@homeflare/distilled-openbao 0.2.0

package/src/services/kubernetes.ts

@@ -0,0 +1,446 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+/** Optional list of PEM-formated public keys or certificates used to verify the signatures of kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. */
+export type KubernetesConfigureAuthRequestPemKeysList = Array<string>;
+export const KubernetesConfigureAuthRequestPemKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<KubernetesConfigureAuthRequestPemKeysList>;
+
+export interface KubernetesConfigureAuthRequest {
+  /** Path that the backend was mounted at */
+  kubernetes_mount_path: string;
+  /** Disable JWT issuer validation (Deprecated, will be removed in a future release) */
+  disable_iss_validation?: boolean;
+  /** Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod */
+  disable_local_ca_jwt?: boolean;
+  /** Optional JWT issuer. If no issuer is specified, then this plugin will use kubernetes.io/serviceaccount as the default issuer. (Deprecated, will be removed in a future release) */
+  issuer?: string;
+  /** PEM encoded CA cert for use by the TLS client used to talk with the API. */
+  kubernetes_ca_cert?: string;
+  /** Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server. */
+  kubernetes_host?: string;
+  /** Optional list of PEM-formated public keys or certificates used to verify the signatures of kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. */
+  pem_keys?: KubernetesConfigureAuthRequestPemKeysList;
+  /** A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. */
+  token_reviewer_jwt?: string;
+}
+export const KubernetesConfigureAuthRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kubernetes_mount_path: S.String.pipe(T.Label()),
+    disable_iss_validation: S.optional(S.Boolean),
+    disable_local_ca_jwt: S.optional(S.Boolean),
+    issuer: S.optional(S.String),
+    kubernetes_ca_cert: S.optional(S.String),
+    kubernetes_host: S.optional(S.String),
+    pem_keys: S.optional(KubernetesConfigureAuthRequestPemKeysList),
+    token_reviewer_jwt: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{kubernetes_mount_path}/config",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "KubernetesConfigureAuthRequest",
+}) as any as S.Schema<KubernetesConfigureAuthRequest>;
+
+export interface KubernetesConfigureAuthResponse {}
+export const KubernetesConfigureAuthResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "KubernetesConfigureAuthResponse",
+}) as any as S.Schema<KubernetesConfigureAuthResponse>;
+
+export interface KubernetesDeleteAuthRoleRequest {
+  /** Path that the backend was mounted at */
+  kubernetes_mount_path: string;
+  /** Name of the role. */
+  name: string;
+}
+export const KubernetesDeleteAuthRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kubernetes_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{kubernetes_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "KubernetesDeleteAuthRoleRequest",
+}) as any as S.Schema<KubernetesDeleteAuthRoleRequest>;
+
+export interface KubernetesDeleteAuthRoleResponse {}
+export const KubernetesDeleteAuthRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "KubernetesDeleteAuthRoleResponse",
+}) as any as S.Schema<KubernetesDeleteAuthRoleResponse>;
+
+export type KubernetesListAuthRolesRequestList = "true";
+export const KubernetesListAuthRolesRequestList = S.String;
+
+export interface KubernetesListAuthRolesRequest {
+  /** Path that the backend was mounted at */
+  kubernetes_mount_path: string;
+  /** Must be set to `true` */
+  list: KubernetesListAuthRolesRequestList | (string & {});
+}
+export const KubernetesListAuthRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kubernetes_mount_path: S.String.pipe(T.Label()),
+    list: KubernetesListAuthRolesRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{kubernetes_mount_path}/role",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "KubernetesListAuthRolesRequest",
+}) as any as S.Schema<KubernetesListAuthRolesRequest>;
+
+export interface KubernetesListAuthRolesResponse {}
+export const KubernetesListAuthRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "KubernetesListAuthRolesResponse",
+}) as any as S.Schema<KubernetesListAuthRolesResponse>;
+
+export interface KubernetesReadAuthConfigurationRequest {
+  /** Path that the backend was mounted at */
+  kubernetes_mount_path: string;
+}
+export const KubernetesReadAuthConfigurationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kubernetes_mount_path: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/auth/{kubernetes_mount_path}/config",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "KubernetesReadAuthConfigurationRequest",
+}) as any as S.Schema<KubernetesReadAuthConfigurationRequest>;
+
+export interface KubernetesReadAuthConfigurationResponse {}
+export const KubernetesReadAuthConfigurationResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "KubernetesReadAuthConfigurationResponse",
+}) as any as S.Schema<KubernetesReadAuthConfigurationResponse>;
+
+export interface KubernetesReadAuthRoleRequest {
+  /** Path that the backend was mounted at */
+  kubernetes_mount_path: string;
+  /** Name of the role. */
+  name: string;
+}
+export const KubernetesReadAuthRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kubernetes_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{kubernetes_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "KubernetesReadAuthRoleRequest",
+}) as any as S.Schema<KubernetesReadAuthRoleRequest>;
+
+export interface KubernetesReadAuthRoleResponse {}
+export const KubernetesReadAuthRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "KubernetesReadAuthRoleResponse",
+}) as any as S.Schema<KubernetesReadAuthRoleResponse>;
+
+/** Use "token_bound_cidrs" instead. If this and "token_bound_cidrs" are both specified, only "token_bound_cidrs" will be used. */
+export type KubernetesWriteAuthRoleRequestBoundCidrsList = Array<string>;
+export const KubernetesWriteAuthRoleRequestBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<KubernetesWriteAuthRoleRequestBoundCidrsList>;
+
+/** List of service account names able to access this role. If set to "*" all names are allowed. */
+export type KubernetesWriteAuthRoleRequestBoundServiceAccountNamesList =
+  Array<string>;
+export const KubernetesWriteAuthRoleRequestBoundServiceAccountNamesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<KubernetesWriteAuthRoleRequestBoundServiceAccountNamesList>;
+
+/** List of namespaces allowed to access this role. If set to "*" all namespaces are allowed. */
+export type KubernetesWriteAuthRoleRequestBoundServiceAccountNamespacesList =
+  Array<string>;
+export const KubernetesWriteAuthRoleRequestBoundServiceAccountNamespacesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<KubernetesWriteAuthRoleRequestBoundServiceAccountNamespacesList>;
+
+/** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+export type KubernetesWriteAuthRoleRequestPoliciesList = Array<string>;
+export const KubernetesWriteAuthRoleRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<KubernetesWriteAuthRoleRequestPoliciesList>;
+
+/** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+export type KubernetesWriteAuthRoleRequestTokenBoundCidrsList = Array<string>;
+export const KubernetesWriteAuthRoleRequestTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<KubernetesWriteAuthRoleRequestTokenBoundCidrsList>;
+
+/** Comma-separated list of policies */
+export type KubernetesWriteAuthRoleRequestTokenPoliciesList = Array<string>;
+export const KubernetesWriteAuthRoleRequestTokenPoliciesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<KubernetesWriteAuthRoleRequestTokenPoliciesList>;
+
+export interface KubernetesWriteAuthRoleRequest {
+  /** Path that the backend was mounted at */
+  kubernetes_mount_path: string;
+  /** Name of the role. */
+  name: string;
+  /** Source to use when deriving the Alias name. valid choices: "serviceaccount_uid" : <token.uid> e.g. 474b11b5-0f20-4f9d-8ca5-65715ab325e0 (most secure choice) "serviceaccount_name" : <namespace>/<serviceaccount> e.g. vault/vault-agent default: "serviceaccount_uid" */
+  alias_name_source?: string;
+  /** Optional Audience claim to verify in the jwt. */
+  audience?: string;
+  /** Use "token_bound_cidrs" instead. If this and "token_bound_cidrs" are both specified, only "token_bound_cidrs" will be used. */
+  bound_cidrs?: KubernetesWriteAuthRoleRequestBoundCidrsList;
+  /** List of service account names able to access this role. If set to "*" all names are allowed. */
+  bound_service_account_names?: KubernetesWriteAuthRoleRequestBoundServiceAccountNamesList;
+  /** A label selector for Kubernetes namespaces which are allowed to access this role. Accepts either a JSON or YAML object. If set with bound_service_account_namespaces, the conditions are ORed. */
+  bound_service_account_namespace_selector?: string;
+  /** List of namespaces allowed to access this role. If set to "*" all namespaces are allowed. */
+  bound_service_account_namespaces?: KubernetesWriteAuthRoleRequestBoundServiceAccountNamespacesList;
+  /** Use "token_max_ttl" instead. If this and "token_max_ttl" are both specified, only "token_max_ttl" will be used. */
+  max_ttl?: number;
+  /** Use "token_num_uses" instead. If this and "token_num_uses" are both specified, only "token_num_uses" will be used. */
+  num_uses?: number;
+  /** Use "token_period" instead. If this and "token_period" are both specified, only "token_period" will be used. */
+  period?: number;
+  /** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+  policies?: KubernetesWriteAuthRoleRequestPoliciesList;
+  /** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+  token_bound_cidrs?: KubernetesWriteAuthRoleRequestTokenBoundCidrsList;
+  /** If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed. */
+  token_explicit_max_ttl?: number;
+  /** The maximum lifetime of the generated token */
+  token_max_ttl?: number;
+  /** If true, the 'default' policy will not automatically be added to generated tokens */
+  token_no_default_policy?: boolean;
+  /** The maximum number of times a token may be used, a value of zero means unlimited */
+  token_num_uses?: number;
+  /** If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h"). */
+  token_period?: number;
+  /** Comma-separated list of policies */
+  token_policies?: KubernetesWriteAuthRoleRequestTokenPoliciesList;
+  /** If true, CIDRs for the token will be strictly bound to the source IP address of the login request */
+  token_strictly_bind_ip?: boolean;
+  /** The initial ttl of the token to generate */
+  token_ttl?: number;
+  /** The type of token to generate, service or batch */
+  token_type?: string;
+  /** Use "token_ttl" instead. If this and "token_ttl" are both specified, only "token_ttl" will be used. */
+  ttl?: number;
