pulumi-vault 6.0.0__py3-none-any.whl → 6.1.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +2 -0
- pulumi_vault/get_namespace.py +225 -0
- pulumi_vault/get_namespaces.py +152 -0
- pulumi_vault/kubernetes/secret_backend_role.py +99 -25
- pulumi_vault/mongodbatlas/secret_backend.py +6 -6
- pulumi_vault/mongodbatlas/secret_role.py +27 -27
- pulumi_vault/secrets/__init__.py +2 -0
- pulumi_vault/secrets/_inputs.py +80 -0
- pulumi_vault/secrets/outputs.py +89 -0
- pulumi_vault/secrets/sync_association.py +32 -58
- pulumi_vault/secrets/sync_aws_destination.py +54 -0
- pulumi_vault/secrets/sync_azure_destination.py +54 -0
- pulumi_vault/secrets/sync_gcp_destination.py +54 -0
- pulumi_vault/secrets/sync_gh_destination.py +54 -0
- pulumi_vault/secrets/sync_vercel_destination.py +54 -0
- {pulumi_vault-6.0.0.dist-info → pulumi_vault-6.1.0.dist-info}/METADATA +1 -1
- {pulumi_vault-6.0.0.dist-info → pulumi_vault-6.1.0.dist-info}/RECORD +19 -15
- {pulumi_vault-6.0.0.dist-info → pulumi_vault-6.1.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-6.0.0.dist-info → pulumi_vault-6.1.0.dist-info}/top_level.txt +0 -0
pulumi_vault/__init__.py
CHANGED
|
@@ -12,6 +12,8 @@ from .cert_auth_backend_role import *
|
|
|
12
12
|
from .egp_policy import *
|
|
13
13
|
from .get_auth_backend import *
|
|
14
14
|
from .get_auth_backends import *
|
|
15
|
+
from .get_namespace import *
|
|
16
|
+
from .get_namespaces import *
|
|
15
17
|
from .get_nomad_access_token import *
|
|
16
18
|
from .get_policy_document import *
|
|
17
19
|
from .get_raft_autopilot_state import *
|
|
@@ -0,0 +1,225 @@
|
|
|
1
|
+
# coding=utf-8
|
|
2
|
+
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
|
|
3
|
+
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
|
+
|
|
5
|
+
import copy
|
|
6
|
+
import warnings
|
|
7
|
+
import pulumi
|
|
8
|
+
import pulumi.runtime
|
|
9
|
+
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
10
|
+
from . import _utilities
|
|
11
|
+
|
|
12
|
+
__all__ = [
|
|
13
|
+
'GetNamespaceResult',
|
|
14
|
+
'AwaitableGetNamespaceResult',
|
|
15
|
+
'get_namespace',
|
|
16
|
+
'get_namespace_output',
|
|
17
|
+
]
|
|
18
|
+
|
|
19
|
+
@pulumi.output_type
|
|
20
|
+
class GetNamespaceResult:
|
|
21
|
+
"""
|
|
22
|
+
A collection of values returned by getNamespace.
|
|
23
|
+
"""
|
|
24
|
+
def __init__(__self__, custom_metadata=None, id=None, namespace=None, namespace_id=None, path=None, path_fq=None):
|
|
25
|
+
if custom_metadata and not isinstance(custom_metadata, dict):
|
|
26
|
+
raise TypeError("Expected argument 'custom_metadata' to be a dict")
|
|
27
|
+
pulumi.set(__self__, "custom_metadata", custom_metadata)
|
|
28
|
+
if id and not isinstance(id, str):
|
|
29
|
+
raise TypeError("Expected argument 'id' to be a str")
|
|
30
|
+
pulumi.set(__self__, "id", id)
|
|
31
|
+
if namespace and not isinstance(namespace, str):
|
|
32
|
+
raise TypeError("Expected argument 'namespace' to be a str")
|
|
33
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
34
|
+
if namespace_id and not isinstance(namespace_id, str):
|
|
35
|
+
raise TypeError("Expected argument 'namespace_id' to be a str")
|
|
36
|
+
pulumi.set(__self__, "namespace_id", namespace_id)
|
|
37
|
+
if path and not isinstance(path, str):
|
|
38
|
+
raise TypeError("Expected argument 'path' to be a str")
|
|
39
|
+
pulumi.set(__self__, "path", path)
|
|
40
|
+
if path_fq and not isinstance(path_fq, str):
|
|
41
|
+
raise TypeError("Expected argument 'path_fq' to be a str")
|
|
42
|
+
pulumi.set(__self__, "path_fq", path_fq)
|
|
43
|
+
|
|
44
|
+
@property
|
|
45
|
+
@pulumi.getter(name="customMetadata")
|
|
46
|
+
def custom_metadata(self) -> Mapping[str, Any]:
|
|
47
|
+
"""
|
|
48
|
+
(Optional) A map of strings containing arbitrary metadata for the namespace.
|
|
49
|
+
Only fetched if `path` is specified.
|
|
50
|
+
*Requires Vault 1.12+.*
|
|
51
|
+
"""
|
|
52
|
+
return pulumi.get(self, "custom_metadata")
|
|
53
|
+
|
|
54
|
+
@property
|
|
55
|
+
@pulumi.getter
|
|
56
|
+
def id(self) -> str:
|
|
57
|
+
"""
|
|
58
|
+
The provider-assigned unique ID for this managed resource.
