@pulumi/vault 6.2.0-alpha.1718953130 → 6.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/authBackend.d.ts +12 -0
- package/authBackend.js +2 -0
- package/authBackend.js.map +1 -1
- package/aws/authBackendClient.d.ts +76 -3
- package/aws/authBackendClient.js +21 -0
- package/aws/authBackendClient.js.map +1 -1
- package/aws/secretBackendRole.d.ts +21 -0
- package/aws/secretBackendRole.js +2 -0
- package/aws/secretBackendRole.js.map +1 -1
- package/azure/authBackendConfig.d.ts +45 -0
- package/azure/authBackendConfig.js +22 -0
- package/azure/authBackendConfig.js.map +1 -1
- package/azure/backend.d.ts +65 -0
- package/azure/backend.js +20 -0
- package/azure/backend.js.map +1 -1
- package/database/secretsMount.d.ts +72 -0
- package/database/secretsMount.js +12 -0
- package/database/secretsMount.js.map +1 -1
- package/gcp/authBackend.d.ts +75 -0
- package/gcp/authBackend.js +23 -0
- package/gcp/authBackend.js.map +1 -1
- package/gcp/secretBackend.d.ts +81 -0
- package/gcp/secretBackend.js +23 -0
- package/gcp/secretBackend.js.map +1 -1
- package/index.d.ts +6 -0
- package/index.js +12 -2
- package/index.js.map +1 -1
- package/jwt/authBackendRole.d.ts +12 -15
- package/jwt/authBackendRole.js.map +1 -1
- package/kubernetes/secretBackend.d.ts +72 -0
- package/kubernetes/secretBackend.js +12 -0
- package/kubernetes/secretBackend.js.map +1 -1
- package/ldap/secretBackend.d.ts +72 -0
- package/ldap/secretBackend.js +12 -0
- package/ldap/secretBackend.js.map +1 -1
- package/mount.d.ts +90 -0
- package/mount.js +12 -0
- package/mount.js.map +1 -1
- package/okta/authBackend.d.ts +120 -0
- package/okta/authBackend.js +18 -0
- package/okta/authBackend.js.map +1 -1
- package/package.json +2 -2
- package/pkisecret/backendConfigEst.d.ts +191 -0
- package/pkisecret/backendConfigEst.js +83 -0
- package/pkisecret/backendConfigEst.js.map +1 -0
- package/pkisecret/getBackendConfigEst.d.ts +117 -0
- package/pkisecret/getBackendConfigEst.js +54 -0
- package/pkisecret/getBackendConfigEst.js.map +1 -0
- package/pkisecret/index.d.ts +6 -0
- package/pkisecret/index.js +9 -1
- package/pkisecret/index.js.map +1 -1
- package/plugin.d.ts +179 -0
- package/plugin.js +105 -0
- package/plugin.js.map +1 -0
- package/pluginPinnedVersion.d.ts +103 -0
- package/pluginPinnedVersion.js +90 -0
- package/pluginPinnedVersion.js.map +1 -0
- package/quotaLeaseCount.d.ts +12 -0
- package/quotaLeaseCount.js +2 -0
- package/quotaLeaseCount.js.map +1 -1
- package/quotaRateLimit.d.ts +12 -0
- package/quotaRateLimit.js +2 -0
- package/quotaRateLimit.js.map +1 -1
- package/ssh/secretBackendCa.d.ts +24 -0
- package/ssh/secretBackendCa.js +4 -0
- package/ssh/secretBackendCa.js.map +1 -1
- package/types/input.d.ts +8 -0
- package/types/output.d.ts +22 -0
package/authBackend.d.ts
CHANGED
|
@@ -39,6 +39,10 @@ export declare class AuthBackend extends pulumi.CustomResource {
|
|
|
39
39
|
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
40
40
|
*/
|
|
41
41
|
readonly disableRemount: pulumi.Output<boolean | undefined>;
|
|
42
|
+
/**
|
|
43
|
+
* The key to use for signing identity tokens.
|
|
44
|
+
*/
|
|
45
|
+
readonly identityTokenKey: pulumi.Output<string | undefined>;
|
|
42
46
|
/**
|
|
43
47
|
* Specifies if the auth method is local only.
|
|
44
48
|
*/
|
|
@@ -90,6 +94,10 @@ export interface AuthBackendState {
|
|
|
90
94
|
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
91
95
|
*/
|
|
92
96
|
disableRemount?: pulumi.Input<boolean>;
|
|
97
|
+
/**
|
|
98
|
+
* The key to use for signing identity tokens.
|
|
99
|
+
*/
|
|
100
|
+
identityTokenKey?: pulumi.Input<string>;
|
|
93
101
|
/**
|
|
94
102
|
* Specifies if the auth method is local only.
|
|
95
103
|
*/
|
|
@@ -129,6 +137,10 @@ export interface AuthBackendArgs {
|
|
|
129
137
|
* See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
130
138
|
*/
|
|
131
139
|
disableRemount?: pulumi.Input<boolean>;
|
|
140
|
+
/**
|
|
141
|
+
* The key to use for signing identity tokens.
|
|
142
|
+
*/
|
|
143
|
+
identityTokenKey?: pulumi.Input<string>;
|
|
132
144
|
/**
|
|
133
145
|
* Specifies if the auth method is local only.
