pulumi-vault 6.1.1__py3-none-any.whl → 6.2.0__py3-none-any.whl

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (29) hide show
  1. pulumi_vault/__init__.py +26 -0
  2. pulumi_vault/auth_backend.py +47 -0
  3. pulumi_vault/aws/auth_backend_client.py +247 -7
  4. pulumi_vault/aws/secret_backend_role.py +54 -0
  5. pulumi_vault/azure/auth_backend_config.py +133 -0
  6. pulumi_vault/azure/backend.py +203 -0
  7. pulumi_vault/database/secrets_mount.py +282 -0
  8. pulumi_vault/gcp/auth_backend.py +244 -0
  9. pulumi_vault/gcp/secret_backend.py +271 -3
  10. pulumi_vault/jwt/auth_backend_role.py +28 -35
  11. pulumi_vault/kubernetes/secret_backend.py +282 -0
  12. pulumi_vault/ldap/secret_backend.py +282 -0
  13. pulumi_vault/mount.py +324 -0
  14. pulumi_vault/okta/auth_backend.py +453 -0
  15. pulumi_vault/pkisecret/__init__.py +2 -0
  16. pulumi_vault/pkisecret/_inputs.py +30 -0
  17. pulumi_vault/pkisecret/backend_config_est.py +614 -0
  18. pulumi_vault/pkisecret/get_backend_config_est.py +233 -0
  19. pulumi_vault/pkisecret/outputs.py +54 -0
  20. pulumi_vault/plugin.py +590 -0
  21. pulumi_vault/plugin_pinned_version.py +293 -0
  22. pulumi_vault/pulumi-plugin.json +1 -1
  23. pulumi_vault/quota_lease_count.py +47 -0
  24. pulumi_vault/quota_rate_limit.py +47 -0
  25. pulumi_vault/ssh/secret_backend_ca.py +94 -0
  26. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/METADATA +1 -1
  27. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/RECORD +29 -25
  28. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/WHEEL +1 -1
  29. {pulumi_vault-6.1.1.dist-info → pulumi_vault-6.2.0.dist-info}/top_level.txt +0 -0
pulumi_vault/kubernetes/secret_backend.py CHANGED
@@ -16,31 +16,40 @@ class SecretBackendArgs:
16
16
  def __init__(__self__, *,
17
17
  path: pulumi.Input[str],
18
18
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
19
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
19
20
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
20
21
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
21
22
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
23
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
22
24
  description: Optional[pulumi.Input[str]] = None,
23
25
  disable_local_ca_jwt: Optional[pulumi.Input[bool]] = None,
24
26
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
27
+ identity_token_key: Optional[pulumi.Input[str]] = None,
25
28
  kubernetes_ca_cert: Optional[pulumi.Input[str]] = None,
26
29
  kubernetes_host: Optional[pulumi.Input[str]] = None,
30
+ listing_visibility: Optional[pulumi.Input[str]] = None,
27
31
  local: Optional[pulumi.Input[bool]] = None,
28
32
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
29
33
  namespace: Optional[pulumi.Input[str]] = None,
30
34
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
35
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
36
+ plugin_version: Optional[pulumi.Input[str]] = None,
31
37
  seal_wrap: Optional[pulumi.Input[bool]] = None,
32
38
  service_account_jwt: Optional[pulumi.Input[str]] = None):
33
39
  """
34
40
  The set of arguments for constructing a SecretBackend resource.
35
41
  :param pulumi.Input[str] path: Where the secret backend will be mounted
36
42
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
43
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
37
44
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
38
45
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
39
46
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
47
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
40
48
  :param pulumi.Input[str] description: Human-friendly description of the mount
41
49
  :param pulumi.Input[bool] disable_local_ca_jwt: Disable defaulting to the local CA certificate and
42
50
  service account JWT when Vault is running in a Kubernetes pod.
43
51
  :param pulumi.Input[bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
52
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens
44
53
  :param pulumi.Input[str] kubernetes_ca_cert: A PEM-encoded CA certificate used by the
45
54
  secrets engine to verify the Kubernetes API server certificate. Defaults to the local
46
55
  pod’s CA if Vault is running in Kubernetes. Otherwise, defaults to the root CA set where
@@ -48,6 +57,7 @@ class SecretBackendArgs:
48
57
  :param pulumi.Input[str] kubernetes_host: The Kubernetes API URL to connect to. Required if the
49
58
  standard pod environment variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT`
50
59
  are not set on the host that Vault is running on.
60
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
51
61
  :param pulumi.Input[bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
52
62
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
53
63
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -55,6 +65,8 @@ class SecretBackendArgs:
55
65
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
56
66
  *Available only for Vault Enterprise*.
57
67
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
68
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
69
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
58
70
  :param pulumi.Input[bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
59
71
  :param pulumi.Input[str] service_account_jwt: The JSON web token of the service account used by the
60
72
  secrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if Vault
@@ -63,22 +75,30 @@ class SecretBackendArgs:
63
75
  pulumi.set(__self__, "path", path)
64
76
  if allowed_managed_keys is not None:
65
77
  pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
78
+ if allowed_response_headers is not None:
79
+ pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
66
80
  if audit_non_hmac_request_keys is not None:
67
81
  pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
68
82
  if audit_non_hmac_response_keys is not None:
69
83
  pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
70
84
  if default_lease_ttl_seconds is not None:
71
85
  pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
86
+ if delegated_auth_accessors is not None:
87
+ pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
72
88
  if description is not None:
73
89
  pulumi.set(__self__, "description", description)
74
90
  if disable_local_ca_jwt is not None:
75
91
  pulumi.set(__self__, "disable_local_ca_jwt", disable_local_ca_jwt)
76
92
  if external_entropy_access is not None:
77
93
  pulumi.set(__self__, "external_entropy_access", external_entropy_access)
94
+ if identity_token_key is not None:
95
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
78
96
  if kubernetes_ca_cert is not None:
79
97
  pulumi.set(__self__, "kubernetes_ca_cert", kubernetes_ca_cert)
80
98
  if kubernetes_host is not None:
81
99
  pulumi.set(__self__, "kubernetes_host", kubernetes_host)
100
+ if listing_visibility is not None:
101
+ pulumi.set(__self__, "listing_visibility", listing_visibility)
82
102
  if local is not None:
83
103
  pulumi.set(__self__, "local", local)
84
104
  if max_lease_ttl_seconds is not None:
@@ -87,6 +107,10 @@ class SecretBackendArgs:
87
107
  pulumi.set(__self__, "namespace", namespace)
88
108
  if options is not None:
89
109
  pulumi.set(__self__, "options", options)
110
+ if passthrough_request_headers is not None:
111
+ pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
112
+ if plugin_version is not None:
113
+ pulumi.set(__self__, "plugin_version", plugin_version)
90
114
  if seal_wrap is not None:
91
115
  pulumi.set(__self__, "seal_wrap", seal_wrap)
92
116
  if service_account_jwt is not None:
@@ -116,6 +140,18 @@ class SecretBackendArgs:
116
140
  def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
117
141
  pulumi.set(self, "allowed_managed_keys", value)
118
142
 