|
|
59
|
+
"""
|
|
60
|
+
return pulumi.get(self, "id")
|
|
61
|
+
|
|
62
|
+
@property
|
|
63
|
+
@pulumi.getter
|
|
64
|
+
def namespace(self) -> Optional[str]:
|
|
65
|
+
return pulumi.get(self, "namespace")
|
|
66
|
+
|
|
67
|
+
@property
|
|
68
|
+
@pulumi.getter(name="namespaceId")
|
|
69
|
+
def namespace_id(self) -> str:
|
|
70
|
+
"""
|
|
71
|
+
Vault server's internal ID of the namespace.
|
|
72
|
+
Only fetched if `path` is specified.
|
|
73
|
+
"""
|
|
74
|
+
return pulumi.get(self, "namespace_id")
|
|
75
|
+
|
|
76
|
+
@property
|
|
77
|
+
@pulumi.getter
|
|
78
|
+
def path(self) -> Optional[str]:
|
|
79
|
+
return pulumi.get(self, "path")
|
|
80
|
+
|
|
81
|
+
@property
|
|
82
|
+
@pulumi.getter(name="pathFq")
|
|
83
|
+
def path_fq(self) -> str:
|
|
84
|
+
"""
|
|
85
|
+
The fully qualified path to the namespace. Useful when provisioning resources in a child `namespace`.
|
|
86
|
+
The path is relative to the provider's `namespace` argument.
|
|
87
|
+
"""
|
|
88
|
+
return pulumi.get(self, "path_fq")
|
|
89
|
+
|
|
90
|
+
|
|
91
|
+
class AwaitableGetNamespaceResult(GetNamespaceResult):
|
|
92
|
+
# pylint: disable=using-constant-test
|
|
93
|
+
def __await__(self):
|
|
94
|
+
if False:
|
|
95
|
+
yield self
|
|
96
|
+
return GetNamespaceResult(
|
|
97
|
+
custom_metadata=self.custom_metadata,
|
|
98
|
+
id=self.id,
|
|
99
|
+
namespace=self.namespace,
|
|
100
|
+
namespace_id=self.namespace_id,
|
|
101
|
+
path=self.path,
|
|
102
|
+
path_fq=self.path_fq)
|
|
103
|
+
|
|
104
|
+
|
|
105
|
+
def get_namespace(namespace: Optional[str] = None,
|
|
106
|
+
path: Optional[str] = None,
|
|
107
|
+
opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetNamespaceResult:
|
|
108
|
+
"""
|
|
109
|
+
## Example Usage
|
|
110
|
+
|
|
111
|
+
### Current namespace
|
|
112
|
+
|
|
113
|
+
<!--Start PulumiCodeChooser -->
|
|
114
|
+
```python
|
|
115
|
+
import pulumi
|
|
116
|
+
import pulumi_vault as vault
|
|
117
|
+
|
|
118
|
+
current = vault.get_namespace()
|
|
119
|
+
```
|
|
120
|
+
<!--End PulumiCodeChooser -->
|
|
121
|
+
|
|
122
|
+
### Single namespace
|
|
123
|
+
|
|
124
|
+
<!--Start PulumiCodeChooser -->
|
|
125
|
+
```python
|
|
126
|
+
import pulumi
|
|
127
|
+
import pulumi_vault as vault
|
|
128
|
+
|
|
129
|
+
ns1 = vault.get_namespace(path="ns1")
|
|
130
|
+
```
|
|
131
|
+
<!--End PulumiCodeChooser -->
|
|
132
|
+
|
|
133
|
+
### Nested namespace
|
|
134
|
+
|
|
135
|
+
<!--Start PulumiCodeChooser -->
|
|
136
|
+
```python
|
|
137
|
+
import pulumi
|
|
138
|
+
import pulumi_vault as vault
|
|
139
|
+
|
|
140
|
+
child = vault.get_namespace(namespace="parent",
|
|
141
|
+
path="child")
|
|
142
|
+
full_path = child.id
|
|
143
|
+
# -> foo/parent/child/
|
|
144
|
+
path_fq = child.path_fq
|
|
145
|
+
```
|
|
146
|
+
<!--End PulumiCodeChooser -->
|
|
147
|
+
|
|
148
|
+
|
|
149
|
+
:param str namespace: The namespace to provision the resource in.
|
|
150
|
+
The value should not contain leading or trailing forward slashes.
|
|
151
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
|
|
152
|
+
:param str path: The path of the namespace. Must not have a trailing `/`.
|
|
153
|
+
If not specified or empty, path attributes are set for the current namespace
|
|
154
|
+
based on the `namespace` arguments of the provider and this data source.
|
|
155
|
+
Other path related attributes will be empty in this case.
