more details. default:
serviceMonitorEnabled (boolean)
ServiceMonitorEnabled enables the creation of Prometheus Operator specific ServiceMonitor for Vault. default: false
existingTlsSecretName (string)
ExistingTLSSecretName is name of the secret that contains a TLS server certificate and key and the corresponding CA certificate. Required secret format kubernetes.io/tls type secret keys + ca.crt key If it is set, generating certificate will be disabled default: ""
tlsExpiryThreshold (string)
TLSExpiryThreshold is the Vault TLS certificate expiration threshold in Go’s Duration format. default: 168h
tlsAdditionalHosts (string array)
TLSAdditionalHosts is a list of additional hostnames or IP addresses to add to the SAN on the automatically generated TLS certificate. default:
caNamespaces (string array)
CANamespaces define a list of namespaces where the generated CA certificate for Vault should be distributed, use ["*"] for all namespaces. default:
istioEnabled (boolean)
IstioEnabled describes if the cluster has a Istio running and enabled. default: false
veleroEnabled (boolean)
VeleroEnabled describes if the cluster has a Velero running and enabled. default: false
veleroFsfreezeImage (string)
VeleroFsfreezeImage specifices the Velero Fsrfeeze image to use in Velero backup hooks default: velero/fsfreeze-pause:latest
vaultContainers (Container array)
VaultContainers add extra containers
vaultInitContainers (Container array)
VaultInitContainers add extra initContainers
VaultUnsealConfig
VaultUnsealConfig holds the parameters for remote Vault based unsealing
Appears in: