@r8s/operator-vault-secrets 0.5.0 → 0.5.1

package/dist/index.d.ts

@@ -1,7 +1,10 @@
 /**
  * @r8s/operator-vault-secrets — HashiCorp Vault Secrets Operator as an npm-resolved
  * operator package. The package version mirrors the operator's own
- * version (0.5.0); consumers declare
+ * version (chart 0.5.0 — the tracked cut, DEFAULT_VAULTSECRETS_VERSION),
+ * floating one package patch above it for component-only changes
+ * (0.5.1 ships the native VaultConnection/VaultAuth CRs from #156);
+ * consumers declare
  * "@r8s/operator-vault-secrets": "^0.0.0" as a peerDependency
  * so npm resolves ONE copy per tree and mixed majors fail at install time.
  */
@@ -26,4 +29,6 @@ export declare const operatorFactory: typeof VaultSecretsOperator;
  * Spread into resources: `resources.push(...declareIfMissing(shared))`
  */
 export declare function declareIfMissing(shared: Operator[], version?: string): ReturnType<typeof declareOperator>[];
+export { VaultConnection, VaultAuth } from './vault-cr';
+export type { VaultConnectionProps, VaultAuthProps, VaultCaCertRef } from './vault-cr';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,UAAU,CAAA;AAEnD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,MAAqC,GAC7C,QAAQ,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAoBlC;AAED,kEAAkE;AAClE,eAAO,MAAM,YAAY,2BAA2B,CAAA;AAEpD,kEAAkE;AAClE,eAAO,MAAM,eAAe,6BAAuB,CAAA;AAEnD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,QAAQ,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,UAAU,CAAC,OAAO,eAAe,CAAC,EAAE,CAGtC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAE9C,4EAA4E;AAC5E,eAAO,MAAM,4BAA4B,UAAU,CAAA;AAEnD;;;;GAIG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,MAAqC,GAC7C,QAAQ,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAoBlC;AAED,kEAAkE;AAClE,eAAO,MAAM,YAAY,2BAA2B,CAAA;AAEpD,kEAAkE;AAClE,eAAO,MAAM,eAAe,6BAAuB,CAAA;AAEnD;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,QAAQ,EAAE,EAClB,OAAO,CAAC,EAAE,MAAM,GACf,UAAU,CAAC,OAAO,eAAe,CAAC,EAAE,CAGtC;AAMD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACvD,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA"}

package/dist/index.js

@@ -1,12 +1,15 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.operatorFactory = exports.OPERATOR_KEY = exports.DEFAULT_VAULTSECRETS_VERSION = void 0;
+exports.VaultAuth = exports.VaultConnection = exports.operatorFactory = exports.OPERATOR_KEY = exports.DEFAULT_VAULTSECRETS_VERSION = void 0;
 exports.VaultSecretsOperator = VaultSecretsOperator;
 exports.declareIfMissing = declareIfMissing;
 /**
  * @r8s/operator-vault-secrets — HashiCorp Vault Secrets Operator as an npm-resolved
  * operator package. The package version mirrors the operator's own
- * version (0.5.0); consumers declare
+ * version (chart 0.5.0 — the tracked cut, DEFAULT_VAULTSECRETS_VERSION),
+ * floating one package patch above it for component-only changes
+ * (0.5.1 ships the native VaultConnection/VaultAuth CRs from #156);
+ * consumers declare
  * "@r8s/operator-vault-secrets": "^0.0.0" as a peerDependency
  * so npm resolves ONE copy per tree and mixed majors fail at install time.
  */
@@ -53,4 +56,9 @@ function declareIfMissing(shared, version) {
     return [(0, core_1.declareOperator)(VaultSecretsOperator(version))];
 }
 // CRDs for this operator are not generated yet — declaration + install manifest only.
+// The chart's defaultVaultConnection/defaultAuthMethod values, as native
+// r8s components (helm-free connection wiring).
+var vault_cr_1 = require("./vault-cr");
+Object.defineProperty(exports, "VaultConnection", { enumerable: true, get: function () { return vault_cr_1.VaultConnection; } });
+Object.defineProperty(exports, "VaultAuth", { enumerable: true, get: function () { return vault_cr_1.VaultAuth; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;;AAkBA,oDAsBC;AAYD,4CAMC;AA1DD;;;;;;GAMG;AACH,oCAA2C;AAG3C,4EAA4E;AAC/D,QAAA,4BAA4B,GAAG,OAAO,CAAA;AAEnD;;;;GAIG;AACH,SAAgB,oBAAoB,CAClC,UAAkB,oCAA4B;IAE9C,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,kCAAkC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,wBAAwB;YAC/B,UAAU,EAAE,qCAAqC;YACjD,OAAO;YACP,SAAS,EAAE,wBAAwB;SACpC;QACD,OAAO;QACP,SAAS,EAAE,wBAAwB;QACnC,IAAI,EAAE;YACJ,0CAA0C;YAC1C,2CAA2C;YAC3C,kCAAkC;YAClC,wCAAwC;SACzC;KACF,CAAA;AACH,CAAC;AAED,kEAAkE;AACrD,QAAA,YAAY,GAAG,wBAAwB,CAAA;AAEpD,kEAAkE;AACrD,QAAA,eAAe,GAAG,oBAAoB,CAAA;AAEnD;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,MAAkB,EAClB,OAAgB;IAEhB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC;QAAE,OAAO,EAAE,CAAA;IACxE,OAAO,CAAC,IAAA,sBAAe,EAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,sFAAsF"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.tsx"],"names":[],"mappings":";;;AAqBA,oDAsBC;AAYD,4CAMC;AA7DD;;;;;;;;;GASG;AACH,oCAA2C;AAG3C,4EAA4E;AAC/D,QAAA,4BAA4B,GAAG,OAAO,CAAA;AAEnD;;;;GAIG;AACH,SAAgB,oBAAoB,CAClC,UAAkB,oCAA4B;IAE9C,OAAO;QACL,IAAI,EAAE,wBAAwB;QAC9B,WAAW,EAAE,kCAAkC;QAC/C,MAAM,EAAE;YACN,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,wBAAwB;YAC/B,UAAU,EAAE,qCAAqC;YACjD,OAAO;YACP,SAAS,EAAE,wBAAwB;SACpC;QACD,OAAO;QACP,SAAS,EAAE,wBAAwB;QACnC,IAAI,EAAE;YACJ,0CAA0C;YAC1C,2CAA2C;YAC3C,kCAAkC;YAClC,wCAAwC;SACzC;KACF,CAAA;AACH,CAAC;AAED,kEAAkE;AACrD,QAAA,YAAY,GAAG,wBAAwB,CAAA;AAEpD,kEAAkE;AACrD,QAAA,eAAe,GAAG,oBAAoB,CAAA;AAEnD;;;GAGG;AACH,SAAgB,gBAAgB,CAC9B,MAAkB,EAClB,OAAgB;IAEhB,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,KAAK,wBAAwB,CAAC;QAAE,OAAO,EAAE,CAAA;IACxE,OAAO,CAAC,IAAA,sBAAe,EAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACzD,CAAC;AAED,sFAAsF;AAEtF,yEAAyE;AACzE,gDAAgD;AAChD,uCAAuD;AAA9C,2GAAA,eAAe,OAAA;AAAE,qGAAA,SAAS,OAAA"}

package/dist/vault-cr.d.ts

@@ -0,0 +1,63 @@
+/** CA certificate reference — a Secret holding a PEM chain. */
+export interface VaultCaCertRef {
+    /** Secret name (same namespace as the VaultConnection). */
+    name: string;
+    /** Key inside the Secret (default: 'ca.crt'). */
+    key?: string;
+}
+export interface VaultConnectionProps {
+    /** Connection name — referenced later as vaultConnectionRef (default: 'default'). */
+    name?: string;
+    /** Namespace to install in — the operator's namespace (default: 'vault-secrets-operator'). */
+    namespace?: string;
+    /** Vault/OpenBao server address (required). */
+    address: string;
+    /** Skip TLS verification (default: false). */
+    skipTLSVerify?: boolean;
+    /** Secret holding the trusted PEM CA chain (default key: 'ca.crt'). */
+    caCertSecretRef?: VaultCaCertRef;
+    /** SNI host for TLS connections. */
+    tlsServerName?: string;
+}
+export interface VaultAuthProps {
+    /** Auth method CR name (default: 'default'). */
+    name?: string;
+    /** Namespace to install in — the operator's namespace (default: 'vault-secrets-operator'). */
+    namespace?: string;
+    /** VaultConnection reference (default: 'default'). */
+    vaultConnectionRef?: string;
+    /** Auth method (default: 'kubernetes'). */
+    method?: 'kubernetes';
+    /** Auth backend mount (default: 'kubernetes'). */
+    mount?: string;
+    /** Vault kubernetes auth role (required). */
+    role: string;
+    /** ServiceAccount whose token authenticates (default: 'vault-secrets-operator'). */
+    serviceAccount?: string;
+    /** Token audiences to request. */
+    audiences?: string[];
+    /** Namespaces the auth method may be consumed from (VSO allowedNamespaces). */
+    allowedNamespaces?: string[];
+}
+/**
+ * VaultConnection — point the operator at the Vault/OpenBao server.
+ * The CR the chart's defaultVaultConnection block rendered.
+ *
+ * @example
+ * import { VaultConnection } from '@r8s/operator-vault-secrets'
+ *
+ * export default <VaultConnection address="https://openbao.openbao.svc.cluster.local:8200" />
+ */
+export declare function VaultConnection(props: VaultConnectionProps): import("@r8s/core").r8sElement;
+/**
+ * VaultAuth — the kubernetes auth method binding: Vault role + the
+ * ServiceAccount the operator authenticates as. The CR the chart's
+ * defaultAuthMethod block rendered.
+ *
+ * @example
+ * import { VaultAuth } from '@r8s/operator-vault-secrets'
+ *
+ * export default <VaultAuth role="vault-secrets-operator" />
+ */
+export declare function VaultAuth(props: VaultAuthProps): import("@r8s/core").r8sElement;
+//# sourceMappingURL=vault-cr.d.ts.map

package/dist/vault-cr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-cr.d.ts","sourceRoot":"","sources":["../src/vault-cr.tsx"],"names":[],"mappings":"AAiBA,+DAA+D;AAC/D,MAAM,WAAW,cAAc;IAC7B,2DAA2D;IAC3D,IAAI,EAAE,MAAM,CAAA;IACZ,iDAAiD;IACjD,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,oBAAoB;IACnC,qFAAqF;IACrF,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAA;IACf,8CAA8C;IAC9C,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,uEAAuE;IACvE,eAAe,CAAC,EAAE,cAAc,CAAA;IAChC,oCAAoC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,cAAc;IAC7B,gDAAgD;IAChD,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,2CAA2C;IAC3C,MAAM,CAAC,EAAE,YAAY,CAAA;IACrB,kDAAkD;IAClD,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAA;IACZ,oFAAoF;IACpF,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,kCAAkC;IAClC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAA;CAC7B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,oBAAoB,kCAgC1D;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,cAAc,kCAwC9C"}

package/dist/vault-cr.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VaultConnection = VaultConnection;
+exports.VaultAuth = VaultAuth;
+/**
+ * VSO connection/auth CRs — r8s-rendered (helm-free).
+ *
+ * The Vault Secrets Operator chart used to render these two Cluster
+ * foundation CRs from the `defaultVaultConnection` / `defaultAuthMethod`
+ * values. With the helm-free direction they are ordinary components: the
+ * chart is installed with the defaults OFF (`defaultVaultConnection.enabled=false`,
+ * `defaultAuthMethod.enabled=false`) and r8s renders the CRs natively from
+ * typed props — auditable, greppable, no values-escalation.
+ *
+ * Shapes mirror the secrets.hashicorp.com/v1beta1 VaultConnection and
+ * VaultAuth CRDs shipped with the chart this package was cut for
+ * (vault-secrets-operator 0.5.0 — HashiCorp repo, not the generated
+ * @r8s/crds ones, which do not cover VSO yet).
+ */
+const core_1 = require("@r8s/core");
+/**
+ * VaultConnection — point the operator at the Vault/OpenBao server.
+ * The CR the chart's defaultVaultConnection block rendered.
+ *
+ * @example
+ * import { VaultConnection } from '@r8s/operator-vault-secrets'
+ *
+ * export default <VaultConnection address="https://openbao.openbao.svc.cluster.local:8200" />
+ */
+function VaultConnection(props) {
+    const { name = 'default', namespace = 'vault-secrets-operator', address, skipTLSVerify = false, caCertSecretRef, tlsServerName, } = props;
+    return (0, core_1.jsx)(core_1.Fragment, {
+        children: [
+            (0, core_1.jsx)('VaultConnection', {
+                apiVersion: 'secrets.hashicorp.com/v1beta1',
+                kind: 'VaultConnection',
+                metadata: { name, namespace },
+                spec: {
+                    address,
+                    skipTLSVerify,
+                    ...(caCertSecretRef
+                        ? {
+                            caCertSecretRef: {
+                                name: caCertSecretRef.name,
+                                key: caCertSecretRef.key ?? 'ca.crt',
+                            },
+                        }
+                        : {}),
+                    ...(tlsServerName ? { tlsServerName } : {}),
+                },
+            }),
+        ],
+    });
+}
+/**
+ * VaultAuth — the kubernetes auth method binding: Vault role + the
+ * ServiceAccount the operator authenticates as. The CR the chart's
+ * defaultAuthMethod block rendered.
+ *
+ * @example
+ * import { VaultAuth } from '@r8s/operator-vault-secrets'
+ *
+ * export default <VaultAuth role="vault-secrets-operator" />
+ */
+function VaultAuth(props) {
+    const { name = 'default', namespace = 'vault-secrets-operator', vaultConnectionRef = 'default', method = 'kubernetes', mount = 'kubernetes', role, serviceAccount = 'vault-secrets-operator', audiences = [], allowedNamespaces, } = props;
+    if (!role) {
+        throw new Error(`VaultAuth "${name}" requires a Vault kubernetes auth role — configure the role in ` +
+            `Vault/OpenBao first and pass role="..." to this component.`);
+    }
+    return (0, core_1.jsx)(core_1.Fragment, {
+        children: [
+            (0, core_1.jsx)('VaultAuth', {
+                apiVersion: 'secrets.hashicorp.com/v1beta1',
+                kind: 'VaultAuth',
+                metadata: { name, namespace },
+                spec: {
+                    vaultConnectionRef,
+                    method,
+                    mount,
+                    ...(allowedNamespaces ? { allowedNamespaces } : {}),
+                    kubernetes: {
+                        role,
+                        ...(serviceAccount ? { serviceAccount } : {}),
+                        ...(audiences.length > 0 ? { audiences } : {}),
+                    },
+                },
+            }),
+        ],
+    });
+}
+//# sourceMappingURL=vault-cr.js.map

package/dist/vault-cr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault-cr.js","sourceRoot":"","sources":["../src/vault-cr.tsx"],"names":[],"mappings":";;AAsEA,0CAgCC;AAYD,8BAwCC;AA1JD;;;;;;;;;;;;;;GAcG;AACH,oCAAyC;AA8CzC;;;;;;;;GAQG;AACH,SAAgB,eAAe,CAAC,KAA2B;IACzD,MAAM,EACJ,IAAI,GAAG,SAAS,EAChB,SAAS,GAAG,wBAAwB,EACpC,OAAO,EACP,aAAa,GAAG,KAAK,EACrB,eAAe,EACf,aAAa,GACd,GAAG,KAAK,CAAA;IAET,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE;YACR,IAAA,UAAG,EAAC,iBAAiB,EAAE;gBACrB,UAAU,EAAE,+BAA+B;gBAC3C,IAAI,EAAE,iBAAiB;gBACvB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBAC7B,IAAI,EAAE;oBACJ,OAAO;oBACP,aAAa;oBACb,GAAG,CAAC,eAAe;wBACjB,CAAC,CAAC;4BACE,eAAe,EAAE;gCACf,IAAI,EAAE,eAAe,CAAC,IAAI;gCAC1B,GAAG,EAAE,eAAe,CAAC,GAAG,IAAI,QAAQ;6BACrC;yBACF;wBACH,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC5C;aACF,CAAC;SACH;KACF,CAAC,CAAA;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,SAAS,CAAC,KAAqB;IAC7C,MAAM,EACJ,IAAI,GAAG,SAAS,EAChB,SAAS,GAAG,wBAAwB,EACpC,kBAAkB,GAAG,SAAS,EAC9B,MAAM,GAAG,YAAY,EACrB,KAAK,GAAG,YAAY,EACpB,IAAI,EACJ,cAAc,GAAG,wBAAwB,EACzC,SAAS,GAAG,EAAE,EACd,iBAAiB,GAClB,GAAG,KAAK,CAAA;IAET,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,cAAc,IAAI,kEAAkE;YAClF,4DAA4D,CAC/D,CAAA;IACH,CAAC;IAED,OAAO,IAAA,UAAG,EAAC,eAAQ,EAAE;QACnB,QAAQ,EAAE;YACR,IAAA,UAAG,EAAC,WAAW,EAAE;gBACf,UAAU,EAAE,+BAA+B;gBAC3C,IAAI,EAAE,WAAW;gBACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE;gBAC7B,IAAI,EAAE;oBACJ,kBAAkB;oBAClB,MAAM;oBACN,KAAK;oBACL,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnD,UAAU,EAAE;wBACV,IAAI;wBACJ,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC7C,GAAG,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBAC/C;iBACF;aACF,CAAC;SACH;KACF,CAAC,CAAA;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@r8s/operator-vault-secrets",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "HashiCorp Vault Secrets Operator \u2014 npm-resolved operator package for r8s",
   "license": "MIT",
   "author": "Berget AI AB",
@@ -23,7 +23,8 @@
   ],
   "r8s": {
     "category": "Operators",
-    "operator": "vault-secrets-operator"
+    "operator": "vault-secrets-operator",
+    "componentOnly": true
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",