|
|
156
|
+
"""
|
|
157
|
+
__args__ = dict()
|
|
158
|
+
__args__['namespace'] = namespace
|
|
159
|
+
__args__['path'] = path
|
|
160
|
+
opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
|
|
161
|
+
__ret__ = pulumi.runtime.invoke('vault:index/getNamespace:getNamespace', __args__, opts=opts, typ=GetNamespaceResult).value
|
|
162
|
+
|
|
163
|
+
return AwaitableGetNamespaceResult(
|
|
164
|
+
custom_metadata=pulumi.get(__ret__, 'custom_metadata'),
|
|
165
|
+
id=pulumi.get(__ret__, 'id'),
|
|
166
|
+
namespace=pulumi.get(__ret__, 'namespace'),
|
|
167
|
+
namespace_id=pulumi.get(__ret__, 'namespace_id'),
|
|
168
|
+
path=pulumi.get(__ret__, 'path'),
|
|
169
|
+
path_fq=pulumi.get(__ret__, 'path_fq'))
|
|
170
|
+
|
|
171
|
+
|
|
172
|
+
@_utilities.lift_output_func(get_namespace)
|
|
173
|
+
def get_namespace_output(namespace: Optional[pulumi.Input[Optional[str]]] = None,
|
|
174
|
+
path: Optional[pulumi.Input[Optional[str]]] = None,
|
|
175
|
+
opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetNamespaceResult]:
|
|
176
|
+
"""
|
|
177
|
+
## Example Usage
|
|
178
|
+
|
|
179
|
+
### Current namespace
|
|
180
|
+
|
|
181
|
+
<!--Start PulumiCodeChooser -->
|
|
182
|
+
```python
|
|
183
|
+
import pulumi
|
|
184
|
+
import pulumi_vault as vault
|
|
185
|
+
|
|
186
|
+
current = vault.get_namespace()
|
|
187
|
+
```
|
|
188
|
+
<!--End PulumiCodeChooser -->
|
|
189
|
+
|
|
190
|
+
### Single namespace
|
|
191
|
+
|
|
192
|
+
<!--Start PulumiCodeChooser -->
|
|
193
|
+
```python
|
|
194
|
+
import pulumi
|
|
195
|
+
import pulumi_vault as vault
|
|
196
|
+
|
|
197
|
+
ns1 = vault.get_namespace(path="ns1")
|
|
198
|
+
```
|
|
199
|
+
<!--End PulumiCodeChooser -->
|
|
200
|
+
|
|
201
|
+
### Nested namespace
|
|
202
|
+
|
|
203
|
+
<!--Start PulumiCodeChooser -->
|
|
204
|
+
```python
|
|
205
|
+
import pulumi
|
|
206
|
+
import pulumi_vault as vault
|
|
207
|
+
|
|
208
|
+
child = vault.get_namespace(namespace="parent",
|
|
209
|
+
path="child")
|
|
210
|
+
full_path = child.id
|
|
211
|
+
# -> foo/parent/child/
|
|
212
|
+
path_fq = child.path_fq
|
|
213
|
+
```
|
|
214
|
+
<!--End PulumiCodeChooser -->
|
|
215
|
+
|
|
216
|
+
|
|
217
|
+
:param str namespace: The namespace to provision the resource in.
|
|
218
|
+
The value should not contain leading or trailing forward slashes.
|
|
219
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
|
|
220
|
+
:param str path: The path of the namespace. Must not have a trailing `/`.
|
|
221
|
+
If not specified or empty, path attributes are set for the current namespace
|
|
222
|
+
based on the `namespace` arguments of the provider and this data source.
|
|
223
|
+
Other path related attributes will be empty in this case.
|
|
224
|
+
"""
|
|
225
|
+
...
|
|
@@ -0,0 +1,152 @@
|
|
|
1
|
+
# coding=utf-8
|
|
2
|
+
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
|
|
3
|
+
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
|
+
|
|
5
|
+
import copy
|
|
6
|
+
import warnings
|
|
7
|
+
import pulumi
|
|
8
|
+
import pulumi.runtime
|
|
9
|
+
from typing import Any, Mapping, Optional, Sequence, Union, overload
|
|
10
|
+
from . import _utilities
|
|
11
|
+
|
|
12
|
+
__all__ = [
|
|
13
|
+
'GetNamespacesResult',
|
|
14
|
+
'AwaitableGetNamespacesResult',
|
|
15
|
+
'get_namespaces',
|
|
16
|
+
'get_namespaces_output',
|
|
17
|
+
]
|
|
18
|
+
|
|
19
|
+
@pulumi.output_type
|
|
20
|
+
class GetNamespacesResult:
|
|
21
|
+
"""
|
|
22
|
+
A collection of values returned by getNamespaces.
|
|
23
|
+
"""
|
|
24
|
+
def __init__(__self__, id=None, namespace=None, paths=None):
|
|
25
|
+
if id and not isinstance(id, str):
|
|
26
|
+
raise TypeError("Expected argument 'id' to be a str")
|
|
27
|
+
pulumi.set(__self__, "id", id)
|
|
28
|
+
if namespace and not isinstance(namespace, str):
|
|
29
|
+
raise TypeError("Expected argument 'namespace' to be a str")
|
|
30
|
+
pulumi.set(__self__, "namespace", namespace)
|
|
31
|
+
if paths and not isinstance(paths, list):
|
|
32
|
+
raise TypeError("Expected argument 'paths' to be a list")
|
|
33
|
+
pulumi.set(__self__, "paths", paths)
|
|
34
|
+
|
|
35
|
+
@property
|
|
36
|
+
@pulumi.getter
|
|
37
|
+
def id(self) -> str:
|
|
38
|
+
"""
|
|
39
|
+
The provider-assigned unique ID for this managed resource.
|
|
40
|
+
"""
|
|
41
|
+
return pulumi.get(self, "id")
|
|
42
|
+
|
|
43
|
+
@property
|
|
44
|
+
@pulumi.getter
|
|
45
|
+
def namespace(self) -> Optional[str]:
|
|
46
|
+
return pulumi.get(self, "namespace")
|
|
47
|
+
|
|
48
|
+
@property
|
|
49
|
+
@pulumi.getter
|
|
50
|
+
def paths(self) -> Sequence[str]:
|
|
51
|
+
"""
|
|
52
|
+
Set of the paths of direct child namespaces.
|
|
53
|
+
"""
|
|
54
|
+
return pulumi.get(self, "paths")
|
|
55
|
+
|
|
56
|
+
|
|
57
|
+
class AwaitableGetNamespacesResult(GetNamespacesResult):
|
|
58
|
+
# pylint: disable=using-constant-test
|
|
59
|
+
def __await__(self):
|
|
60
|
+
if False:
|
|
61
|
+
yield self
|
|
62
|
+
return GetNamespacesResult(
|
|
63
|
+
id=self.id,
|
|
64
|
+
namespace=self.namespace,
|
|
65
|
+
paths=self.paths)
|
|
66
|
+
|
|
67
|
+
|
|
68
|
+
def get_namespaces(namespace: Optional[str] = None,
|
|
69
|
+
opts: Optional[pulumi.InvokeOptions] = None) -> AwaitableGetNamespacesResult:
|
|
70
|
+
"""
|
|
71
|
+
## Example Usage
|
|
72
|
+
|
|
73
|
+
### Child namespaces
|
|
74
|
+
|
|
75
|
+
<!--Start PulumiCodeChooser -->
|
|
76
|
+
```python
|
|
77
|
+
import pulumi
|
|
78
|
+
import pulumi_vault as vault
|
|
79
|
+
|
|
80
|
+
children = vault.get_namespaces()
|
|
81
|
+
```
|
|
82
|
+
<!--End PulumiCodeChooser -->
|
|
83
|
+
|
|
84
|
+
### Nested namespace
|
|
85
|
+
|
|
86
|
+
To fetch the details of nested namespaces:
|
|
87
|
+
|
|
88
|
+
<!--Start PulumiCodeChooser -->
|
|
89
|
+
```python
|
|
90
|
+
import pulumi
|
|
91
|
+
import pulumi_vault as vault
|
|
92
|
+
|
|
93
|
+
children = vault.get_namespaces(namespace="parent")
|
|
94
|
+
child = [vault.get_namespace(namespace=children.namespace,
|
|
95
|
+
path=__key) for __key, __value in children.paths]
|
|
96
|
+
```
|
|
97
|
+
<!--End PulumiCodeChooser -->
|
|
98
|
+
|
|
99
|
+
|
|
100
|
+
:param str namespace: The namespace to provision the resource in.
|
|
101
|
+
The value should not contain leading or trailing forward slashes.
|
|
102
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
|
|
103
|
+
"""
|
|
104
|
+
__args__ = dict()
|
|
105
|
+
__args__['namespace'] = namespace
|
|
106
|
+
opts = pulumi.InvokeOptions.merge(_utilities.get_invoke_opts_defaults(), opts)
|
|
107
|
+
__ret__ = pulumi.runtime.invoke('vault:index/getNamespaces:getNamespaces', __args__, opts=opts, typ=GetNamespacesResult).value
|
|
108
|
+
|
|
109
|
+
return AwaitableGetNamespacesResult(
|
|
110
|
+
id=pulumi.get(__ret__, 'id'),
|
|
111
|
+
namespace=pulumi.get(__ret__, 'namespace'),
|
|
112
|
+
paths=pulumi.get(__ret__, 'paths'))
|
|
113
|
+
|
|
114
|
+
|
|
115
|
+
@_utilities.lift_output_func(get_namespaces)
|
|
116
|
+
def get_namespaces_output(namespace: Optional[pulumi.Input[Optional[str]]] = None,
|
|
117
|
+
opts: Optional[pulumi.InvokeOptions] = None) -> pulumi.Output[GetNamespacesResult]:
|
|
118
|
+
"""
|
|
119
|
+
## Example Usage
|
|
120
|
+
|
|
121
|
+
### Child namespaces
|
|
122
|
+
|
|
123
|
+
<!--Start PulumiCodeChooser -->
|
|
124
|
+
```python
|
|
125
|
+
import pulumi
|
|
126
|
+
import pulumi_vault as vault
|
|
127
|
+
|
|
128
|
+
children = vault.get_namespaces()
|
|
129
|
+
```
|
|
130
|
+
<!--End PulumiCodeChooser -->
|
|
131
|
+
|
|
132
|
+
### Nested namespace
|
|
133
|
+
|
|
134
|
+
To fetch the details of nested namespaces:
|
|
135
|
+
|
|
136
|
+
<!--Start PulumiCodeChooser -->
|
|
137
|
+
```python
|
|
138
|
+
import pulumi
|
|
139
|
+
import pulumi_vault as vault
|
|
140
|
+
|
|
141
|
+
children = vault.get_namespaces(namespace="parent")
|
|
142
|
+
child = [vault.get_namespace(namespace=children.namespace,
|
|
143
|
+
path=__key) for __key, __value in children.paths]
|
|
144
|
+
```
|
|
145
|
+
<!--End PulumiCodeChooser -->
|
|
146
|
+
|
|
147
|
+
|
|
148
|
+
:param str namespace: The namespace to provision the resource in.
|
|
149
|
+
The value should not contain leading or trailing forward slashes.
|
|
150
|
+
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault#namespace).
|
|
151
|
+
"""
|
|
152
|
+
...
|
|
@@ -14,8 +14,9 @@ __all__ = ['SecretBackendRoleArgs', 'SecretBackendRole']
|
|
|
14
14
|
@pulumi.input_type
|
|
15
15
|
class SecretBackendRoleArgs:
|
|
16
16
|
def __init__(__self__, *,
|
|
17
|
-
allowed_kubernetes_namespaces: pulumi.Input[Sequence[pulumi.Input[str]]],
|
|
18
17
|
backend: pulumi.Input[str],
|
|
18
|
+
allowed_kubernetes_namespace_selector: Optional[pulumi.Input[str]] = None,
|
|
19
|
+
allowed_kubernetes_namespaces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
19
20
|
extra_annotations: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
|
|
20
21
|
extra_labels: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
|
|
21
22
|
generated_role_rules: Optional[pulumi.Input[str]] = None,
|
|
@@ -29,10 +30,15 @@ class SecretBackendRoleArgs:
|
|
|
29
30
|
token_max_ttl: Optional[pulumi.Input[int]] = None):
|
|
30
31
|
"""
|
|
31
32
|
The set of arguments for constructing a SecretBackendRole resource.
|
|
32
|
-
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_kubernetes_namespaces: The list of Kubernetes namespaces this role
|
|
33
|
-
can generate credentials for. If set to `*` all namespaces are allowed.
|
|
34
33
|
:param pulumi.Input[str] backend: The path of the Kubernetes Secrets Engine backend mount to create
|
|
35
34
|
the role in.
|
|
35
|
+
:param pulumi.Input[str] allowed_kubernetes_namespace_selector: A label selector for Kubernetes namespaces
|
|
36
|
+
in which credentials can be generated. Accepts either a JSON or YAML object. The value should be
|
|
37
|
+
of type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).
|
|
38
|
+
If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.
|
|
39
|
+
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_kubernetes_namespaces: The list of Kubernetes namespaces this role
|
|
40
|
+
can generate credentials for. If set to `*` all namespaces are allowed. If set with
|
|
41
|
+
`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.
|
|
36
42
|
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] extra_annotations: Additional annotations to apply to all generated
|
|
37
43
|
Kubernetes objects.
|
|
38
44
|
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] extra_labels: Additional labels to apply to all generated Kubernetes
|
|
@@ -62,8 +68,11 @@ class SecretBackendRoleArgs:
|
|
|
62
68
|
:param pulumi.Input[int] token_default_ttl: The default TTL for generated Kubernetes tokens in seconds.
|
|
63
69
|
:param pulumi.Input[int] token_max_ttl: The maximum TTL for generated Kubernetes tokens in seconds.
|
|
64
70
|
"""
|
|
65
|
-
pulumi.set(__self__, "allowed_kubernetes_namespaces", allowed_kubernetes_namespaces)
|
|
66
71
|
pulumi.set(__self__, "backend", backend)
|
|
72
|
+
if allowed_kubernetes_namespace_selector is not None:
|
|
73
|
+
pulumi.set(__self__, "allowed_kubernetes_namespace_selector", allowed_kubernetes_namespace_selector)
|
|
74
|
+
if allowed_kubernetes_namespaces is not None:
|
|
75
|
+
pulumi.set(__self__, "allowed_kubernetes_namespaces", allowed_kubernetes_namespaces)
|
|
67
76
|
if extra_annotations is not None:
|
|
68
77
|
pulumi.set(__self__, "extra_annotations", extra_annotations)
|
|
69
78
|
if extra_labels is not None:
|
|
@@ -87,19 +96,6 @@ class SecretBackendRoleArgs:
|
|
|
87
96
|
if token_max_ttl is not None:
|
|
88
97
|
pulumi.set(__self__, "token_max_ttl", token_max_ttl)
|
|
89
98
|
|
|
90
|
-
@property
|
|
91
|
-
@pulumi.getter(name="allowedKubernetesNamespaces")
|
|
92
|
-
def allowed_kubernetes_namespaces(self) -> pulumi.Input[Sequence[pulumi.Input[str]]]:
|
|
93
|
-
"""
|
|
94
|
-
The list of Kubernetes namespaces this role
|
|
95
|
-
can generate credentials for. If set to `*` all namespaces are allowed.