143
+ @property
144
+ @pulumi.getter(name="allowedResponseHeaders")
145
+ def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
146
+ """
147
+ List of headers to allow and pass from the request to the plugin
148
+ """
149
+ return pulumi.get(self, "allowed_response_headers")
150
+
151
+ @allowed_response_headers.setter
152
+ def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
153
+ pulumi.set(self, "allowed_response_headers", value)
154
+
119
155
  @property
120
156
  @pulumi.getter(name="auditNonHmacRequestKeys")
121
157
  def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
@@ -152,6 +188,18 @@ class SecretBackendArgs:
152
188
  def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[int]]):
153
189
  pulumi.set(self, "default_lease_ttl_seconds", value)
154
190
 
191
+ @property
192
+ @pulumi.getter(name="delegatedAuthAccessors")
193
+ def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
194
+ """
195
+ List of headers to allow and pass from the request to the plugin
196
+ """
197
+ return pulumi.get(self, "delegated_auth_accessors")
198
+
199
+ @delegated_auth_accessors.setter
200
+ def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
201
+ pulumi.set(self, "delegated_auth_accessors", value)
202
+
155
203
  @property
156
204
  @pulumi.getter
157
205
  def description(self) -> Optional[pulumi.Input[str]]:
@@ -189,6 +237,18 @@ class SecretBackendArgs:
189
237
  def external_entropy_access(self, value: Optional[pulumi.Input[bool]]):
190
238
  pulumi.set(self, "external_entropy_access", value)
191
239
 
240
+ @property
241
+ @pulumi.getter(name="identityTokenKey")
242
+ def identity_token_key(self) -> Optional[pulumi.Input[str]]:
243
+ """
244
+ The key to use for signing plugin workload identity tokens
245
+ """
246
+ return pulumi.get(self, "identity_token_key")
247
+
248
+ @identity_token_key.setter
249
+ def identity_token_key(self, value: Optional[pulumi.Input[str]]):
250
+ pulumi.set(self, "identity_token_key", value)
251
+
192
252
  @property
193
253
  @pulumi.getter(name="kubernetesCaCert")
194
254
  def kubernetes_ca_cert(self) -> Optional[pulumi.Input[str]]:
@@ -218,6 +278,18 @@ class SecretBackendArgs:
218
278
  def kubernetes_host(self, value: Optional[pulumi.Input[str]]):
219
279
  pulumi.set(self, "kubernetes_host", value)
220
280
 
281
+ @property
282
+ @pulumi.getter(name="listingVisibility")
283
+ def listing_visibility(self) -> Optional[pulumi.Input[str]]:
284
+ """
285
+ Specifies whether to show this mount in the UI-specific listing endpoint
286
+ """
287
+ return pulumi.get(self, "listing_visibility")
288
+
289
+ @listing_visibility.setter
290
+ def listing_visibility(self, value: Optional[pulumi.Input[str]]):
291
+ pulumi.set(self, "listing_visibility", value)
292
+
221
293
  @property
222
294
  @pulumi.getter
223
295
  def local(self) -> Optional[pulumi.Input[bool]]:
@@ -269,6 +341,30 @@ class SecretBackendArgs:
269
341
  def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
270
342
  pulumi.set(self, "options", value)
271
343
 
344
+ @property
345
+ @pulumi.getter(name="passthroughRequestHeaders")
346
+ def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
347
+ """
348
+ List of headers to allow and pass from the request to the plugin
349
+ """
350
+ return pulumi.get(self, "passthrough_request_headers")
351
+
352
+ @passthrough_request_headers.setter
353
+ def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
354
+ pulumi.set(self, "passthrough_request_headers", value)
355
+
356
+ @property
357
+ @pulumi.getter(name="pluginVersion")
358
+ def plugin_version(self) -> Optional[pulumi.Input[str]]:
359
+ """
360
+ Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
361
+ """
362
+ return pulumi.get(self, "plugin_version")
363
+
364
+ @plugin_version.setter
365
+ def plugin_version(self, value: Optional[pulumi.Input[str]]):
366
+ pulumi.set(self, "plugin_version", value)
367
+
272
368
  @property
273
369
  @pulumi.getter(name="sealWrap")
274
370
  def seal_wrap(self) -> Optional[pulumi.Input[bool]]:
@@ -301,32 +397,41 @@ class _SecretBackendState:
301
397
  def __init__(__self__, *,
302
398
  accessor: Optional[pulumi.Input[str]] = None,
303
399
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
400
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
304
401
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
305
402
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
306
403
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
404
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
307
405
  description: Optional[pulumi.Input[str]] = None,
308
406
  disable_local_ca_jwt: Optional[pulumi.Input[bool]] = None,
309
407
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
408
+ identity_token_key: Optional[pulumi.Input[str]] = None,
310
409
  kubernetes_ca_cert: Optional[pulumi.Input[str]] = None,
311
410
  kubernetes_host: Optional[pulumi.Input[str]] = None,
411
+ listing_visibility: Optional[pulumi.Input[str]] = None,
312
412
  local: Optional[pulumi.Input[bool]] = None,
313
413
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
314
414
  namespace: Optional[pulumi.Input[str]] = None,
315
415
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
416
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
316
417
  path: Optional[pulumi.Input[str]] = None,
418
+ plugin_version: Optional[pulumi.Input[str]] = None,
317
419
  seal_wrap: Optional[pulumi.Input[bool]] = None,
318
420
  service_account_jwt: Optional[pulumi.Input[str]] = None):
319
421
  """
320
422
  Input properties used for looking up and filtering SecretBackend resources.
321
423
  :param pulumi.Input[str] accessor: Accessor of the mount
322
424
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
425
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
323
426
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
324
427
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
325
428
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
429
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
326
430
  :param pulumi.Input[str] description: Human-friendly description of the mount
327
431
  :param pulumi.Input[bool] disable_local_ca_jwt: Disable defaulting to the local CA certificate and
328
432
  service account JWT when Vault is running in a Kubernetes pod.
329
433
  :param pulumi.Input[bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
434
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens
330
435
  :param pulumi.Input[str] kubernetes_ca_cert: A PEM-encoded CA certificate used by the
331
436
  secrets engine to verify the Kubernetes API server certificate. Defaults to the local
332
437
  pod’s CA if Vault is running in Kubernetes. Otherwise, defaults to the root CA set where
@@ -334,6 +439,7 @@ class _SecretBackendState:
334
439
  :param pulumi.Input[str] kubernetes_host: The Kubernetes API URL to connect to. Required if the
335
440
  standard pod environment variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT`
336
441
  are not set on the host that Vault is running on.
442
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
337
443
  :param pulumi.Input[bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
338
444
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
339
445
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -341,7 +447,9 @@ class _SecretBackendState:
341
447
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
342
448
  *Available only for Vault Enterprise*.
343
449
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
450
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
344
451
  :param pulumi.Input[str] path: Where the secret backend will be mounted
452
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
345
453
  :param pulumi.Input[bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
346
454
  :param pulumi.Input[str] service_account_jwt: The JSON web token of the service account used by the
347
455
  secrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if Vault
@@ -351,22 +459,30 @@ class _SecretBackendState:
351
459
  pulumi.set(__self__, "accessor", accessor)
352
460
  if allowed_managed_keys is not None:
353
461
  pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
462
+ if allowed_response_headers is not None:
463
+ pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
354
464
  if audit_non_hmac_request_keys is not None:
355
465
  pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
356
466
  if audit_non_hmac_response_keys is not None:
357
467
  pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
358
468
  if default_lease_ttl_seconds is not None:
359
469
  pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
470
+ if delegated_auth_accessors is not None:
471
+ pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
360
472
  if description is not None:
361
473
  pulumi.set(__self__, "description", description)
362
474
  if disable_local_ca_jwt is not None:
363
475
  pulumi.set(__self__, "disable_local_ca_jwt", disable_local_ca_jwt)
364
476
  if external_entropy_access is not None:
365
477
  pulumi.set(__self__, "external_entropy_access", external_entropy_access)
478
+ if identity_token_key is not None:
479
+ pulumi.set(__self__, "identity_token_key", identity_token_key)
366
480
  if kubernetes_ca_cert is not None:
367
481
  pulumi.set(__self__, "kubernetes_ca_cert", kubernetes_ca_cert)
368
482
  if kubernetes_host is not None:
369
483
  pulumi.set(__self__, "kubernetes_host", kubernetes_host)
484
+ if listing_visibility is not None:
485
+ pulumi.set(__self__, "listing_visibility", listing_visibility)
370
486
  if local is not None:
371
487
  pulumi.set(__self__, "local", local)
372
488
  if max_lease_ttl_seconds is not None:
@@ -375,8 +491,12 @@ class _SecretBackendState:
375
491
  pulumi.set(__self__, "namespace", namespace)
376
492
  if options is not None:
377
493
  pulumi.set(__self__, "options", options)
494
+ if passthrough_request_headers is not None:
495
+ pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
378
496
  if path is not None:
379
497
  pulumi.set(__self__, "path", path)
498
+ if plugin_version is not None:
499
+ pulumi.set(__self__, "plugin_version", plugin_version)
380
500
  if seal_wrap is not None:
381
501
  pulumi.set(__self__, "seal_wrap", seal_wrap)
382
502
  if service_account_jwt is not None:
@@ -406,6 +526,18 @@ class _SecretBackendState:
406
526
  def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
407
527
  pulumi.set(self, "allowed_managed_keys", value)
408
528
 
529
+ @property
530
+ @pulumi.getter(name="allowedResponseHeaders")
531
+ def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
532
+ """
533
+ List of headers to allow and pass from the request to the plugin
534
+ """
535
+ return pulumi.get(self, "allowed_response_headers")
536
+
537
+ @allowed_response_headers.setter
538
+ def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
539
+ pulumi.set(self, "allowed_response_headers", value)
540
+
409
541
  @property
410
542
  @pulumi.getter(name="auditNonHmacRequestKeys")
411
543
  def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
@@ -442,6 +574,18 @@ class _SecretBackendState:
442
574
  def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[int]]):
443
575
  pulumi.set(self, "default_lease_ttl_seconds", value)
444
576
 
577
+ @property
578
+ @pulumi.getter(name="delegatedAuthAccessors")
579
+ def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
580
+ """
581
+ List of headers to allow and pass from the request to the plugin
582
+ """
583
+ return pulumi.get(self, "delegated_auth_accessors")
584
+
585
+ @delegated_auth_accessors.setter
586
+ def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
587
+ pulumi.set(self, "delegated_auth_accessors", value)
588
+
445
589
  @property
446
590
  @pulumi.getter
447
591
  def description(self) -> Optional[pulumi.Input[str]]:
@@ -479,6 +623,18 @@ class _SecretBackendState:
479
623
  def external_entropy_access(self, value: Optional[pulumi.Input[bool]]):
480
624
  pulumi.set(self, "external_entropy_access", value)
481
625
 
