pulumi-vault 5.21.0a1710160723__py3-none-any.whl → 6.5.0a1736836139__py3-none-any.whl

pulumi_vault/kubernetes/get_auth_backend_config.py

@@ -4,9 +4,14 @@
 
 import copy
 import warnings
+import sys
 import pulumi
 import pulumi.runtime
 from typing import Any, Mapping, Optional, Sequence, Union, overload
+if sys.version_info >= (3, 11):
+    from typing import NotRequired, TypedDict, TypeAlias
+else:
+    from typing_extensions import NotRequired, TypedDict, TypeAlias
 from .. import _utilities
 
 __all__ = [
@@ -21,7 +26,7 @@ class GetAuthBackendConfigResult:
     """
     A collection of values returned by getAuthBackendConfig.
     """
-    def __init__(__self__, backend=None, disable_iss_validation=None, disable_local_ca_jwt=None, id=None, issuer=None, kubernetes_ca_cert=None, kubernetes_host=None, namespace=None, pem_keys=None):
+    def __init__(__self__, backend=None, disable_iss_validation=None, disable_local_ca_jwt=None, id=None, issuer=None, kubernetes_ca_cert=None, kubernetes_host=None, namespace=None, pem_keys=None, use_annotations_as_alias_metadata=None):
         if backend and not isinstance(backend, str):
             raise TypeError("Expected argument 'backend' to be a str")
         pulumi.set(__self__, "backend", backend)
@@ -49,6 +54,9 @@ class GetAuthBackendConfigResult:
         if pem_keys and not isinstance(pem_keys, list):
             raise TypeError("Expected argument 'pem_keys' to be a list")
         pulumi.set(__self__, "pem_keys", pem_keys)
+        if use_annotations_as_alias_metadata and not isinstance(use_annotations_as_alias_metadata, bool):
+            raise TypeError("Expected argument 'use_annotations_as_alias_metadata' to be a bool")
+        pulumi.set(__self__, "use_annotations_as_alias_metadata", use_annotations_as_alias_metadata)
 
     @property
     @pulumi.getter
@@ -58,11 +66,17 @@ class GetAuthBackendConfigResult:
     @property
     @pulumi.getter(name="disableIssValidation")
     def disable_iss_validation(self) -> bool:
+        """
+        (Optional) Disable JWT issuer validation. Allows to skip ISS validation. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`
+        """
         return pulumi.get(self, "disable_iss_validation")
 
     @property
     @pulumi.getter(name="disableLocalCaJwt")
     def disable_local_ca_jwt(self) -> bool:
+        """
+        (Optional) Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`
+        """
         return pulumi.get(self, "disable_local_ca_jwt")
 
     @property
@@ -110,6 +124,14 @@ class GetAuthBackendConfigResult:
         """
         return pulumi.get(self, "pem_keys")
 
+    @property
+    @pulumi.getter(name="useAnnotationsAsAliasMetadata")
+    def use_annotations_as_alias_metadata(self) -> bool:
+        """
+        (Optional) Use annotations from the client token's associated service account as alias metadata for the Vault entity. Requires Vault `v1.16+` or Vault auth kubernetes plugin `v0.18.0+`
+        """
+        return pulumi.get(self, "use_annotations_as_alias_metadata")
+
 
 class AwaitableGetAuthBackendConfigResult(GetAuthBackendConfigResult):
     # pylint: disable=using-constant-test
@@ -125,7 +147,8 @@ class AwaitableGetAuthBackendConfigResult(GetAuthBackendConfigResult):
             kubernetes_ca_cert=self.kubernetes_ca_cert,
             kubernetes_host=self.kubernetes_host,
             namespace=self.namespace,
-            pem_keys=self.pem_keys)
+            pem_keys=self.pem_keys,
+            use_annotations_as_alias_metadata=self.use_annotations_as_alias_metadata)
 
 
 def get_auth_backend_config(backend: Optional[str] = None,
@@ -136,6 +159,7 @@ def get_auth_backend_config(backend: Optional[str] = None,
                             kubernetes_host: Optional[str] = None,
                             namespace: Optional[str] = None,
                             pem_keys: Optional[Sequence[str]] = None,
+                            use_annotations_as_alias_metadata: Optional[bool] = None,
                             opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetAuthBackendConfigResult:
     """
     Reads the Role of an Kubernetes from a Vault server. See the [Vault
@@ -145,6 +169,8 @@ def get_auth_backend_config(backend: Optional[str] = None,
 
     :param str backend: The unique name for the Kubernetes backend the config to
            retrieve Role attributes for resides in. Defaults to "kubernetes".
+    :param bool disable_iss_validation: (Optional) Disable JWT issuer validation. Allows to skip ISS validation. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`
+    :param bool disable_local_ca_jwt: (Optional) Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`
     :param str issuer: Optional JWT issuer. If no issuer is specified, `kubernetes.io/serviceaccount` will be used as the default issuer.
     :param str kubernetes_ca_cert: PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.
     :param str kubernetes_host: Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.
@@ -153,6 +179,7 @@ def get_auth_backend_config(backend: Optional[str] = None,
            The `namespace` is always relative to the provider's configured namespace.
            *Available only for Vault Enterprise*.
     :param Sequence[str] pem_keys: Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.
+    :param bool use_annotations_as_alias_metadata: (Optional) Use annotations from the client token's associated service account as alias metadata for the Vault entity. Requires Vault `v1.16+` or Vault auth kubernetes plugin `v0.18.0+`
     """
     __args__ = dict()
     __args__['backend'] = backend
@@ -163,6 +190,7 @@ def get_auth_backend_config(backend: Optional[str] = None,
     __args__['kubernetesHost'] = kubernetes_host
     __args__['namespace'] = namespace
     __args__['pemKeys'] = pem_keys
+    __args__['useAnnotationsAsAliasMetadata'] = use_annotations_as_alias_metadata
     opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
     __ret__ = pulumi.runtime.invoke('vault:kubernetes/getAuthBackendConfig:getAuthBackendConfig', __args__, opts=opts, typ=GetAuthBackendConfigResult).value
 
@@ -175,10 +203,8 @@ def get_auth_backend_config(backend: Optional[str] = None,
         kubernetes_ca_cert=pulumi.get(__ret__, 'kubernetes_ca_cert'),
         kubernetes_host=pulumi.get(__ret__, 'kubernetes_host'),
         namespace=pulumi.get(__ret__, 'namespace'),
-        pem_keys=pulumi.get(__ret__, 'pem_keys'))
-
-
-@_utilities.lift_output_func(get_auth_backend_config)
+        pem_keys=pulumi.get(__ret__, 'pem_keys'),
+        use_annotations_as_alias_metadata=pulumi.get(__ret__, 'use_annotations_as_alias_metadata'))
 def get_auth_backend_config_output(backend: Optional[pulumi.Input[Optional[str]]] = None,
                                    disable_iss_validation: Optional[pulumi.Input[Optional[bool]]] = None,
                                    disable_local_ca_jwt: Optional[pulumi.Input[Optional[bool]]] = None,
@@ -187,7 +213,8 @@ def get_auth_backend_config_output(backend: Optional[pulumi.Input[Optional[str]]
                                    kubernetes_host: Optional[pulumi.Input[Optional[str]]] = None,
                                    namespace: Optional[pulumi.Input[Optional[str]]] = None,
                                    pem_keys: Optional[pulumi.Input[Optional[Sequence[str]]]] = None,
-                                   opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetAuthBackendConfigResult]:
+                                   use_annotations_as_alias_metadata: Optional[pulumi.Input[Optional[bool]]] = None,
+                                   opts: Optional[Union[pulumi.InvokeOptions, pulumi.InvokeOutputOptions]] = None) -> pulumi.Output[GetAuthBackendConfigResult]:
     """
     Reads the Role of an Kubernetes from a Vault server. See the [Vault
     documentation](https://www.vaultproject.io/api-docs/auth/kubernetes#read-config) for more
@@ -196,6 +223,8 @@ def get_auth_backend_config_output(backend: Optional[pulumi.Input[Optional[str]]
 
     :param str backend: The unique name for the Kubernetes backend the config to
            retrieve Role attributes for resides in. Defaults to "kubernetes".
+    :param bool disable_iss_validation: (Optional) Disable JWT issuer validation. Allows to skip ISS validation. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`
+    :param bool disable_local_ca_jwt: (Optional) Disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. Requires Vault `v1.5.4+` or Vault auth kubernetes plugin `v0.7.1+`
     :param str issuer: Optional JWT issuer. If no issuer is specified, `kubernetes.io/serviceaccount` will be used as the default issuer.
     :param str kubernetes_ca_cert: PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API.
     :param str kubernetes_host: Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.
@@ -204,5 +233,28 @@ def get_auth_backend_config_output(backend: Optional[pulumi.Input[Optional[str]]
            The `namespace` is always relative to the provider's configured namespace.
            *Available only for Vault Enterprise*.
     :param Sequence[str] pem_keys: Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys.
+    :param bool use_annotations_as_alias_metadata: (Optional) Use annotations from the client token's associated service account as alias metadata for the Vault entity. Requires Vault `v1.16+` or Vault auth kubernetes plugin `v0.18.0+`
     """
-    ...
+    __args__ = dict()
+    __args__['backend'] = backend
+    __args__['disableIssValidation'] = disable_iss_validation
+    __args__['disableLocalCaJwt'] = disable_local_ca_jwt
+    __args__['issuer'] = issuer
+    __args__['kubernetesCaCert'] = kubernetes_ca_cert
+    __args__['kubernetesHost'] = kubernetes_host
+    __args__['namespace'] = namespace
+    __args__['pemKeys'] = pem_keys
+    __args__['useAnnotationsAsAliasMetadata'] = use_annotations_as_alias_metadata
+    opts = pulumi.InvokeOutputOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
+    __ret__ = pulumi.runtime.invoke_output('vault:kubernetes/getAuthBackendConfig:getAuthBackendConfig', __args__, opts=opts, typ=GetAuthBackendConfigResult)
+    return __ret__.apply(lambda __response__: GetAuthBackendConfigResult(
+        backend=pulumi.get(__response__, 'backend'),
+        disable_iss_validation=pulumi.get(__response__, 'disable_iss_validation'),
+        disable_local_ca_jwt=pulumi.get(__response__, 'disable_local_ca_jwt'),
+        id=pulumi.get(__response__, 'id'),
+        issuer=pulumi.get(__response__, 'issuer'),
+        kubernetes_ca_cert=pulumi.get(__response__, 'kubernetes_ca_cert'),
+        kubernetes_host=pulumi.get(__response__, 'kubernetes_host'),
+        namespace=pulumi.get(__response__, 'namespace'),
+        pem_keys=pulumi.get(__response__, 'pem_keys'),
+        use_annotations_as_alias_metadata=pulumi.get(__response__, 'use_annotations_as_alias_metadata')))

pulumi_vault/kubernetes/get_auth_backend_role.py

@@ -4,9 +4,14 @@
 
 import copy
 import warnings
+import sys
 import pulumi
 import pulumi.runtime
 from typing import Any, Mapping, Optional, Sequence, Union, overload
+if sys.version_info >= (3, 11):
+    from typing import NotRequired, TypedDict, TypeAlias
+else:
+    from typing_extensions import NotRequired, TypedDict, TypeAlias
 from .. import _utilities
 