|
|
96
|
-
"""
|
|
97
|
-
return pulumi.get(self, "allowed_kubernetes_namespaces")
|
|
98
|
-
|
|
99
|
-
@allowed_kubernetes_namespaces.setter
|
|
100
|
-
def allowed_kubernetes_namespaces(self, value: pulumi.Input[Sequence[pulumi.Input[str]]]):
|
|
101
|
-
pulumi.set(self, "allowed_kubernetes_namespaces", value)
|
|
102
|
-
|
|
103
99
|
@property
|
|
104
100
|
@pulumi.getter
|
|
105
101
|
def backend(self) -> pulumi.Input[str]:
|
|
@@ -113,6 +109,35 @@ class SecretBackendRoleArgs:
|
|
|
113
109
|
def backend(self, value: pulumi.Input[str]):
|
|
114
110
|
pulumi.set(self, "backend", value)
|
|
115
111
|
|
|
112
|
+
@property
|
|
113
|
+
@pulumi.getter(name="allowedKubernetesNamespaceSelector")
|
|
114
|
+
def allowed_kubernetes_namespace_selector(self) -> Optional[pulumi.Input[str]]:
|
|
115
|
+
"""
|
|
116
|
+
A label selector for Kubernetes namespaces
|
|
117
|
+
in which credentials can be generated. Accepts either a JSON or YAML object. The value should be
|
|
118
|
+
of type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).
|
|
119
|
+
If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.
|
|
120
|
+
"""
|
|
121
|
+
return pulumi.get(self, "allowed_kubernetes_namespace_selector")
|
|
122
|
+
|
|
123
|
+
@allowed_kubernetes_namespace_selector.setter
|
|
124
|
+
def allowed_kubernetes_namespace_selector(self, value: Optional[pulumi.Input[str]]):
|
|
125
|
+
pulumi.set(self, "allowed_kubernetes_namespace_selector", value)
|
|
126
|
+
|
|
127
|
+
@property
|
|
128
|
+
@pulumi.getter(name="allowedKubernetesNamespaces")
|
|
129
|
+
def allowed_kubernetes_namespaces(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
130
|
+
"""
|
|
131
|
+
The list of Kubernetes namespaces this role
|
|
132
|
+
can generate credentials for. If set to `*` all namespaces are allowed. If set with
|
|
133
|
+
`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.
|
|
134
|
+
"""
|
|
135
|
+
return pulumi.get(self, "allowed_kubernetes_namespaces")
|
|
136
|
+
|
|
137
|
+
@allowed_kubernetes_namespaces.setter
|
|
138
|
+
def allowed_kubernetes_namespaces(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
|
|
139
|
+
pulumi.set(self, "allowed_kubernetes_namespaces", value)
|
|
140
|
+
|
|
116
141
|
@property
|
|
117
142
|
@pulumi.getter(name="extraAnnotations")
|
|
118
143
|
def extra_annotations(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]]:
|
|
@@ -266,6 +291,7 @@ class SecretBackendRoleArgs:
|
|
|
266
291
|
@pulumi.input_type
|
|
267
292
|
class _SecretBackendRoleState:
|
|
268
293
|
def __init__(__self__, *,
|
|
294
|
+
allowed_kubernetes_namespace_selector: Optional[pulumi.Input[str]] = None,
|
|
269
295
|
allowed_kubernetes_namespaces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
270
296
|
backend: Optional[pulumi.Input[str]] = None,
|
|
271
297
|
extra_annotations: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
|
|
@@ -281,8 +307,13 @@ class _SecretBackendRoleState:
|
|
|
281
307
|
token_max_ttl: Optional[pulumi.Input[int]] = None):
|
|
282
308
|
"""
|
|
283
309
|
Input properties used for looking up and filtering SecretBackendRole resources.
|
|
310
|
+
:param pulumi.Input[str] allowed_kubernetes_namespace_selector: A label selector for Kubernetes namespaces
|
|
311
|
+
in which credentials can be generated. Accepts either a JSON or YAML object. The value should be
|
|
312
|
+
of type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).
|
|
313
|
+
If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.
|
|
284
314
|
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_kubernetes_namespaces: The list of Kubernetes namespaces this role
|
|
285
|
-
can generate credentials for. If set to `*` all namespaces are allowed.
|
|
315
|
+
can generate credentials for. If set to `*` all namespaces are allowed. If set with
|
|
316
|
+
`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.
|
|
286
317
|
:param pulumi.Input[str] backend: The path of the Kubernetes Secrets Engine backend mount to create
|
|
287
318
|
the role in.
|
|
288
319
|
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] extra_annotations: Additional annotations to apply to all generated
|
|
@@ -314,6 +345,8 @@ class _SecretBackendRoleState:
|
|
|
314
345
|
:param pulumi.Input[int] token_default_ttl: The default TTL for generated Kubernetes tokens in seconds.
|
|
315
346
|
:param pulumi.Input[int] token_max_ttl: The maximum TTL for generated Kubernetes tokens in seconds.
|
|
316
347
|
"""
|
|
348
|
+
if allowed_kubernetes_namespace_selector is not None:
|
|
349
|
+
pulumi.set(__self__, "allowed_kubernetes_namespace_selector", allowed_kubernetes_namespace_selector)
|
|
317
350
|
if allowed_kubernetes_namespaces is not None:
|
|
318
351
|
pulumi.set(__self__, "allowed_kubernetes_namespaces", allowed_kubernetes_namespaces)
|
|
319
352
|
if backend is not None:
|
|
@@ -341,12 +374,28 @@ class _SecretBackendRoleState:
|
|
|
341
374
|
if token_max_ttl is not None:
|
|
342
375
|
pulumi.set(__self__, "token_max_ttl", token_max_ttl)
|
|
343
376
|
|
|
377
|
+
@property
|
|
378
|
+
@pulumi.getter(name="allowedKubernetesNamespaceSelector")
|
|
379
|
+
def allowed_kubernetes_namespace_selector(self) -> Optional[pulumi.Input[str]]:
|
|
380
|
+
"""
|
|
381
|
+
A label selector for Kubernetes namespaces
|
|
382
|
+
in which credentials can be generated. Accepts either a JSON or YAML object. The value should be
|
|
383
|
+
of type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).
|
|
384
|
+
If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.
|
|
385
|
+
"""
|
|
386
|
+
return pulumi.get(self, "allowed_kubernetes_namespace_selector")
|
|
387
|
+
|
|
388
|
+
@allowed_kubernetes_namespace_selector.setter
|
|
389
|
+
def allowed_kubernetes_namespace_selector(self, value: Optional[pulumi.Input[str]]):
|
|
390
|
+
pulumi.set(self, "allowed_kubernetes_namespace_selector", value)
|
|
391
|
+
|
|
344
392
|
@property
|
|
345
393
|
@pulumi.getter(name="allowedKubernetesNamespaces")
|
|
346
394
|
def allowed_kubernetes_namespaces(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
|
|
347
395
|
"""
|
|
348
396
|
The list of Kubernetes namespaces this role
|
|
349
|
-
can generate credentials for. If set to `*` all namespaces are allowed.
|
|
397
|
+
can generate credentials for. If set to `*` all namespaces are allowed. If set with
|
|
398
|
+
`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.
|
|
350
399
|
"""
|
|
351
400
|
return pulumi.get(self, "allowed_kubernetes_namespaces")
|
|
352
401
|
|
|
@@ -522,6 +571,7 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
522
571
|
def __init__(__self__,
|
|
523
572
|
resource_name: str,
|
|
524
573
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
574
|
+
allowed_kubernetes_namespace_selector: Optional[pulumi.Input[str]] = None,
|
|
525
575
|
allowed_kubernetes_namespaces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
526
576
|
backend: Optional[pulumi.Input[str]] = None,
|
|
527
577
|
extra_annotations: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
|
|
@@ -649,8 +699,13 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
649
699
|
|
|
650
700
|
:param str resource_name: The name of the resource.
|
|
651
701
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
702
|
+
:param pulumi.Input[str] allowed_kubernetes_namespace_selector: A label selector for Kubernetes namespaces
|
|
703
|
+
in which credentials can be generated. Accepts either a JSON or YAML object. The value should be
|
|
704
|
+
of type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).
|
|
705
|
+
If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.
|
|
652
706
|
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_kubernetes_namespaces: The list of Kubernetes namespaces this role
|
|
653
|
-
can generate credentials for. If set to `*` all namespaces are allowed.
|
|
707
|
+
can generate credentials for. If set to `*` all namespaces are allowed. If set with
|
|
708
|
+
`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.
|
|
654
709
|
:param pulumi.Input[str] backend: The path of the Kubernetes Secrets Engine backend mount to create
|
|
655
710
|
the role in.
|
|
656
711
|
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] extra_annotations: Additional annotations to apply to all generated
|
|
@@ -814,6 +869,7 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
814
869
|
def _internal_init(__self__,
|
|
815
870
|
resource_name: str,
|
|
816
871
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
872
|
+
allowed_kubernetes_namespace_selector: Optional[pulumi.Input[str]] = None,
|
|
817
873
|
allowed_kubernetes_namespaces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
818
874
|
backend: Optional[pulumi.Input[str]] = None,
|
|
819
875
|
extra_annotations: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
|
|
@@ -836,8 +892,7 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
836
892
|
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
837
893
|
__props__ = SecretBackendRoleArgs.__new__(SecretBackendRoleArgs)
|
|
838
894
|
|
|
839
|
-
|
|
840
|
-
raise TypeError("Missing required property 'allowed_kubernetes_namespaces'")
|
|
895
|
+
__props__.__dict__["allowed_kubernetes_namespace_selector"] = allowed_kubernetes_namespace_selector
|
|
841
896
|
__props__.__dict__["allowed_kubernetes_namespaces"] = allowed_kubernetes_namespaces
|
|
842
897
|
if backend is None and not opts.urn:
|
|
843
898
|
raise TypeError("Missing required property 'backend'")
|
|
@@ -863,6 +918,7 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
863
918
|
def get(resource_name: str,
|
|
864
919
|
id: pulumi.Input[str],
|
|
865
920
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
921
|
+
allowed_kubernetes_namespace_selector: Optional[pulumi.Input[str]] = None,
|
|
866
922
|
allowed_kubernetes_namespaces: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
|
|
867
923
|
backend: Optional[pulumi.Input[str]] = None,
|
|
868
924
|
extra_annotations: Optional[pulumi.Input[Mapping[str, pulumi.Input[str]]]] = None,
|
|
@@ -883,8 +939,13 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
883
939
|
:param str resource_name: The unique name of the resulting resource.