626
+ @property
627
+ @pulumi.getter(name="identityTokenKey")
628
+ def identity_token_key(self) -> Optional[pulumi.Input[str]]:
629
+ """
630
+ The key to use for signing plugin workload identity tokens
631
+ """
632
+ return pulumi.get(self, "identity_token_key")
633
+
634
+ @identity_token_key.setter
635
+ def identity_token_key(self, value: Optional[pulumi.Input[str]]):
636
+ pulumi.set(self, "identity_token_key", value)
637
+
482
638
  @property
483
639
  @pulumi.getter(name="kubernetesCaCert")
484
640
  def kubernetes_ca_cert(self) -> Optional[pulumi.Input[str]]:
@@ -508,6 +664,18 @@ class _SecretBackendState:
508
664
  def kubernetes_host(self, value: Optional[pulumi.Input[str]]):
509
665
  pulumi.set(self, "kubernetes_host", value)
510
666
 
667
+ @property
668
+ @pulumi.getter(name="listingVisibility")
669
+ def listing_visibility(self) -> Optional[pulumi.Input[str]]:
670
+ """
671
+ Specifies whether to show this mount in the UI-specific listing endpoint
672
+ """
673
+ return pulumi.get(self, "listing_visibility")
674
+
675
+ @listing_visibility.setter
676
+ def listing_visibility(self, value: Optional[pulumi.Input[str]]):
677
+ pulumi.set(self, "listing_visibility", value)
678
+
511
679
  @property
512
680
  @pulumi.getter
513
681
  def local(self) -> Optional[pulumi.Input[bool]]:
@@ -559,6 +727,18 @@ class _SecretBackendState:
559
727
  def options(self, value: Optional[pulumi.Input[Mapping[str, Any]]]):
560
728
  pulumi.set(self, "options", value)
561
729
 
730
+ @property
731
+ @pulumi.getter(name="passthroughRequestHeaders")
732
+ def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]:
733
+ """
734
+ List of headers to allow and pass from the request to the plugin
735
+ """
736
+ return pulumi.get(self, "passthrough_request_headers")
737
+
738
+ @passthrough_request_headers.setter
739
+ def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]]):
740
+ pulumi.set(self, "passthrough_request_headers", value)
741
+
562
742
  @property
563
743
  @pulumi.getter
564
744
  def path(self) -> Optional[pulumi.Input[str]]:
@@ -571,6 +751,18 @@ class _SecretBackendState:
571
751
  def path(self, value: Optional[pulumi.Input[str]]):
572
752
  pulumi.set(self, "path", value)
573
753
 