+}
+export const KubernetesWriteAuthRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kubernetes_mount_path: S.String.pipe(T.Label()),
+    name: S.String.pipe(T.Label()),
+    alias_name_source: S.optional(S.String),
+    audience: S.optional(S.String),
+    bound_cidrs: S.optional(KubernetesWriteAuthRoleRequestBoundCidrsList),
+    bound_service_account_names: S.optional(
+      KubernetesWriteAuthRoleRequestBoundServiceAccountNamesList,
+    ),
+    bound_service_account_namespace_selector: S.optional(S.String),
+    bound_service_account_namespaces: S.optional(
+      KubernetesWriteAuthRoleRequestBoundServiceAccountNamespacesList,
+    ),
+    max_ttl: S.optional(S.Number),
+    num_uses: S.optional(S.Number),
+    period: S.optional(S.Number),
+    policies: S.optional(KubernetesWriteAuthRoleRequestPoliciesList),
+    token_bound_cidrs: S.optional(
+      KubernetesWriteAuthRoleRequestTokenBoundCidrsList,
+    ),
+    token_explicit_max_ttl: S.optional(S.Number),
+    token_max_ttl: S.optional(S.Number),
+    token_no_default_policy: S.optional(S.Boolean),
+    token_num_uses: S.optional(S.Number),
+    token_period: S.optional(S.Number),
+    token_policies: S.optional(KubernetesWriteAuthRoleRequestTokenPoliciesList),
+    token_strictly_bind_ip: S.optional(S.Boolean),
+    token_ttl: S.optional(S.Number),
+    token_type: S.optional(S.String),
+    ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{kubernetes_mount_path}/role/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "KubernetesWriteAuthRoleRequest",
+}) as any as S.Schema<KubernetesWriteAuthRoleRequest>;
+
+export interface KubernetesWriteAuthRoleResponse {}
+export const KubernetesWriteAuthRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "KubernetesWriteAuthRoleResponse",
+}) as any as S.Schema<KubernetesWriteAuthRoleResponse>;
+
+export interface LoginKubernetesRequest {
+  /** Path that the backend was mounted at */
+  kubernetes_mount_path: string;
+  /** A signed JWT for authenticating a service account. This field is required. */
+  jwt?: string;
+  /** Name of the role against which the login is being attempted. This field is required */
+  role?: string;
+}
+export const LoginKubernetesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kubernetes_mount_path: S.String.pipe(T.Label()),
+    jwt: S.optional(S.String),
+    role: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{kubernetes_mount_path}/login",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "LoginKubernetesRequest",
+}) as any as S.Schema<LoginKubernetesRequest>;
+
+export interface LoginKubernetesResponse {}
+export const LoginKubernetesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "LoginKubernetesResponse",
+}) as any as S.Schema<LoginKubernetesResponse>;
+
+export type KubernetesConfigureAuthError = OpenBaoOpError;
+export const kubernetesConfigureAuth: API.OperationMethod<
+  KubernetesConfigureAuthRequest,
+  KubernetesConfigureAuthResponse,
+  KubernetesConfigureAuthError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: KubernetesConfigureAuthRequest,
+  output: KubernetesConfigureAuthResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type KubernetesDeleteAuthRoleError = OpenBaoOpError;
+export const kubernetesDeleteAuthRole: API.OperationMethod<
+  KubernetesDeleteAuthRoleRequest,
+  KubernetesDeleteAuthRoleResponse,
+  KubernetesDeleteAuthRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: KubernetesDeleteAuthRoleRequest,
+  output: KubernetesDeleteAuthRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type KubernetesListAuthRolesError = OpenBaoOpError;
+export const kubernetesListAuthRoles: API.OperationMethod<
+  KubernetesListAuthRolesRequest,
+  KubernetesListAuthRolesResponse,
+  KubernetesListAuthRolesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: KubernetesListAuthRolesRequest,
+  output: KubernetesListAuthRolesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type KubernetesReadAuthConfigurationError = OpenBaoOpError;
+export const kubernetesReadAuthConfiguration: API.OperationMethod<
+  KubernetesReadAuthConfigurationRequest,
+  KubernetesReadAuthConfigurationResponse,
+  KubernetesReadAuthConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: KubernetesReadAuthConfigurationRequest,
+  output: KubernetesReadAuthConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type KubernetesReadAuthRoleError = OpenBaoOpError;
+export const kubernetesReadAuthRole: API.OperationMethod<
+  KubernetesReadAuthRoleRequest,
+  KubernetesReadAuthRoleResponse,
+  KubernetesReadAuthRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: KubernetesReadAuthRoleRequest,
+  output: KubernetesReadAuthRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type KubernetesWriteAuthRoleError = OpenBaoOpError;
+export const kubernetesWriteAuthRole: API.OperationMethod<
+  KubernetesWriteAuthRoleRequest,
+  KubernetesWriteAuthRoleResponse,
+  KubernetesWriteAuthRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: KubernetesWriteAuthRoleRequest,
+  output: KubernetesWriteAuthRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type LoginKubernetesError = OpenBaoOpError;
+export const loginKubernetes: API.OperationMethod<
+  LoginKubernetesRequest,
+  LoginKubernetesResponse,
+  LoginKubernetesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginKubernetesRequest,
+  output: LoginKubernetesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));