|
|
884
940
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
885
941
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
942
|
+
:param pulumi.Input[str] allowed_kubernetes_namespace_selector: A label selector for Kubernetes namespaces
|
|
943
|
+
in which credentials can be generated. Accepts either a JSON or YAML object. The value should be
|
|
944
|
+
of type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).
|
|
945
|
+
If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.
|
|
886
946
|
:param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_kubernetes_namespaces: The list of Kubernetes namespaces this role
|
|
887
|
-
can generate credentials for. If set to `*` all namespaces are allowed.
|
|
947
|
+
can generate credentials for. If set to `*` all namespaces are allowed. If set with
|
|
948
|
+
`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.
|
|
888
949
|
:param pulumi.Input[str] backend: The path of the Kubernetes Secrets Engine backend mount to create
|
|
889
950
|
the role in.
|
|
890
951
|
:param pulumi.Input[Mapping[str, pulumi.Input[str]]] extra_annotations: Additional annotations to apply to all generated
|
|
@@ -920,6 +981,7 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
920
981
|
|
|
921
982
|
__props__ = _SecretBackendRoleState.__new__(_SecretBackendRoleState)
|
|
922
983
|
|
|
984
|
+
__props__.__dict__["allowed_kubernetes_namespace_selector"] = allowed_kubernetes_namespace_selector
|
|
923
985
|
__props__.__dict__["allowed_kubernetes_namespaces"] = allowed_kubernetes_namespaces
|
|
924
986
|
__props__.__dict__["backend"] = backend
|
|
925
987
|
__props__.__dict__["extra_annotations"] = extra_annotations
|
|
@@ -935,12 +997,24 @@ class SecretBackendRole(pulumi.CustomResource):
|
|
|
935
997
|
__props__.__dict__["token_max_ttl"] = token_max_ttl
|
|
936
998
|
return SecretBackendRole(resource_name, opts=opts, __props__=__props__)
|
|
937
999
|
|
|
1000
|
+
@property
|
|
1001
|
+
@pulumi.getter(name="allowedKubernetesNamespaceSelector")
|
|
1002
|
+
def allowed_kubernetes_namespace_selector(self) -> pulumi.Output[Optional[str]]:
|
|
1003
|
+
"""
|
|
1004
|
+
A label selector for Kubernetes namespaces
|
|
1005
|
+
in which credentials can be generated. Accepts either a JSON or YAML object. The value should be
|
|
1006
|
+
of type [LabelSelector](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#labelselector-v1-meta).
|
|
1007
|
+
If set with `allowed_kubernetes_namespace`, the conditions are `OR`ed.
|
|
1008
|
+
"""
|
|
1009
|
+
return pulumi.get(self, "allowed_kubernetes_namespace_selector")
|
|
1010
|
+
|
|
938
1011
|
@property
|
|
939
1012
|
@pulumi.getter(name="allowedKubernetesNamespaces")
|
|
940
|
-
def allowed_kubernetes_namespaces(self) -> pulumi.Output[Sequence[str]]:
|
|
1013
|
+
def allowed_kubernetes_namespaces(self) -> pulumi.Output[Optional[Sequence[str]]]:
|
|
941
1014
|
"""
|
|
942
1015
|
The list of Kubernetes namespaces this role
|
|
943
|
-
can generate credentials for. If set to `*` all namespaces are allowed.
|
|
1016
|
+
can generate credentials for. If set to `*` all namespaces are allowed. If set with
|
|
1017
|
+
`allowed_kubernetes_namespace_selector`, the conditions are `OR`ed.
|
|
944
1018
|
"""
|
|
945
1019
|
return pulumi.get(self, "allowed_kubernetes_namespaces")
|
|
946
1020
|
|
|
@@ -199,11 +199,11 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
199
199
|
import pulumi_vault as vault
|
|
200
200
|
|
|
201
201
|
mongo = vault.Mount("mongo",
|
|
202
|
-
description="MongoDB Atlas secret engine mount",
|
|
203
202
|
path="mongodbatlas",
|
|
204
|
-
type="mongodbatlas"
|
|
203
|
+
type="mongodbatlas",
|
|
204
|
+
description="MongoDB Atlas secret engine mount")
|
|
205
205
|
config = vault.mongodbatlas.SecretBackend("config",
|
|
206
|
-
mount=
|
|
206
|
+
mount=mongo.path,
|
|
207
207
|
private_key="privateKey",
|
|
208
208
|
public_key="publicKey")
|
|
209
209
|
```
|
|
@@ -242,11 +242,11 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
242
242
|
import pulumi_vault as vault
|
|
243
243
|
|
|
244
244
|
mongo = vault.Mount("mongo",
|
|
245
|
-
description="MongoDB Atlas secret engine mount",
|
|
246
245
|
path="mongodbatlas",
|
|
247
|
-
type="mongodbatlas"
|
|
246
|
+
type="mongodbatlas",
|
|
247
|
+
description="MongoDB Atlas secret engine mount")
|
|
248
248
|
config = vault.mongodbatlas.SecretBackend("config",
|
|
249
|
-
mount=
|
|
249
|
+
mount=mongo.path,
|
|
250
250
|
private_key="privateKey",
|
|
251
251
|
public_key="publicKey")
|
|
252
252
|
```
|