754
+ @property
755
+ @pulumi.getter(name="pluginVersion")
756
+ def plugin_version(self) -> Optional[pulumi.Input[str]]:
757
+ """
758
+ Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
759
+ """
760
+ return pulumi.get(self, "plugin_version")
761
+
762
+ @plugin_version.setter
763
+ def plugin_version(self, value: Optional[pulumi.Input[str]]):
764
+ pulumi.set(self, "plugin_version", value)
765
+
574
766
  @property
575
767
  @pulumi.getter(name="sealWrap")
576
768
  def seal_wrap(self) -> Optional[pulumi.Input[bool]]:
@@ -604,19 +796,25 @@ class SecretBackend(pulumi.CustomResource):
604
796
  resource_name: str,
605
797
  opts: Optional[pulumi.ResourceOptions] = None,
606
798
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
799
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
607
800
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
608
801
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
609
802
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
803
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
610
804
  description: Optional[pulumi.Input[str]] = None,
611
805
  disable_local_ca_jwt: Optional[pulumi.Input[bool]] = None,
612
806
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
807
+ identity_token_key: Optional[pulumi.Input[str]] = None,
613
808
  kubernetes_ca_cert: Optional[pulumi.Input[str]] = None,
614
809
  kubernetes_host: Optional[pulumi.Input[str]] = None,
810
+ listing_visibility: Optional[pulumi.Input[str]] = None,
615
811
  local: Optional[pulumi.Input[bool]] = None,
616
812
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
617
813
  namespace: Optional[pulumi.Input[str]] = None,
618
814
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
815
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
619
816
  path: Optional[pulumi.Input[str]] = None,
817
+ plugin_version: Optional[pulumi.Input[str]] = None,
620
818
  seal_wrap: Optional[pulumi.Input[bool]] = None,
621
819
  service_account_jwt: Optional[pulumi.Input[str]] = None,
622
820
  __props__=None):
@@ -650,13 +848,16 @@ class SecretBackend(pulumi.CustomResource):
650
848
  :param str resource_name: The name of the resource.
651
849
  :param pulumi.ResourceOptions opts: Options for the resource.
652
850
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
851
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
653
852
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
654
853
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
655
854
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
855
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
656
856
  :param pulumi.Input[str] description: Human-friendly description of the mount
657
857
  :param pulumi.Input[bool] disable_local_ca_jwt: Disable defaulting to the local CA certificate and
658
858
  service account JWT when Vault is running in a Kubernetes pod.
659
859
  :param pulumi.Input[bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
860
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens
660
861
  :param pulumi.Input[str] kubernetes_ca_cert: A PEM-encoded CA certificate used by the
661
862
  secrets engine to verify the Kubernetes API server certificate. Defaults to the local
662
863
  pod’s CA if Vault is running in Kubernetes. Otherwise, defaults to the root CA set where
@@ -664,6 +865,7 @@ class SecretBackend(pulumi.CustomResource):
664
865
  :param pulumi.Input[str] kubernetes_host: The Kubernetes API URL to connect to. Required if the
665
866
  standard pod environment variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT`
666
867
  are not set on the host that Vault is running on.
868
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
667
869
  :param pulumi.Input[bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
668
870
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
669
871
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -671,7 +873,9 @@ class SecretBackend(pulumi.CustomResource):
671
873
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
672
874
  *Available only for Vault Enterprise*.
673
875
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
876
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
674
877
  :param pulumi.Input[str] path: Where the secret backend will be mounted
878
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
675
879
  :param pulumi.Input[bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
676
880
  :param pulumi.Input[str] service_account_jwt: The JSON web token of the service account used by the
677
881
  secrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if Vault
@@ -726,19 +930,25 @@ class SecretBackend(pulumi.CustomResource):
726
930
  resource_name: str,
727
931
  opts: Optional[pulumi.ResourceOptions] = None,
728
932
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
933
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
729
934
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
730
935
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
731
936
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
937
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
732
938
  description: Optional[pulumi.Input[str]] = None,
733
939
  disable_local_ca_jwt: Optional[pulumi.Input[bool]] = None,
734
940
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
941
+ identity_token_key: Optional[pulumi.Input[str]] = None,
735
942
  kubernetes_ca_cert: Optional[pulumi.Input[str]] = None,
736
943
  kubernetes_host: Optional[pulumi.Input[str]] = None,
944
+ listing_visibility: Optional[pulumi.Input[str]] = None,
737
945
  local: Optional[pulumi.Input[bool]] = None,
738
946
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
739
947
  namespace: Optional[pulumi.Input[str]] = None,
740
948
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
949
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
741
950
  path: Optional[pulumi.Input[str]] = None,
951
+ plugin_version: Optional[pulumi.Input[str]] = None,
742
952
  seal_wrap: Optional[pulumi.Input[bool]] = None,
743
953
  service_account_jwt: Optional[pulumi.Input[str]] = None,
744
954
  __props__=None):
@@ -751,21 +961,27 @@ class SecretBackend(pulumi.CustomResource):
751
961
  __props__ = SecretBackendArgs.__new__(SecretBackendArgs)
752
962
 