|
|
134
146
|
*/
|
package/authBackend.js
CHANGED
|
@@ -45,6 +45,7 @@ class AuthBackend extends pulumi.CustomResource {
|
|
|
45
45
|
resourceInputs["accessor"] = state ? state.accessor : undefined;
|
|
46
46
|
resourceInputs["description"] = state ? state.description : undefined;
|
|
47
47
|
resourceInputs["disableRemount"] = state ? state.disableRemount : undefined;
|
|
48
|
+
resourceInputs["identityTokenKey"] = state ? state.identityTokenKey : undefined;
|
|
48
49
|
resourceInputs["local"] = state ? state.local : undefined;
|
|
49
50
|
resourceInputs["namespace"] = state ? state.namespace : undefined;
|
|
50
51
|
resourceInputs["path"] = state ? state.path : undefined;
|
|
@@ -58,6 +59,7 @@ class AuthBackend extends pulumi.CustomResource {
|
|
|
58
59
|
}
|
|
59
60
|
resourceInputs["description"] = args ? args.description : undefined;
|
|
60
61
|
resourceInputs["disableRemount"] = args ? args.disableRemount : undefined;
|
|
62
|
+
resourceInputs["identityTokenKey"] = args ? args.identityTokenKey : undefined;
|
|
61
63
|
resourceInputs["local"] = args ? args.local : undefined;
|
|
62
64
|
resourceInputs["namespace"] = args ? args.namespace : undefined;
|
|
63
65
|
resourceInputs["path"] = args ? args.path : undefined;
|
package/authBackend.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authBackend.js","sourceRoot":"","sources":["../authBackend.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AAGzC,yCAAyC;AAEzC;;;;;;;;GAQG;AACH,MAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAwB,EAAE,IAAmC;QACtH,OAAO,IAAI,WAAW,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IAClE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;IAC5D,CAAC;
|
|
1
|
+
{"version":3,"file":"authBackend.js","sourceRoot":"","sources":["../authBackend.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AAGzC,yCAAyC;AAEzC;;;;;;;;GAQG;AACH,MAAa,WAAY,SAAQ,MAAM,CAAC,cAAc;IAClD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAAwB,EAAE,IAAmC;QACtH,OAAO,IAAI,WAAW,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IAClE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,WAAW,CAAC,YAAY,CAAC;IAC5D,CAAC;IAqDD,YAAY,IAAY,EAAE,WAAgD,EAAE,IAAmC;QAC3G,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAA2C,CAAC;YAC1D,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,cAAc,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,cAAc,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1D,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;SAC3D;aAAM;YACH,MAAM,IAAI,GAAG,WAA0C,CAAC;YACxD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACjD,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;aACvD;YACD,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,cAAc,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,cAAc,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC;SAClD;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IAChE,CAAC;;AA9GL,kCA+GC;AAjGG,gBAAgB;AACO,wBAAY,GAAG,qCAAqC,CAAC"}
|
|
@@ -2,6 +2,19 @@ import * as pulumi from "@pulumi/pulumi";
|
|
|
2
2
|
/**
|
|
3
3
|
* ## Example Usage
|
|
4
4
|
*
|
|
5
|
+
* You can setup the AWS auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
6
|
+
* ```typescript
|
|
7
|
+
* import * as pulumi from "@pulumi/pulumi";
|
|
8
|
+
* import * as vault from "@pulumi/vault";
|
|
9
|
+
*
|
|
10
|
+
* const example = new vault.AuthBackend("example", {type: "aws"});
|
|
11
|
+
* const exampleAuthBackendClient = new vault.aws.AuthBackendClient("example", {
|
|
12
|
+
* identityTokenAudience: "<TOKEN_AUDIENCE>",
|
|
13
|
+
* identityTokenTtl: "<TOKEN_TTL>",
|
|
14
|
+
* roleArn: "<AWS_ROLE_ARN>",
|
|
15
|
+
* });
|
|
16
|
+
* ```
|
|
17
|
+
*
|
|
5
18
|
* ```typescript
|
|
6
19
|
* import * as pulumi from "@pulumi/pulumi";
|
|
7
20
|
* import * as vault from "@pulumi/vault";
|
|
@@ -40,7 +53,7 @@ export declare class AuthBackendClient extends pulumi.CustomResource {
|
|
|
40
53
|
static isInstance(obj: any): obj is AuthBackendClient;
|
|
41
54
|
/**
|
|
42
55
|
* The AWS access key that Vault should use for the
|
|
43
|
-
* auth backend.
|
|
56
|
+
* auth backend. Mutually exclusive with `identityTokenAudience`.
|
|
44
57
|
*/
|
|
45
58
|
readonly accessKey: pulumi.Output<string | undefined>;
|
|
46
59
|
/**
|
|
@@ -64,6 +77,21 @@ export declare class AuthBackendClient extends pulumi.CustomResource {
|
|
|
64
77
|
* that are used in the IAM auth method.
|
|
65
78
|
*/
|
|
66
79
|
readonly iamServerIdHeaderValue: pulumi.Output<string | undefined>;
|
|
80
|
+
/**
|
|
81
|
+
* The audience claim value. Mutually exclusive with `accessKey`.
|
|
82
|
+
* Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
83
|
+
*/
|
|
84
|
+
readonly identityTokenAudience: pulumi.Output<string | undefined>;
|
|
85
|
+
/**
|
|
86
|
+
* The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
87
|
+
* *Available only for Vault Enterprise*
|
|
88
|
+
*/
|
|
89
|
+
readonly identityTokenTtl: pulumi.Output<number>;
|
|
90
|
+
/**
|
|
91
|
+
* Number of max retries the client should use for recoverable errors.
|
|
92
|
+
* The default `-1` falls back to the AWS SDK's default behavior.
|
|
93
|
+
*/
|
|
94
|
+
readonly maxRetries: pulumi.Output<number | undefined>;
|
|
67
95
|
/**
|
|
68
96
|
* The namespace to provision the resource in.
|
|
69
97
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -71,6 +99,11 @@ export declare class AuthBackendClient extends pulumi.CustomResource {
|
|
|
71
99
|
* *Available only for Vault Enterprise*.
|
|
72
100
|
*/
|
|
73
101
|
readonly namespace: pulumi.Output<string | undefined>;
|
|
102
|
+
/**
|
|
103
|
+
* Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
104
|
+
* *Available only for Vault Enterprise*
|
|
105
|
+
*/
|
|
106
|
+
readonly roleArn: pulumi.Output<string | undefined>;
|
|
74
107
|
/**
|
|
75
108
|
* The AWS secret key that Vault should use for the
|
|
76
109
|
* auth backend.
|
|
@@ -109,7 +142,7 @@ export declare class AuthBackendClient extends pulumi.CustomResource {
|
|
|
109
142
|
export interface AuthBackendClientState {
|
|
110
143
|
/**
|
|
111
144
|
* The AWS access key that Vault should use for the
|
|
112
|
-
* auth backend.
|
|
145
|
+
* auth backend. Mutually exclusive with `identityTokenAudience`.
|
|
113
146
|
*/
|
|
114
147
|
accessKey?: pulumi.Input<string>;
|
|
115
148
|
/**
|
|
@@ -133,6 +166,21 @@ export interface AuthBackendClientState {
|
|
|
133
166
|
* that are used in the IAM auth method.
|
|
134
167
|
*/
|
|
135
168
|
iamServerIdHeaderValue?: pulumi.Input<string>;
|
|
169
|
+
/**
|
|
170
|
+
* The audience claim value. Mutually exclusive with `accessKey`.
|
|
171
|
+
* Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
172
|
+
*/
|
|
173
|
+
identityTokenAudience?: pulumi.Input<string>;
|
|
174
|
+
/**
|
|
175
|
+
* The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
176
|
+
* *Available only for Vault Enterprise*
|
|
177
|
+
*/
|
|
178
|
+
identityTokenTtl?: pulumi.Input<number>;
|
|
179
|
+
/**
|
|
180
|
+
* Number of max retries the client should use for recoverable errors.
|
|
181
|
+
* The default `-1` falls back to the AWS SDK's default behavior.
|
|
182
|
+
*/
|
|
183
|
+
maxRetries?: pulumi.Input<number>;
|
|
136
184
|
/**
|
|
137
185
|
* The namespace to provision the resource in.
|
|
138
186
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -140,6 +188,11 @@ export interface AuthBackendClientState {
|
|
|
140
188
|
* *Available only for Vault Enterprise*.
|
|
141
189
|
*/
|
|
142
190
|
namespace?: pulumi.Input<string>;
|
|
191
|
+
/**
|
|
192
|
+
* Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
193
|
+
* *Available only for Vault Enterprise*
|
|
194
|
+
*/
|
|
195
|
+
roleArn?: pulumi.Input<string>;
|
|
143
196
|
/**
|
|
144
197
|
* The AWS secret key that Vault should use for the
|
|
145
198
|
* auth backend.
|
|
@@ -170,7 +223,7 @@ export interface AuthBackendClientState {
|
|
|
170
223
|
export interface AuthBackendClientArgs {
|
|
171
224
|
/**
|
|
172
225
|
* The AWS access key that Vault should use for the
|
|
173
|
-
* auth backend.
|
|
226
|
+
* auth backend. Mutually exclusive with `identityTokenAudience`.
|
|
174
227
|
*/
|
|
175
228
|
accessKey?: pulumi.Input<string>;
|
|
176
229
|
/**
|
|
@@ -194,6 +247,21 @@ export interface AuthBackendClientArgs {
|
|
|
194
247
|
* that are used in the IAM auth method.
|
|
195
248
|
*/
|
|
196
249
|
iamServerIdHeaderValue?: pulumi.Input<string>;
|
|
250
|
+
/**
|
|
251
|
+
* The audience claim value. Mutually exclusive with `accessKey`.
|
|
252
|
+
* Requires Vault 1.17+. *Available only for Vault Enterprise*
|
|
253
|
+
*/
|
|
254
|
+
identityTokenAudience?: pulumi.Input<string>;
|
|
255
|
+
/**
|
|
256
|
+
* The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
257
|
+
* *Available only for Vault Enterprise*
|
|
258
|
+
*/
|
|
259
|
+
identityTokenTtl?: pulumi.Input<number>;
|
|
260
|
+
/**
|
|
261
|
+
* Number of max retries the client should use for recoverable errors.
|
|
262
|
+
* The default `-1` falls back to the AWS SDK's default behavior.
|
|
263
|
+
*/
|
|
264
|
+
maxRetries?: pulumi.Input<number>;
|
|
197
265
|
/**
|
|
198
266
|
* The namespace to provision the resource in.
|
|
199
267
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -201,6 +269,11 @@ export interface AuthBackendClientArgs {
|
|
|
201
269
|
* *Available only for Vault Enterprise*.
|
|
202
270
|
*/
|
|
203
271
|
namespace?: pulumi.Input<string>;
|
|
272
|
+
/**
|
|
273
|
+
* Role ARN to assume for plugin identity token federation. Requires Vault 1.17+.
|
|
274
|
+
* *Available only for Vault Enterprise*
|
|
275
|
+
*/
|
|
276
|
+
roleArn?: pulumi.Input<string>;
|
|
204
277
|
/**
|
|
205
278
|
* The AWS secret key that Vault should use for the
|
|
206
279
|
* auth backend.
|
package/aws/authBackendClient.js
CHANGED
|
@@ -8,6 +8,19 @@ const utilities = require("../utilities");
|
|
|
8
8
|
/**
|
|
9
9
|
* ## Example Usage
|
|
10
10
|
*
|
|
11
|
+
* You can setup the AWS auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
12
|
+
* ```typescript
|
|
13
|
+
* import * as pulumi from "@pulumi/pulumi";
|
|
14
|
+
* import * as vault from "@pulumi/vault";
|
|
15
|
+
*
|
|
16
|
+
* const example = new vault.AuthBackend("example", {type: "aws"});
|
|
17
|
+
* const exampleAuthBackendClient = new vault.aws.AuthBackendClient("example", {
|
|
18
|
+
* identityTokenAudience: "<TOKEN_AUDIENCE>",
|
|
19
|
+
* identityTokenTtl: "<TOKEN_TTL>",
|
|
20
|
+
* roleArn: "<AWS_ROLE_ARN>",
|
|
21
|
+
* });
|
|
22
|
+
* ```
|
|
23
|
+
*
|
|
11
24
|
* ```typescript
|
|
12
25
|
* import * as pulumi from "@pulumi/pulumi";
|
|
13
26
|
* import * as vault from "@pulumi/vault";
|
|
@@ -61,7 +74,11 @@ class AuthBackendClient extends pulumi.CustomResource {
|
|
|
61
74
|
resourceInputs["ec2Endpoint"] = state ? state.ec2Endpoint : undefined;
|
|
62
75
|
resourceInputs["iamEndpoint"] = state ? state.iamEndpoint : undefined;
|
|
63
76
|
resourceInputs["iamServerIdHeaderValue"] = state ? state.iamServerIdHeaderValue : undefined;
|
|
77
|
+
resourceInputs["identityTokenAudience"] = state ? state.identityTokenAudience : undefined;
|
|
78
|
+
resourceInputs["identityTokenTtl"] = state ? state.identityTokenTtl : undefined;
|
|
79
|
+
resourceInputs["maxRetries"] = state ? state.maxRetries : undefined;
|
|
64
80
|
resourceInputs["namespace"] = state ? state.namespace : undefined;
|
|
81
|
+
resourceInputs["roleArn"] = state ? state.roleArn : undefined;
|
|
65
82
|
resourceInputs["secretKey"] = state ? state.secretKey : undefined;
|
|
66
83
|
resourceInputs["stsEndpoint"] = state ? state.stsEndpoint : undefined;
|
|
67
84
|
resourceInputs["stsRegion"] = state ? state.stsRegion : undefined;
|
|
@@ -74,7 +91,11 @@ class AuthBackendClient extends pulumi.CustomResource {
|
|
|
74
91
|
resourceInputs["ec2Endpoint"] = args ? args.ec2Endpoint : undefined;
|
|
75
92
|
resourceInputs["iamEndpoint"] = args ? args.iamEndpoint : undefined;
|
|
76
93
|
resourceInputs["iamServerIdHeaderValue"] = args ? args.iamServerIdHeaderValue : undefined;
|
|
94
|
+
resourceInputs["identityTokenAudience"] = args ? args.identityTokenAudience : undefined;
|
|
95
|
+
resourceInputs["identityTokenTtl"] = args ? args.identityTokenTtl : undefined;
|
|
96
|
+
resourceInputs["maxRetries"] = args ? args.maxRetries : undefined;
|
|
77
97
|
resourceInputs["namespace"] = args ? args.namespace : undefined;
|
|
98
|
+
resourceInputs["roleArn"] = args ? args.roleArn : undefined;
|
|
78
99
|
resourceInputs["secretKey"] = (args === null || args === void 0 ? void 0 : args.secretKey) ? pulumi.secret(args.secretKey) : undefined;
|
|
79
100
|
resourceInputs["stsEndpoint"] = args ? args.stsEndpoint : undefined;
|
|
80
101
|
resourceInputs["stsRegion"] = args ? args.stsRegion : undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authBackendClient.js","sourceRoot":"","sources":["../../aws/authBackendClient.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C
|
|
1
|
+
{"version":3,"file":"authBackendClient.js","sourceRoot":"","sources":["../../aws/authBackendClient.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,MAAa,iBAAkB,SAAQ,MAAM,CAAC,cAAc;IACxD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAA8B,EAAE,IAAmC;QAC5H,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IACxE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,iBAAiB,CAAC,YAAY,CAAC;IAClE,CAAC;IAuFD,YAAY,IAAY,EAAE,WAA4D,EAAE,IAAmC;QACvH,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAAiD,CAAC;YAChE,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,cAAc,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;SAC/F;aAAM;YACH,MAAM,IAAI,GAAG,WAAgD,CAAC;YAC9D,cAAc,CAAC,WAAW,CAAC,GAAG,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,SAAS,EAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,cAAc,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,WAAW,CAAC,GAAG,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,SAAS,EAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;SAC7F;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3E,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;;AAzJL,8CA0JC;AA5IG,gBAAgB;AACO,8BAAY,GAAG,+CAA+C,CAAC"}
|
|
@@ -80,6 +80,13 @@ export declare class SecretBackendRole extends pulumi.CustomResource {
|
|
|
80
80
|
* and `policyArns` parameters.
|
|
81
81
|
*/
|
|
82
82
|
readonly iamGroups: pulumi.Output<string[] | undefined>;
|
|
83
|
+
/**
|
|
84
|
+
* A map of strings representing key/value pairs
|
|
85
|
+
* to be used as tags for any IAM user that is created by this role.
|
|
86
|
+
*/
|
|
87
|
+
readonly iamTags: pulumi.Output<{
|
|
88
|
+
[key: string]: string;
|
|
89
|
+
} | undefined>;
|
|
83
90
|
/**
|
|
84
91
|
* The max allowed TTL in seconds for STS credentials
|
|
85
92
|
* (credentials TTL are capped to `maxStsTtl`). Valid only when `credentialType` is
|
|
@@ -175,6 +182,13 @@ export interface SecretBackendRoleState {
|
|
|
175
182
|
* and `policyArns` parameters.
|
|
176
183
|
*/
|
|
177
184
|
iamGroups?: pulumi.Input<pulumi.Input<string>[]>;
|
|
185
|
+
/**
|
|
186
|
+
* A map of strings representing key/value pairs
|
|
187
|
+
* to be used as tags for any IAM user that is created by this role.
|
|
188
|
+
*/
|
|
189
|
+
iamTags?: pulumi.Input<{
|
|
190
|
+
[key: string]: pulumi.Input<string>;
|
|
191
|
+
}>;
|
|
178
192
|
/**
|
|
179
193
|
* The max allowed TTL in seconds for STS credentials
|
|
180
194
|
* (credentials TTL are capped to `maxStsTtl`). Valid only when `credentialType` is
|
|
@@ -262,6 +276,13 @@ export interface SecretBackendRoleArgs {
|
|
|
262
276
|
* and `policyArns` parameters.