 __all__ = [
@@ -336,9 +341,6 @@ def get_auth_backend_role(audience: Optional[str] = None,
         token_policies=pulumi.get(__ret__, 'token_policies'),
         token_ttl=pulumi.get(__ret__, 'token_ttl'),
         token_type=pulumi.get(__ret__, 'token_type'))
-
-
-@_utilities.lift_output_func(get_auth_backend_role)
 def get_auth_backend_role_output(audience: Optional[pulumi.Input[Optional[str]]] = None,
                                  backend: Optional[pulumi.Input[Optional[str]]] = None,
                                  namespace: Optional[pulumi.Input[Optional[str]]] = None,
@@ -352,7 +354,7 @@ def get_auth_backend_role_output(audience: Optional[pulumi.Input[Optional[str]]]
                                  token_policies: Optional[pulumi.Input[Optional[Sequence[str]]]] = None,
                                  token_ttl: Optional[pulumi.Input[Optional[int]]] = None,
                                  token_type: Optional[pulumi.Input[Optional[str]]] = None,
-                                 opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetAuthBackendRoleResult]:
+                                 opts: Optional[Union[pulumi.InvokeOptions, pulumi.InvokeOutputOptions]] = None) -> pulumi.Output[GetAuthBackendRoleResult]:
     """
     Reads the Role of an Kubernetes from a Vault server. See the [Vault
     documentation](https://www.vaultproject.io/api-docs/auth/kubernetes#read-role) for more
@@ -395,4 +397,37 @@ def get_auth_backend_role_output(audience: Optional[pulumi.Input[Optional[str]]]
            `default-service` and `default-batch` which specify the type to return unless the client
            requests a different type at generation time.
     """
-    ...
+    __args__ = dict()
+    __args__['audience'] = audience
+    __args__['backend'] = backend
+    __args__['namespace'] = namespace
+    __args__['roleName'] = role_name
+    __args__['tokenBoundCidrs'] = token_bound_cidrs
+    __args__['tokenExplicitMaxTtl'] = token_explicit_max_ttl
+    __args__['tokenMaxTtl'] = token_max_ttl
+    __args__['tokenNoDefaultPolicy'] = token_no_default_policy
+    __args__['tokenNumUses'] = token_num_uses
+    __args__['tokenPeriod'] = token_period
+    __args__['tokenPolicies'] = token_policies
+    __args__['tokenTtl'] = token_ttl
+    __args__['tokenType'] = token_type
+    opts = pulumi.InvokeOutputOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
+    __ret__ = pulumi.runtime.invoke_output('vault:kubernetes/getAuthBackendRole:getAuthBackendRole', __args__, opts=opts, typ=GetAuthBackendRoleResult)
+    return __ret__.apply(lambda __response__: GetAuthBackendRoleResult(
+        alias_name_source=pulumi.get(__response__, 'alias_name_source'),
+        audience=pulumi.get(__response__, 'audience'),
+        backend=pulumi.get(__response__, 'backend'),
+        bound_service_account_names=pulumi.get(__response__, 'bound_service_account_names'),
+        bound_service_account_namespaces=pulumi.get(__response__, 'bound_service_account_namespaces'),
+        id=pulumi.get(__response__, 'id'),
+        namespace=pulumi.get(__response__, 'namespace'),
+        role_name=pulumi.get(__response__, 'role_name'),
+        token_bound_cidrs=pulumi.get(__response__, 'token_bound_cidrs'),
+        token_explicit_max_ttl=pulumi.get(__response__, 'token_explicit_max_ttl'),
+        token_max_ttl=pulumi.get(__response__, 'token_max_ttl'),
+        token_no_default_policy=pulumi.get(__response__, 'token_no_default_policy'),
+        token_num_uses=pulumi.get(__response__, 'token_num_uses'),
+        token_period=pulumi.get(__response__, 'token_period'),
+        token_policies=pulumi.get(__response__, 'token_policies'),
+        token_ttl=pulumi.get(__response__, 'token_ttl'),
+        token_type=pulumi.get(__response__, 'token_type')))

pulumi_vault/kubernetes/get_service_account_token.py

@@ -4,9 +4,14 @@
 
 import copy
 import warnings
+import sys
 import pulumi
 import pulumi.runtime
 from typing import Any, Mapping, Optional, Sequence, Union, overload
+if sys.version_info >= (3, 11):
+    from typing import NotRequired, TypedDict, TypeAlias
+else:
+    from typing_extensions import NotRequired, TypedDict, TypeAlias
 from .. import _utilities
 
 __all__ = [
@@ -180,20 +185,21 @@ def get_service_account_token(backend: Optional[str] = None,
     """
     ## Example Usage
 
-    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
+    import pulumi_std as std
     import pulumi_vault as vault
 
     config = vault.kubernetes.SecretBackend("config",
         path="kubernetes",
         description="kubernetes secrets engine description",
         kubernetes_host="https://127.0.0.1:61233",
-        kubernetes_ca_cert=(lambda path: open(path).read())("/path/to/cert"),
-        service_account_jwt=(lambda path: open(path).read())("/path/to/token"),
+        kubernetes_ca_cert=std.file(input="/path/to/cert").result,
+        service_account_jwt=std.file(input="/path/to/token").result,
         disable_local_ca_jwt=False)
     role = vault.kubernetes.SecretBackendRole("role",
         backend=config.path,
+        name="service-account-name-role",
         allowed_kubernetes_namespaces=["*"],
         token_max_ttl=43200,
         token_default_ttl=21600,
@@ -212,7 +218,6 @@ def get_service_account_token(backend: Optional[str] = None,
         cluster_role_binding=False,
         ttl="1h")
     ```
-    <!--End PulumiCodeChooser -->
 
 
     :param str backend: The Kubernetes secret backend to generate service account 
@@ -223,7 +228,7 @@ def get_service_account_token(backend: Optional[str] = None,
            generate the credentials.
     :param str namespace: The namespace of the target resource.
            The value should not contain leading or trailing forward slashes.
-           The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
+           The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
            *Available only for Vault Enterprise*.
     :param str role: The name of the Kubernetes secret backend role to generate service 
            account tokens from.
@@ -254,33 +259,31 @@ def get_service_account_token(backend: Optional[str] = None,
         service_account_namespace=pulumi.get(__ret__, 'service_account_namespace'),
         service_account_token=pulumi.get(__ret__, 'service_account_token'),
         ttl=pulumi.get(__ret__, 'ttl'))
-
-
-@_utilities.lift_output_func(get_service_account_token)
 def get_service_account_token_output(backend: Optional[pulumi.Input[str]] = None,
                                      cluster_role_binding: Optional[pulumi.Input[Optional[bool]]] = None,
                                      kubernetes_namespace: Optional[pulumi.Input[str]] = None,
                                      namespace: Optional[pulumi.Input[Optional[str]]] = None,
                                      role: Optional[pulumi.Input[str]] = None,
                                      ttl: Optional[pulumi.Input[Optional[str]]] = None,
-                                     opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetServiceAccountTokenResult]:
+                                     opts: Optional[Union[pulumi.InvokeOptions, pulumi.InvokeOutputOptions]] = None) -> pulumi.Output[GetServiceAccountTokenResult]:
     """
     ## Example Usage
 
-    <!--Start PulumiCodeChooser -->
     ```python
     import pulumi
+    import pulumi_std as std
     import pulumi_vault as vault
 
     config = vault.kubernetes.SecretBackend("config",
         path="kubernetes",
         description="kubernetes secrets engine description",
         kubernetes_host="https://127.0.0.1:61233",
-        kubernetes_ca_cert=(lambda path: open(path).read())("/path/to/cert"),
-        service_account_jwt=(lambda path: open(path).read())("/path/to/token"),
+        kubernetes_ca_cert=std.file(input="/path/to/cert").result,
+        service_account_jwt=std.file(input="/path/to/token").result,
         disable_local_ca_jwt=False)
     role = vault.kubernetes.SecretBackendRole("role",
         backend=config.path,
+        name="service-account-name-role",
         allowed_kubernetes_namespaces=["*"],
         token_max_ttl=43200,
         token_default_ttl=21600,
@@ -299,7 +302,6 @@ def get_service_account_token_output(backend: Optional[pulumi.Input[str]] = None
         cluster_role_binding=False,
         ttl="1h")
     ```
-    <!--End PulumiCodeChooser -->
 
 
     :param str backend: The Kubernetes secret backend to generate service account 
@@ -310,11 +312,33 @@ def get_service_account_token_output(backend: Optional[pulumi.Input[str]] = None
            generate the credentials.
     :param str namespace: The namespace of the target resource.
            The value should not contain leading or trailing forward slashes.
-           The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
+           The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
            *Available only for Vault Enterprise*.
     :param str role: The name of the Kubernetes secret backend role to generate service 
            account tokens from.
     :param str ttl: The TTL of the generated Kubernetes service account token, specified in 
            seconds or as a Go duration format string.
     """
-    ...
+    __args__ = dict()
+    __args__['backend'] = backend
+    __args__['clusterRoleBinding'] = cluster_role_binding
+    __args__['kubernetesNamespace'] = kubernetes_namespace
+    __args__['namespace'] = namespace
+    __args__['role'] = role
+    __args__['ttl'] = ttl
+    opts = pulumi.InvokeOutputOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
+    __ret__ = pulumi.runtime.invoke_output('vault:kubernetes/getServiceAccountToken:getServiceAccountToken', __args__, opts=opts, typ=GetServiceAccountTokenResult)
+    return __ret__.apply(lambda __response__: GetServiceAccountTokenResult(
+        backend=pulumi.get(__response__, 'backend'),
+        cluster_role_binding=pulumi.get(__response__, 'cluster_role_binding'),
+        id=pulumi.get(__response__, 'id'),
+        kubernetes_namespace=pulumi.get(__response__, 'kubernetes_namespace'),
+        lease_duration=pulumi.get(__response__, 'lease_duration'),
+        lease_id=pulumi.get(__response__, 'lease_id'),
+        lease_renewable=pulumi.get(__response__, 'lease_renewable'),
+        namespace=pulumi.get(__response__, 'namespace'),
+        role=pulumi.get(__response__, 'role'),
+        service_account_name=pulumi.get(__response__, 'service_account_name'),
+        service_account_namespace=pulumi.get(__response__, 'service_account_namespace'),
+        service_account_token=pulumi.get(__response__, 'service_account_token'),
+        ttl=pulumi.get(__response__, 'ttl')))