753
963
  __props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
964
+ __props__.__dict__["allowed_response_headers"] = allowed_response_headers
754
965
  __props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
755
966
  __props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
756
967
  __props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
968
+ __props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
757
969
  __props__.__dict__["description"] = description
758
970
  __props__.__dict__["disable_local_ca_jwt"] = disable_local_ca_jwt
759
971
  __props__.__dict__["external_entropy_access"] = external_entropy_access
972
+ __props__.__dict__["identity_token_key"] = identity_token_key
760
973
  __props__.__dict__["kubernetes_ca_cert"] = kubernetes_ca_cert
761
974
  __props__.__dict__["kubernetes_host"] = kubernetes_host
975
+ __props__.__dict__["listing_visibility"] = listing_visibility
762
976
  __props__.__dict__["local"] = local
763
977
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
764
978
  __props__.__dict__["namespace"] = namespace
765
979
  __props__.__dict__["options"] = options
980
+ __props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
766
981
  if path is None and not opts.urn:
767
982
  raise TypeError("Missing required property 'path'")
768
983
  __props__.__dict__["path"] = path
984
+ __props__.__dict__["plugin_version"] = plugin_version
769
985
  __props__.__dict__["seal_wrap"] = seal_wrap
770
986
  __props__.__dict__["service_account_jwt"] = None if service_account_jwt is None else pulumi.Output.secret(service_account_jwt)
771
987
  __props__.__dict__["accessor"] = None
@@ -783,19 +999,25 @@ class SecretBackend(pulumi.CustomResource):
783
999
  opts: Optional[pulumi.ResourceOptions] = None,
784
1000
  accessor: Optional[pulumi.Input[str]] = None,
785
1001
  allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
1002
+ allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
786
1003
  audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
787
1004
  audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
788
1005
  default_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
1006
+ delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
789
1007
  description: Optional[pulumi.Input[str]] = None,
790
1008
  disable_local_ca_jwt: Optional[pulumi.Input[bool]] = None,
791
1009
  external_entropy_access: Optional[pulumi.Input[bool]] = None,
1010
+ identity_token_key: Optional[pulumi.Input[str]] = None,
792
1011
  kubernetes_ca_cert: Optional[pulumi.Input[str]] = None,
793
1012
  kubernetes_host: Optional[pulumi.Input[str]] = None,
1013
+ listing_visibility: Optional[pulumi.Input[str]] = None,
794
1014
  local: Optional[pulumi.Input[bool]] = None,
795
1015
  max_lease_ttl_seconds: Optional[pulumi.Input[int]] = None,
796
1016
  namespace: Optional[pulumi.Input[str]] = None,
797
1017
  options: Optional[pulumi.Input[Mapping[str, Any]]] = None,
1018
+ passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[str]]]] = None,
798
1019
  path: Optional[pulumi.Input[str]] = None,
1020
+ plugin_version: Optional[pulumi.Input[str]] = None,
799
1021
  seal_wrap: Optional[pulumi.Input[bool]] = None,
800
1022
  service_account_jwt: Optional[pulumi.Input[str]] = None) -> 'SecretBackend':
801
1023
  """
@@ -807,13 +1029,16 @@ class SecretBackend(pulumi.CustomResource):
807
1029
  :param pulumi.ResourceOptions opts: Options for the resource.
808
1030
  :param pulumi.Input[str] accessor: Accessor of the mount
809
1031
  :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
1032
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
810
1033
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
811
1034
  :param pulumi.Input[Sequence[pulumi.Input[str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
812
1035
  :param pulumi.Input[int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
1036
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
813
1037
  :param pulumi.Input[str] description: Human-friendly description of the mount
814
1038
  :param pulumi.Input[bool] disable_local_ca_jwt: Disable defaulting to the local CA certificate and
815
1039
  service account JWT when Vault is running in a Kubernetes pod.
816
1040
  :param pulumi.Input[bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
1041
+ :param pulumi.Input[str] identity_token_key: The key to use for signing plugin workload identity tokens
817
1042
  :param pulumi.Input[str] kubernetes_ca_cert: A PEM-encoded CA certificate used by the
818
1043
  secrets engine to verify the Kubernetes API server certificate. Defaults to the local
819
1044
  pod’s CA if Vault is running in Kubernetes. Otherwise, defaults to the root CA set where
@@ -821,6 +1046,7 @@ class SecretBackend(pulumi.CustomResource):
821
1046
  :param pulumi.Input[str] kubernetes_host: The Kubernetes API URL to connect to. Required if the
822
1047
  standard pod environment variables `KUBERNETES_SERVICE_HOST` or `KUBERNETES_SERVICE_PORT`
823
1048
  are not set on the host that Vault is running on.
1049
+ :param pulumi.Input[str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
824
1050
  :param pulumi.Input[bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
825
1051
  :param pulumi.Input[int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
826
1052
  :param pulumi.Input[str] namespace: The namespace to provision the resource in.
@@ -828,7 +1054,9 @@ class SecretBackend(pulumi.CustomResource):
828
1054
  The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
829
1055
  *Available only for Vault Enterprise*.
830
1056
  :param pulumi.Input[Mapping[str, Any]] options: Specifies mount type specific options that are passed to the backend
1057
+ :param pulumi.Input[Sequence[pulumi.Input[str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
831
1058
  :param pulumi.Input[str] path: Where the secret backend will be mounted
1059
+ :param pulumi.Input[str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
832
1060
  :param pulumi.Input[bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
833
1061
  :param pulumi.Input[str] service_account_jwt: The JSON web token of the service account used by the
834
1062
  secrets engine to manage Kubernetes credentials. Defaults to the local pod’s JWT if Vault
@@ -840,19 +1068,25 @@ class SecretBackend(pulumi.CustomResource):
840
1068
 