|
|
263
277
|
*/
|
|
264
278
|
iamGroups?: pulumi.Input<pulumi.Input<string>[]>;
|
|
279
|
+
/**
|
|
280
|
+
* A map of strings representing key/value pairs
|
|
281
|
+
* to be used as tags for any IAM user that is created by this role.
|
|
282
|
+
*/
|
|
283
|
+
iamTags?: pulumi.Input<{
|
|
284
|
+
[key: string]: pulumi.Input<string>;
|
|
285
|
+
}>;
|
|
265
286
|
/**
|
|
266
287
|
* The max allowed TTL in seconds for STS credentials
|
|
267
288
|
* (credentials TTL are capped to `maxStsTtl`). Valid only when `credentialType` is
|
package/aws/secretBackendRole.js
CHANGED
|
@@ -74,6 +74,7 @@ class SecretBackendRole extends pulumi.CustomResource {
|
|
|
74
74
|
resourceInputs["credentialType"] = state ? state.credentialType : undefined;
|
|
75
75
|
resourceInputs["defaultStsTtl"] = state ? state.defaultStsTtl : undefined;
|
|
76
76
|
resourceInputs["iamGroups"] = state ? state.iamGroups : undefined;
|
|
77
|
+
resourceInputs["iamTags"] = state ? state.iamTags : undefined;
|
|
77
78
|
resourceInputs["maxStsTtl"] = state ? state.maxStsTtl : undefined;
|
|
78
79
|
resourceInputs["name"] = state ? state.name : undefined;
|
|
79
80
|
resourceInputs["namespace"] = state ? state.namespace : undefined;
|
|
@@ -95,6 +96,7 @@ class SecretBackendRole extends pulumi.CustomResource {
|
|
|
95
96
|
resourceInputs["credentialType"] = args ? args.credentialType : undefined;
|
|
96
97
|
resourceInputs["defaultStsTtl"] = args ? args.defaultStsTtl : undefined;
|
|
97
98
|
resourceInputs["iamGroups"] = args ? args.iamGroups : undefined;
|
|
99
|
+
resourceInputs["iamTags"] = args ? args.iamTags : undefined;
|
|
98
100
|
resourceInputs["maxStsTtl"] = args ? args.maxStsTtl : undefined;
|
|
99
101
|
resourceInputs["name"] = args ? args.name : undefined;
|
|
100
102
|
resourceInputs["namespace"] = args ? args.namespace : undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"secretBackendRole.js","sourceRoot":"","sources":["../../aws/secretBackendRole.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAa,iBAAkB,SAAQ,MAAM,CAAC,cAAc;IACxD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAA8B,EAAE,IAAmC;QAC5H,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IACxE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,iBAAiB,CAAC,YAAY,CAAC;IAClE,CAAC;
|
|
1
|
+
{"version":3,"file":"secretBackendRole.js","sourceRoot":"","sources":["../../aws/secretBackendRole.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,MAAa,iBAAkB,SAAQ,MAAM,CAAC,cAAc;IACxD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAA8B,EAAE,IAAmC;QAC5H,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IACxE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,iBAAiB,CAAC,YAAY,CAAC;IAClE,CAAC;IAkGD,YAAY,IAAY,EAAE,WAA4D,EAAE,IAAmC;QACvH,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAAiD,CAAC;YAChE,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,cAAc,CAAC,eAAe,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACxD,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,wBAAwB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5F,cAAc,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,gBAAgB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5E,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;SACnE;aAAM;YACH,MAAM,IAAI,GAAG,WAAgD,CAAC;YAC9D,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACpD,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;aAC1D;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC3D,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;aACjE;YACD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,cAAc,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;YACtD,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,wBAAwB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1E,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;SACjE;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,KAAK,CAAC,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;;AAtKL,8CAuKC;AAzJG,gBAAgB;AACO,8BAAY,GAAG,+CAA+C,CAAC"}
|
|
@@ -2,6 +2,24 @@ import * as pulumi from "@pulumi/pulumi";
|
|
|
2
2
|
/**
|
|
3
3
|
* ## Example Usage
|
|
4
4
|
*
|
|
5
|
+
* You can setup the Azure auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
6
|
+
* ```typescript
|
|
7
|
+
* import * as pulumi from "@pulumi/pulumi";
|
|
8
|
+
* import * as vault from "@pulumi/vault";
|
|
9
|
+
*
|
|
10
|
+
* const example = new vault.AuthBackend("example", {
|
|
11
|
+
* type: "azure",
|
|
12
|
+
* identityTokenKey: "example-key",
|
|
13
|
+
* });
|
|
14
|
+
* const exampleAuthBackendConfig = new vault.azure.AuthBackendConfig("example", {
|
|
15
|
+
* backend: example.path,
|
|
16
|
+
* tenantId: "11111111-2222-3333-4444-555555555555",
|
|
17
|
+
* clientId: "11111111-2222-3333-4444-555555555555",
|
|
18
|
+
* identityTokenAudience: "<TOKEN_AUDIENCE>",
|
|
19
|
+
* identityTokenTtl: "<TOKEN_TTL>",
|
|
20
|
+
* });
|
|
21
|
+
* ```
|
|
22
|
+
*
|
|
5
23
|
* ```typescript
|
|
6
24
|
* import * as pulumi from "@pulumi/pulumi";
|
|
7
25
|
* import * as vault from "@pulumi/vault";
|
|
@@ -61,6 +79,15 @@ export declare class AuthBackendConfig extends pulumi.CustomResource {
|
|
|
61
79
|
* AzureGermanCloud. Defaults to `AzurePublicCloud`.
|
|
62
80
|
*/
|
|
63
81
|
readonly environment: pulumi.Output<string | undefined>;
|
|
82
|
+
/**
|
|
83
|
+
* The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
84
|
+
* *Available only for Vault Enterprise*
|
|
85
|
+
*/
|
|
86
|
+
readonly identityTokenAudience: pulumi.Output<string | undefined>;
|
|
87
|
+
/**
|
|
88
|
+
* The TTL of generated identity tokens in seconds.
|
|
89
|
+
*/
|
|
90
|
+
readonly identityTokenTtl: pulumi.Output<number>;
|
|
64
91
|
/**
|
|
65
92
|
* The namespace to provision the resource in.
|
|
66
93
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -112,6 +139,15 @@ export interface AuthBackendConfigState {
|
|
|
112
139
|
* AzureGermanCloud. Defaults to `AzurePublicCloud`.
|
|
113
140
|
*/
|
|
114
141
|
environment?: pulumi.Input<string>;
|
|
142
|
+
/**
|
|
143
|
+
* The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
144
|
+
* *Available only for Vault Enterprise*
|
|
145
|
+
*/
|
|
146
|
+
identityTokenAudience?: pulumi.Input<string>;
|
|
147
|
+
/**
|
|
148
|
+
* The TTL of generated identity tokens in seconds.
|
|
149
|
+
*/
|
|
150
|
+
identityTokenTtl?: pulumi.Input<number>;
|
|
115
151
|
/**
|
|
116
152
|
* The namespace to provision the resource in.
|
|
117
153
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -155,6 +191,15 @@ export interface AuthBackendConfigArgs {
|
|
|
155
191
|
* AzureGermanCloud. Defaults to `AzurePublicCloud`.
|
|
156
192
|
*/
|
|
157
193
|
environment?: pulumi.Input<string>;
|
|
194
|
+
/**
|
|
195
|
+
* The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
196
|
+
* *Available only for Vault Enterprise*
|
|
197
|
+
*/
|
|
198
|
+
identityTokenAudience?: pulumi.Input<string>;
|
|
199
|
+
/**
|
|
200
|
+
* The TTL of generated identity tokens in seconds.
|
|
201
|
+
*/
|
|
202
|
+
identityTokenTtl?: pulumi.Input<number>;
|
|
158
203
|
/**
|
|
159
204
|
* The namespace to provision the resource in.
|
|
160
205
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -8,6 +8,24 @@ const utilities = require("../utilities");
|
|
|
8
8
|
/**
|
|
9
9
|
* ## Example Usage
|
|
10
10
|
*
|
|
11
|
+
* You can setup the Azure auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
12
|
+
* ```typescript
|
|
13
|
+
* import * as pulumi from "@pulumi/pulumi";
|
|
14
|
+
* import * as vault from "@pulumi/vault";
|
|
15
|
+
*
|
|
16
|
+
* const example = new vault.AuthBackend("example", {
|
|
17
|
+
* type: "azure",
|
|
18
|
+
* identityTokenKey: "example-key",
|
|
19
|
+
* });
|
|
20
|
+
* const exampleAuthBackendConfig = new vault.azure.AuthBackendConfig("example", {
|
|
21
|
+
* backend: example.path,
|
|
22
|
+
* tenantId: "11111111-2222-3333-4444-555555555555",
|
|
23
|
+
* clientId: "11111111-2222-3333-4444-555555555555",
|
|
24
|
+
* identityTokenAudience: "<TOKEN_AUDIENCE>",
|
|
25
|
+
* identityTokenTtl: "<TOKEN_TTL>",
|
|
26
|
+
* });
|
|
27
|
+
* ```
|
|
28
|
+
*
|
|
11
29
|
* ```typescript
|
|
12
30
|
* import * as pulumi from "@pulumi/pulumi";
|
|
13
31
|
* import * as vault from "@pulumi/vault";
|
|
@@ -62,6 +80,8 @@ class AuthBackendConfig extends pulumi.CustomResource {
|
|
|
62
80
|
resourceInputs["clientId"] = state ? state.clientId : undefined;
|
|
63
81
|
resourceInputs["clientSecret"] = state ? state.clientSecret : undefined;
|
|
64
82
|
resourceInputs["environment"] = state ? state.environment : undefined;
|
|
83
|
+
resourceInputs["identityTokenAudience"] = state ? state.identityTokenAudience : undefined;
|
|
84
|
+
resourceInputs["identityTokenTtl"] = state ? state.identityTokenTtl : undefined;
|
|
65
85
|
resourceInputs["namespace"] = state ? state.namespace : undefined;
|
|
66
86
|
resourceInputs["resource"] = state ? state.resource : undefined;
|
|
67
87
|
resourceInputs["tenantId"] = state ? state.tenantId : undefined;
|
|
@@ -78,6 +98,8 @@ class AuthBackendConfig extends pulumi.CustomResource {
|
|
|
78
98
|
resourceInputs["clientId"] = (args === null || args === void 0 ? void 0 : args.clientId) ? pulumi.secret(args.clientId) : undefined;
|
|
79
99
|
resourceInputs["clientSecret"] = (args === null || args === void 0 ? void 0 : args.clientSecret) ? pulumi.secret(args.clientSecret) : undefined;
|
|
80
100
|
resourceInputs["environment"] = args ? args.environment : undefined;
|
|
101
|
+
resourceInputs["identityTokenAudience"] = args ? args.identityTokenAudience : undefined;
|
|
102
|
+
resourceInputs["identityTokenTtl"] = args ? args.identityTokenTtl : undefined;
|
|
81
103
|
resourceInputs["namespace"] = args ? args.namespace : undefined;
|
|
82
104
|
resourceInputs["resource"] = args ? args.resource : undefined;
|
|
83
105
|
resourceInputs["tenantId"] = (args === null || args === void 0 ? void 0 : args.tenantId) ? pulumi.secret(args.tenantId) : undefined;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"authBackendConfig.js","sourceRoot":"","sources":["../../azure/authBackendConfig.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C
|
|
1
|
+
{"version":3,"file":"authBackendConfig.js","sourceRoot":"","sources":["../../azure/authBackendConfig.ts"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,iFAAiF;;;AAEjF,yCAAyC;AACzC,0CAA0C;AAE1C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,MAAa,iBAAkB,SAAQ,MAAM,CAAC,cAAc;IACxD;;;;;;;;OAQG;IACI,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,EAA2B,EAAE,KAA8B,EAAE,IAAmC;QAC5H,OAAO,IAAI,iBAAiB,CAAC,IAAI,EAAO,KAAK,kCAAO,IAAI,KAAE,EAAE,EAAE,EAAE,IAAG,CAAC;IACxE,CAAC;IAKD;;;OAGG;IACI,MAAM,CAAC,UAAU,CAAC,GAAQ;QAC7B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,EAAE;YACnC,OAAO,KAAK,CAAC;SAChB;QACD,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,iBAAiB,CAAC,YAAY,CAAC;IAClE,CAAC;IA0DD,YAAY,IAAY,EAAE,WAA4D,EAAE,IAAmC;QACvH,IAAI,cAAc,GAAkB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE;YACT,MAAM,KAAK,GAAG,WAAiD,CAAC;YAChE,cAAc,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,cAAc,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;YACxE,cAAc,CAAC,aAAa,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACtE,cAAc,CAAC,uBAAuB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC1F,cAAc,CAAC,kBAAkB,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;YAChF,cAAc,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAClE,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;SACnE;aAAM;YACH,MAAM,IAAI,GAAG,WAAgD,CAAC;YAC9D,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;aAC3D;YACD,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE;gBACrD,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;aAC3D;YACD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAC5D,cAAc,CAAC,UAAU,CAAC,GAAG,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,QAAQ,EAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACvF,cAAc,CAAC,cAAc,CAAC,GAAG,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,YAAY,EAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YACnG,cAAc,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,cAAc,CAAC,uBAAuB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YACxF,cAAc,CAAC,kBAAkB,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9E,cAAc,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;YAChE,cAAc,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;YAC9D,cAAc,CAAC,UAAU,CAAC,GAAG,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,QAAQ,EAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;SAC1F;QACD,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,EAAE,uBAAuB,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,UAAU,CAAC,EAAE,CAAC;QACzF,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,CAAC,iBAAiB,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC;IACtE,CAAC;;AAxHL,8CAyHC;AA3GG,gBAAgB;AACO,8BAAY,GAAG,iDAAiD,CAAC"}
|
package/azure/backend.d.ts
CHANGED
|
@@ -4,6 +4,20 @@ import * as pulumi from "@pulumi/pulumi";
|
|
|
4
4
|
*
|
|
5
5
|
* ### *Vault-1.9 And Above*
|
|
6
6
|
*
|
|
7
|
+
* You can setup the Azure secrets engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
8
|
+
* ```typescript
|
|
9
|
+
* import * as pulumi from "@pulumi/pulumi";
|
|
10
|
+
* import * as vault from "@pulumi/vault";
|
|
11
|
+
*
|
|
12
|
+
* const azure = new vault.azure.Backend("azure", {
|
|
13
|
+
* subscriptionId: "11111111-2222-3333-4444-111111111111",
|
|
14
|
+
* tenantId: "11111111-2222-3333-4444-222222222222",
|
|
15
|
+
* clientId: "11111111-2222-3333-4444-333333333333",
|
|
16
|
+
* identityTokenAudience: "<TOKEN_AUDIENCE>",
|
|
17
|
+
* identityTokenTtl: "<TOKEN_TTL>",
|
|
18
|
+
* });
|
|
19
|
+
* ```
|
|
20
|
+
*
|
|
7
21
|
* ```typescript
|
|
8
22
|
* import * as pulumi from "@pulumi/pulumi";
|
|
9
23
|
* import * as vault from "@pulumi/vault";
|
|
@@ -71,6 +85,21 @@ export declare class Backend extends pulumi.CustomResource {
|
|
|
71
85
|
* The Azure environment.
|
|
72
86
|
*/
|
|
73
87
|
readonly environment: pulumi.Output<string | undefined>;
|
|
88
|
+
/**
|
|
89
|
+
* The audience claim value. Requires Vault 1.17+.
|
|
90
|
+
* *Available only for Vault Enterprise*
|
|
91
|
+
*/
|
|
92
|
+
readonly identityTokenAudience: pulumi.Output<string | undefined>;
|
|
93
|
+
/**
|
|
94
|
+
* The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
95
|
+
* *Available only for Vault Enterprise*
|
|
96
|
+
*/
|
|
97
|
+
readonly identityTokenKey: pulumi.Output<string | undefined>;
|
|
98
|
+
/**
|
|
99
|
+
* The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
100
|
+
* *Available only for Vault Enterprise*
|
|
101
|
+
*/
|
|
102
|
+
readonly identityTokenTtl: pulumi.Output<number>;
|
|
74
103
|
/**
|
|
75
104
|
* The namespace to provision the resource in.
|
|
76
105
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -92,6 +121,8 @@ export declare class Backend extends pulumi.CustomResource {
|
|
|
92
121
|
readonly tenantId: pulumi.Output<string>;
|
|
93
122
|
/**
|
|
94
123
|
* Use the Microsoft Graph API. Should be set to true on vault-1.10+
|
|
124
|
+
*
|
|
125
|
+
* @deprecated This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.
|
|
95
126
|
*/
|
|
96
127
|
readonly useMicrosoftGraphApi: pulumi.Output<boolean>;
|
|
97
128
|
/**
|
|
@@ -128,6 +159,21 @@ export interface BackendState {
|
|
|
128
159
|
* The Azure environment.
|
|
129
160
|
*/
|
|
130
161
|
environment?: pulumi.Input<string>;
|
|
162
|
+
/**
|
|
163
|
+
* The audience claim value. Requires Vault 1.17+.
|
|
164
|
+
* *Available only for Vault Enterprise*
|
|
165
|
+
*/
|
|
166
|
+
identityTokenAudience?: pulumi.Input<string>;
|
|
167
|
+
/**
|
|
168
|
+
* The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
169
|
+
* *Available only for Vault Enterprise*
|
|
170
|
+
*/
|
|
171
|
+
identityTokenKey?: pulumi.Input<string>;
|
|
172
|
+
/**
|
|
173
|
+
* The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
174
|
+
* *Available only for Vault Enterprise*
|
|
175
|
+
*/
|
|
176
|
+
identityTokenTtl?: pulumi.Input<number>;
|
|
131
177
|
/**
|
|
132
178
|
* The namespace to provision the resource in.
|
|
133
179
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -149,6 +195,8 @@ export interface BackendState {
|
|
|
149
195
|
tenantId?: pulumi.Input<string>;
|
|
150
196
|
/**
|
|
151
197
|
* Use the Microsoft Graph API. Should be set to true on vault-1.10+
|
|
198
|
+
*
|
|
199
|
+
* @deprecated This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.
|
|
152
200
|
*/
|
|
153
201
|
useMicrosoftGraphApi?: pulumi.Input<boolean>;
|
|
154
202
|
}
|
|
@@ -177,6 +225,21 @@ export interface BackendArgs {
|
|
|
177
225
|
* The Azure environment.
|
|
178
226
|
*/
|
|
179
227
|
environment?: pulumi.Input<string>;
|
|
228
|
+
/**
|
|
229
|
+
* The audience claim value. Requires Vault 1.17+.
|
|
230
|
+
* *Available only for Vault Enterprise*
|
|
231
|
+
*/
|
|
232
|
+
identityTokenAudience?: pulumi.Input<string>;
|
|
233
|
+
/**
|
|
234
|
+
* The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
235
|
+
* *Available only for Vault Enterprise*
|
|
236
|
+
*/
|
|
237
|
+
identityTokenKey?: pulumi.Input<string>;
|
|
238
|
+
/**
|
|
239
|
+
* The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
240
|
+
* *Available only for Vault Enterprise*
|
|
241
|
+
*/
|
|
242
|
+
identityTokenTtl?: pulumi.Input<number>;
|
|
180
243
|
/**
|
|
181
244
|
* The namespace to provision the resource in.
|
|
182
245
|
* The value should not contain leading or trailing forward slashes.
|
|
@@ -198,6 +261,8 @@ export interface BackendArgs {
|
|
|
198
261
|
tenantId: pulumi.Input<string>;
|
|
199
262
|
/**
|
|
200
263
|
* Use the Microsoft Graph API. Should be set to true on vault-1.10+
|
|
264
|
+
*
|
|
265
|
+
* @deprecated This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.
|
|
201
266
|
*/
|
|
202
267
|
useMicrosoftGraphApi?: pulumi.Input<boolean>;
|
|
203
268
|
}
|
package/azure/backend.js
CHANGED
|
@@ -10,6 +10,20 @@ const utilities = require("../utilities");
|
|
|
10
10
|
*
|
|
11
11
|
* ### *Vault-1.9 And Above*
|
|
12
12
|
*
|
|
13
|
+
* You can setup the Azure secrets engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
14
|
+
* ```typescript
|
|
15
|
+
* import * as pulumi from "@pulumi/pulumi";
|
|
16
|
+
* import * as vault from "@pulumi/vault";
|
|
17
|
+
*
|
|
18
|
+
* const azure = new vault.azure.Backend("azure", {
|
|
19
|
+
* subscriptionId: "11111111-2222-3333-4444-111111111111",
|
|
20
|
+
* tenantId: "11111111-2222-3333-4444-222222222222",
|
|
21
|
+
* clientId: "11111111-2222-3333-4444-333333333333",
|
|
22
|
+
* identityTokenAudience: "<TOKEN_AUDIENCE>",
|
|
23
|
+
* identityTokenTtl: "<TOKEN_TTL>",
|
|
24
|
+
* });
|
|
25
|
+
* ```
|
|
26
|
+
*
|
|
13
27
|
* ```typescript
|
|
14
28
|
* import * as pulumi from "@pulumi/pulumi";
|
|
15
29
|
* import * as vault from "@pulumi/vault";
|
|
@@ -73,6 +87,9 @@ class Backend extends pulumi.CustomResource {
|
|
|
73
87
|
resourceInputs["description"] = state ? state.description : undefined;
|
|
74
88
|
resourceInputs["disableRemount"] = state ? state.disableRemount : undefined;
|
|
75
89
|
resourceInputs["environment"] = state ? state.environment : undefined;
|
|
90
|
+
resourceInputs["identityTokenAudience"] = state ? state.identityTokenAudience : undefined;
|
|
91
|
+
resourceInputs["identityTokenKey"] = state ? state.identityTokenKey : undefined;
|
|
92
|
+
resourceInputs["identityTokenTtl"] = state ? state.identityTokenTtl : undefined;
|
|
76
93
|
resourceInputs["namespace"] = state ? state.namespace : undefined;
|
|
77
94
|
resourceInputs["path"] = state ? state.path : undefined;
|
|
78
95
|
resourceInputs["subscriptionId"] = state ? state.subscriptionId : undefined;
|
|
@@ -92,6 +109,9 @@ class Backend extends pulumi.CustomResource {
|
|
|
92
109
|
resourceInputs["description"] = args ? args.description : undefined;
|
|
93
110
|
resourceInputs["disableRemount"] = args ? args.disableRemount : undefined;
|
|
94
111
|
resourceInputs["environment"] = args ? args.environment : undefined;
|
|
112
|
+
resourceInputs["identityTokenAudience"] = args ? args.identityTokenAudience : undefined;
|
|
113
|
+
resourceInputs["identityTokenKey"] = args ? args.identityTokenKey : undefined;
|
|
114
|
+
resourceInputs["identityTokenTtl"] = args ? args.identityTokenTtl : undefined;
|
|
95
115
|
resourceInputs["namespace"] = args ? args.namespace : undefined;
|
|
96
116
|
resourceInputs["path"] = args ? args.path : undefined;
|
|
97
117
|
resourceInputs["subscriptionId"] = (args === null || args === void 0 ? void 0 : args.subscriptionId) ? pulumi.secret(args.subscriptionId) : undefined;
|