841
1069
  __props__.__dict__["accessor"] = accessor
842
1070
  __props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
1071
+ __props__.__dict__["allowed_response_headers"] = allowed_response_headers
843
1072
  __props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
844
1073
  __props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
845
1074
  __props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
1075
+ __props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
846
1076
  __props__.__dict__["description"] = description
847
1077
  __props__.__dict__["disable_local_ca_jwt"] = disable_local_ca_jwt
848
1078
  __props__.__dict__["external_entropy_access"] = external_entropy_access
1079
+ __props__.__dict__["identity_token_key"] = identity_token_key
849
1080
  __props__.__dict__["kubernetes_ca_cert"] = kubernetes_ca_cert
850
1081
  __props__.__dict__["kubernetes_host"] = kubernetes_host
1082
+ __props__.__dict__["listing_visibility"] = listing_visibility
851
1083
  __props__.__dict__["local"] = local
852
1084
  __props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
853
1085
  __props__.__dict__["namespace"] = namespace
854
1086
  __props__.__dict__["options"] = options
1087
+ __props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
855
1088
  __props__.__dict__["path"] = path
1089
+ __props__.__dict__["plugin_version"] = plugin_version
856
1090
  __props__.__dict__["seal_wrap"] = seal_wrap
857
1091
  __props__.__dict__["service_account_jwt"] = service_account_jwt
858
1092
  return SecretBackend(resource_name, opts=opts, __props__=__props__)
@@ -873,6 +1107,14 @@ class SecretBackend(pulumi.CustomResource):
873
1107
  """
874
1108
  return pulumi.get(self, "allowed_managed_keys")
875
1109
 
1110
+ @property
1111
+ @pulumi.getter(name="allowedResponseHeaders")
1112
+ def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[str]]]:
1113
+ """
1114
+ List of headers to allow and pass from the request to the plugin
1115
+ """
1116
+ return pulumi.get(self, "allowed_response_headers")
1117
+
876
1118
  @property
877
1119
  @pulumi.getter(name="auditNonHmacRequestKeys")
878
1120
  def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[str]]:
@@ -897,6 +1139,14 @@ class SecretBackend(pulumi.CustomResource):
897
1139
  """
898
1140
  return pulumi.get(self, "default_lease_ttl_seconds")
899
1141
 
1142
+ @property
1143
+ @pulumi.getter(name="delegatedAuthAccessors")
1144
+ def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[str]]]:
1145
+ """
1146
+ List of headers to allow and pass from the request to the plugin
1147
+ """
1148
+ return pulumi.get(self, "delegated_auth_accessors")
1149
+
900
1150
  @property
901
1151
  @pulumi.getter
902
1152
  def description(self) -> pulumi.Output[Optional[str]]:
@@ -922,6 +1172,14 @@ class SecretBackend(pulumi.CustomResource):
922
1172
  """
923
1173
  return pulumi.get(self, "external_entropy_access")
924
1174
 
1175
+ @property
1176
+ @pulumi.getter(name="identityTokenKey")
1177
+ def identity_token_key(self) -> pulumi.Output[Optional[str]]:
1178
+ """
1179
+ The key to use for signing plugin workload identity tokens
1180
+ """
1181
+ return pulumi.get(self, "identity_token_key")
1182
+
925
1183
  @property
926
1184
  @pulumi.getter(name="kubernetesCaCert")
927
1185
  def kubernetes_ca_cert(self) -> pulumi.Output[Optional[str]]:
@@ -943,6 +1201,14 @@ class SecretBackend(pulumi.CustomResource):
943
1201
  """
944
1202
  return pulumi.get(self, "kubernetes_host")
945
1203
 
1204
+ @property
1205
+ @pulumi.getter(name="listingVisibility")
1206
+ def listing_visibility(self) -> pulumi.Output[Optional[str]]:
1207
+ """
1208
+ Specifies whether to show this mount in the UI-specific listing endpoint
1209
+ """
1210
+ return pulumi.get(self, "listing_visibility")
1211
+
946
1212
  @property
947
1213
  @pulumi.getter
948
1214
  def local(self) -> pulumi.Output[Optional[bool]]:
@@ -978,6 +1244,14 @@ class SecretBackend(pulumi.CustomResource):
978
1244
  """
979
1245
  return pulumi.get(self, "options")
980
1246
 
1247
+ @property
1248
+ @pulumi.getter(name="passthroughRequestHeaders")
1249
+ def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[str]]]:
1250
+ """
1251
+ List of headers to allow and pass from the request to the plugin
1252
+ """
1253
+ return pulumi.get(self, "passthrough_request_headers")
1254
+
981
1255
  @property
982
1256
  @pulumi.getter
983
1257
  def path(self) -> pulumi.Output[str]:
@@ -986,6 +1260,14 @@ class SecretBackend(pulumi.CustomResource):
986
1260
  """
987
1261
  return pulumi.get(self, "path")
988
1262
 
1263
+ @property
1264
+ @pulumi.getter(name="pluginVersion")
1265
+ def plugin_version(self) -> pulumi.Output[Optional[str]]:
1266
+ """
1267
+ Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
1268
+ """
1269
+ return pulumi.get(self, "plugin_version")
1270
+
989
1271
  @property
990
1272
  @pulumi.getter(name="sealWrap")
991
1273
  def seal_wrap(self) -> pulumi.Output[bool]: