pulumi-vault 6.2.0__py3-none-any.whl → 6.2.0a1712470779__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +0 -26
- pulumi_vault/_inputs.py +20 -0
- pulumi_vault/ad/secret_backend.py +6 -2
- pulumi_vault/ad/secret_library.py +4 -2
- pulumi_vault/ad/secret_role.py +4 -0
- pulumi_vault/alicloud/auth_backend_role.py +192 -69
- pulumi_vault/approle/auth_backend_login.py +4 -0
- pulumi_vault/approle/auth_backend_role.py +186 -63
- pulumi_vault/approle/auth_backend_role_secret_id.py +4 -0
- pulumi_vault/approle/get_auth_backend_role_id.py +4 -0
- pulumi_vault/audit.py +20 -12
- pulumi_vault/audit_request_header.py +6 -6
- pulumi_vault/auth_backend.py +0 -47
- pulumi_vault/aws/auth_backend_client.py +17 -253
- pulumi_vault/aws/auth_backend_config_identity.py +4 -0
- pulumi_vault/aws/auth_backend_identity_whitelist.py +10 -6
- pulumi_vault/aws/auth_backend_login.py +8 -0
- pulumi_vault/aws/auth_backend_role.py +186 -63
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +10 -6
- pulumi_vault/aws/auth_backend_sts_role.py +4 -0
- pulumi_vault/aws/secret_backend_role.py +4 -56
- pulumi_vault/aws/secret_backend_static_role.py +4 -2
- pulumi_vault/azure/auth_backend_config.py +10 -139
- pulumi_vault/azure/auth_backend_role.py +186 -63
- pulumi_vault/azure/backend.py +22 -217
- pulumi_vault/azure/backend_role.py +18 -14
- pulumi_vault/azure/get_access_credentials.py +4 -0
- pulumi_vault/cert_auth_backend_role.py +208 -75
- pulumi_vault/consul/secret_backend.py +18 -10
- pulumi_vault/consul/secret_backend_role.py +4 -2
- pulumi_vault/database/_inputs.py +784 -522
- pulumi_vault/database/outputs.py +784 -522
- pulumi_vault/database/secret_backend_connection.py +4 -2
- pulumi_vault/database/secret_backend_role.py +4 -4
- pulumi_vault/database/secret_backend_static_role.py +8 -10
- pulumi_vault/database/secrets_mount.py +4 -286
- pulumi_vault/egp_policy.py +8 -4
- pulumi_vault/gcp/auth_backend.py +18 -226
- pulumi_vault/gcp/auth_backend_role.py +264 -63
- pulumi_vault/gcp/get_auth_backend_role.py +4 -0
- pulumi_vault/gcp/secret_backend.py +9 -275
- pulumi_vault/gcp/secret_impersonated_account.py +14 -12
- pulumi_vault/gcp/secret_roleset.py +6 -4
- pulumi_vault/gcp/secret_static_account.py +16 -14
- pulumi_vault/generic/endpoint.py +8 -4
- pulumi_vault/generic/get_secret.py +4 -40
- pulumi_vault/get_auth_backend.py +4 -0
- pulumi_vault/get_auth_backends.py +8 -0
- pulumi_vault/get_namespace.py +12 -0
- pulumi_vault/get_namespaces.py +12 -4
- pulumi_vault/get_nomad_access_token.py +4 -0
- pulumi_vault/get_policy_document.py +8 -8
- pulumi_vault/get_raft_autopilot_state.py +4 -0
- pulumi_vault/github/auth_backend.py +4 -0
- pulumi_vault/github/team.py +6 -2
- pulumi_vault/github/user.py +6 -2
- pulumi_vault/identity/entity.py +8 -6
- pulumi_vault/identity/entity_alias.py +8 -6
- pulumi_vault/identity/entity_policies.py +12 -12
- pulumi_vault/identity/get_entity.py +4 -0
- pulumi_vault/identity/get_group.py +4 -0
- pulumi_vault/identity/get_oidc_client_creds.py +4 -2
- pulumi_vault/identity/get_oidc_openid_config.py +6 -10
- pulumi_vault/identity/get_oidc_public_keys.py +6 -10
- pulumi_vault/identity/group.py +42 -38
- pulumi_vault/identity/group_alias.py +4 -2
- pulumi_vault/identity/group_member_entity_ids.py +16 -12
- pulumi_vault/identity/group_member_group_ids.py +20 -24
- pulumi_vault/identity/group_policies.py +8 -4
- pulumi_vault/identity/mfa_duo.py +8 -4
- pulumi_vault/identity/mfa_login_enforcement.py +8 -8
- pulumi_vault/identity/mfa_okta.py +8 -4
- pulumi_vault/identity/mfa_pingid.py +4 -0
- pulumi_vault/identity/mfa_totp.py +4 -0
- pulumi_vault/identity/oidc.py +4 -0
- pulumi_vault/identity/oidc_assignment.py +6 -10
- pulumi_vault/identity/oidc_client.py +10 -10
- pulumi_vault/identity/oidc_key.py +12 -16
- pulumi_vault/identity/oidc_key_allowed_client_id.py +12 -16
- pulumi_vault/identity/oidc_provider.py +16 -22
- pulumi_vault/identity/oidc_role.py +20 -28
- pulumi_vault/identity/oidc_scope.py +8 -6
- pulumi_vault/jwt/auth_backend.py +32 -20
- pulumi_vault/jwt/auth_backend_role.py +225 -91
- pulumi_vault/kmip/secret_backend.py +14 -10
- pulumi_vault/kmip/secret_role.py +4 -0
- pulumi_vault/kmip/secret_scope.py +4 -0
- pulumi_vault/kubernetes/auth_backend_config.py +4 -0
- pulumi_vault/kubernetes/auth_backend_role.py +172 -56
- pulumi_vault/kubernetes/get_service_account_token.py +8 -8
- pulumi_vault/kubernetes/secret_backend.py +8 -288
- pulumi_vault/kubernetes/secret_backend_role.py +24 -24
- pulumi_vault/kv/get_secret.py +4 -0
- pulumi_vault/kv/get_secret_subkeys_v2.py +6 -4
- pulumi_vault/kv/get_secret_v2.py +0 -58
- pulumi_vault/kv/get_secrets_list.py +8 -4
- pulumi_vault/kv/get_secrets_list_v2.py +12 -14
- pulumi_vault/kv/secret.py +4 -0
- pulumi_vault/kv/secret_backend_v2.py +4 -0
- pulumi_vault/kv/secret_v2.py +4 -2
- pulumi_vault/ldap/auth_backend.py +161 -66
- pulumi_vault/ldap/auth_backend_group.py +4 -0
- pulumi_vault/ldap/auth_backend_user.py +4 -0
- pulumi_vault/ldap/secret_backend.py +8 -286
- pulumi_vault/ldap/secret_backend_dynamic_role.py +4 -0
- pulumi_vault/ldap/secret_backend_library_set.py +4 -2
- pulumi_vault/ldap/secret_backend_static_role.py +4 -0
- pulumi_vault/managed/_inputs.py +132 -84
- pulumi_vault/managed/keys.py +28 -7
- pulumi_vault/managed/outputs.py +132 -84
- pulumi_vault/mfa_duo.py +6 -4
- pulumi_vault/mfa_okta.py +6 -4
- pulumi_vault/mfa_pingid.py +6 -4
- pulumi_vault/mfa_totp.py +12 -10
- pulumi_vault/mongodbatlas/secret_backend.py +4 -0
- pulumi_vault/mongodbatlas/secret_role.py +4 -2
- pulumi_vault/mount.py +42 -350
- pulumi_vault/nomad_secret_backend.py +8 -4
- pulumi_vault/nomad_secret_role.py +4 -0
- pulumi_vault/okta/_inputs.py +8 -8
- pulumi_vault/okta/auth_backend.py +10 -459
- pulumi_vault/okta/auth_backend_group.py +4 -0
- pulumi_vault/okta/auth_backend_user.py +4 -0
- pulumi_vault/okta/outputs.py +8 -8
- pulumi_vault/outputs.py +20 -0
- pulumi_vault/password_policy.py +8 -6
- pulumi_vault/pkisecret/__init__.py +0 -2
- pulumi_vault/pkisecret/_inputs.py +0 -30
- pulumi_vault/pkisecret/backend_config_cluster.py +4 -0
- pulumi_vault/pkisecret/get_backend_issuer.py +0 -36
- pulumi_vault/pkisecret/get_backend_issuers.py +4 -0
- pulumi_vault/pkisecret/get_backend_key.py +6 -2
- pulumi_vault/pkisecret/get_backend_keys.py +4 -0
- pulumi_vault/pkisecret/outputs.py +0 -54
- pulumi_vault/pkisecret/secret_backend_cert.py +8 -6
- pulumi_vault/pkisecret/secret_backend_config_ca.py +8 -4
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +4 -0
- pulumi_vault/pkisecret/secret_backend_config_urls.py +4 -0
- pulumi_vault/pkisecret/secret_backend_crl_config.py +6 -2
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +8 -4
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +14 -10
- pulumi_vault/pkisecret/secret_backend_issuer.py +4 -0
- pulumi_vault/pkisecret/secret_backend_role.py +4 -2
- pulumi_vault/pkisecret/secret_backend_root_cert.py +8 -4
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +10 -6
- pulumi_vault/pkisecret/secret_backend_sign.py +8 -6
- pulumi_vault/provider.py +8 -0
- pulumi_vault/pulumi-plugin.json +1 -2
- pulumi_vault/quota_lease_count.py +8 -53
- pulumi_vault/quota_rate_limit.py +4 -49
- pulumi_vault/rabbitmq/secret_backend.py +8 -4
- pulumi_vault/rabbitmq/secret_backend_role.py +4 -2
- pulumi_vault/raft_autopilot.py +4 -0
- pulumi_vault/raft_snapshot_agent_config.py +304 -109
- pulumi_vault/rgp_policy.py +6 -2
- pulumi_vault/saml/auth_backend.py +12 -8
- pulumi_vault/saml/auth_backend_role.py +178 -64
- pulumi_vault/secrets/sync_association.py +10 -12
- pulumi_vault/secrets/sync_aws_destination.py +8 -6
- pulumi_vault/secrets/sync_azure_destination.py +12 -10
- pulumi_vault/secrets/sync_config.py +6 -2
- pulumi_vault/secrets/sync_gcp_destination.py +6 -6
- pulumi_vault/secrets/sync_gh_destination.py +8 -6
- pulumi_vault/secrets/sync_github_apps.py +8 -8
- pulumi_vault/secrets/sync_vercel_destination.py +8 -6
- pulumi_vault/ssh/_inputs.py +32 -6
- pulumi_vault/ssh/outputs.py +32 -6
- pulumi_vault/ssh/secret_backend_ca.py +4 -94
- pulumi_vault/ssh/secret_backend_role.py +4 -4
- pulumi_vault/terraformcloud/secret_backend.py +56 -0
- pulumi_vault/terraformcloud/secret_creds.py +17 -2
- pulumi_vault/terraformcloud/secret_role.py +69 -2
- pulumi_vault/token.py +18 -14
- pulumi_vault/tokenauth/auth_backend_role.py +180 -64
- pulumi_vault/transform/alphabet.py +6 -4
- pulumi_vault/transform/get_decode.py +4 -4
- pulumi_vault/transform/get_encode.py +4 -4
- pulumi_vault/transform/role.py +6 -4
- pulumi_vault/transform/template.py +4 -4
- pulumi_vault/transit/get_decrypt.py +20 -4
- pulumi_vault/transit/get_encrypt.py +14 -0
- pulumi_vault/transit/secret_backend_key.py +6 -6
- pulumi_vault/transit/secret_cache_config.py +4 -0
- {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712470779.dist-info}/METADATA +1 -1
- pulumi_vault-6.2.0a1712470779.dist-info/RECORD +252 -0
- {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712470779.dist-info}/WHEEL +1 -1
- pulumi_vault/pkisecret/backend_config_est.py +0 -614
- pulumi_vault/pkisecret/get_backend_config_est.py +0 -233
- pulumi_vault/plugin.py +0 -590
- pulumi_vault/plugin_pinned_version.py +0 -293
- pulumi_vault-6.2.0.dist-info/RECORD +0 -256
- {pulumi_vault-6.2.0.dist-info → pulumi_vault-6.2.0a1712470779.dist-info}/top_level.txt +0 -0
@@ -258,20 +258,18 @@ class OidcKey(pulumi.CustomResource):
|
|
258
258
|
"""
|
259
259
|
## Example Usage
|
260
260
|
|
261
|
+
<!--Start PulumiCodeChooser -->
|
261
262
|
```python
|
262
263
|
import pulumi
|
263
264
|
import pulumi_vault as vault
|
264
265
|
|
265
|
-
key = vault.identity.OidcKey("key",
|
266
|
-
|
267
|
-
|
268
|
-
role = vault.identity.OidcRole("role",
|
269
|
-
name="role",
|
270
|
-
key=key.name)
|
271
|
-
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
|
266
|
+
key = vault.identity.OidcKey("key", algorithm="RS256")
|
267
|
+
role_oidc_role = vault.identity.OidcRole("roleOidcRole", key=key.name)
|
268
|
+
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("roleOidcKeyAllowedClientID",
|
272
269
|
key_name=key.name,
|
273
|
-
allowed_client_id=
|
270
|
+
allowed_client_id=role_oidc_role.client_id)
|
274
271
|
```
|
272
|
+
<!--End PulumiCodeChooser -->
|
275
273
|
|
276
274
|
## Import
|
277
275
|
|
@@ -305,20 +303,18 @@ class OidcKey(pulumi.CustomResource):
|
|
305
303
|
"""
|
306
304
|
## Example Usage
|
307
305
|
|
306
|
+
<!--Start PulumiCodeChooser -->
|
308
307
|
```python
|
309
308
|
import pulumi
|
310
309
|
import pulumi_vault as vault
|
311
310
|
|
312
|
-
key = vault.identity.OidcKey("key",
|
313
|
-
|
314
|
-
|
315
|
-
role = vault.identity.OidcRole("role",
|
316
|
-
name="role",
|
317
|
-
key=key.name)
|
318
|
-
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
|
311
|
+
key = vault.identity.OidcKey("key", algorithm="RS256")
|
312
|
+
role_oidc_role = vault.identity.OidcRole("roleOidcRole", key=key.name)
|
313
|
+
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("roleOidcKeyAllowedClientID",
|
319
314
|
key_name=key.name,
|
320
|
-
allowed_client_id=
|
315
|
+
allowed_client_id=role_oidc_role.client_id)
|
321
316
|
```
|
317
|
+
<!--End PulumiCodeChooser -->
|
322
318
|
|
323
319
|
## Import
|
324
320
|
|
@@ -145,20 +145,18 @@ class OidcKeyAllowedClientID(pulumi.CustomResource):
|
|
145
145
|
"""
|
146
146
|
## Example Usage
|
147
147
|
|
148
|
+
<!--Start PulumiCodeChooser -->
|
148
149
|
```python
|
149
150
|
import pulumi
|
150
151
|
import pulumi_vault as vault
|
151
152
|
|
152
|
-
key = vault.identity.OidcKey("key",
|
153
|
-
|
154
|
-
|
155
|
-
role = vault.identity.OidcRole("role",
|
156
|
-
name="role",
|
157
|
-
key=key.name)
|
158
|
-
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
|
153
|
+
key = vault.identity.OidcKey("key", algorithm="RS256")
|
154
|
+
role_oidc_role = vault.identity.OidcRole("roleOidcRole", key=key.name)
|
155
|
+
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("roleOidcKeyAllowedClientID",
|
159
156
|
key_name=key.name,
|
160
|
-
allowed_client_id=
|
157
|
+
allowed_client_id=role_oidc_role.client_id)
|
161
158
|
```
|
159
|
+
<!--End PulumiCodeChooser -->
|
162
160
|
|
163
161
|
:param str resource_name: The name of the resource.
|
164
162
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
@@ -178,20 +176,18 @@ class OidcKeyAllowedClientID(pulumi.CustomResource):
|
|
178
176
|
"""
|
179
177
|
## Example Usage
|
180
178
|
|
179
|
+
<!--Start PulumiCodeChooser -->
|
181
180
|
```python
|
182
181
|
import pulumi
|
183
182
|
import pulumi_vault as vault
|
184
183
|
|
185
|
-
key = vault.identity.OidcKey("key",
|
186
|
-
|
187
|
-
|
188
|
-
role = vault.identity.OidcRole("role",
|
189
|
-
name="role",
|
190
|
-
key=key.name)
|
191
|
-
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
|
184
|
+
key = vault.identity.OidcKey("key", algorithm="RS256")
|
185
|
+
role_oidc_role = vault.identity.OidcRole("roleOidcRole", key=key.name)
|
186
|
+
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("roleOidcKeyAllowedClientID",
|
192
187
|
key_name=key.name,
|
193
|
-
allowed_client_id=
|
188
|
+
allowed_client_id=role_oidc_role.client_id)
|
194
189
|
```
|
190
|
+
<!--End PulumiCodeChooser -->
|
195
191
|
|
196
192
|
:param str resource_name: The name of the resource.
|
197
193
|
:param OidcKeyAllowedClientIDArgs args: The arguments to use to populate this resource's properties.
|
@@ -273,23 +273,21 @@ class OidcProvider(pulumi.CustomResource):
|
|
273
273
|
|
274
274
|
## Example Usage
|
275
275
|
|
276
|
+
<!--Start PulumiCodeChooser -->
|
276
277
|
```python
|
277
278
|
import pulumi
|
278
279
|
import json
|
279
280
|
import pulumi_vault as vault
|
280
281
|
|
281
|
-
|
282
|
-
name="my-key",
|
282
|
+
test_oidc_key = vault.identity.OidcKey("testOidcKey",
|
283
283
|
allowed_client_ids=["*"],
|
284
284
|
rotation_period=3600,
|
285
285
|
verification_ttl=3600)
|
286
|
-
test_oidc_assignment = vault.identity.OidcAssignment("
|
287
|
-
name="my-assignment",
|
286
|
+
test_oidc_assignment = vault.identity.OidcAssignment("testOidcAssignment",
|
288
287
|
entity_ids=["fake-ascbascas-2231a-sdfaa"],
|
289
288
|
group_ids=["fake-sajkdsad-32414-sfsada"])
|
290
|
-
test_oidc_client = vault.identity.OidcClient("
|
291
|
-
name
|
292
|
-
key=test.name,
|
289
|
+
test_oidc_client = vault.identity.OidcClient("testOidcClient",
|
290
|
+
key=test_oidc_key.name,
|
293
291
|
redirect_uris=[
|
294
292
|
"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback",
|
295
293
|
"http://127.0.0.1:8251/callback",
|
@@ -298,19 +296,18 @@ class OidcProvider(pulumi.CustomResource):
|
|
298
296
|
assignments=[test_oidc_assignment.name],
|
299
297
|
id_token_ttl=2400,
|
300
298
|
access_token_ttl=7200)
|
301
|
-
test_oidc_scope = vault.identity.OidcScope("
|
302
|
-
name="groups",
|
299
|
+
test_oidc_scope = vault.identity.OidcScope("testOidcScope",
|
303
300
|
template=json.dumps({
|
304
301
|
"groups": "{{identity.entity.groups.names}}",
|
305
302
|
}),
|
306
303
|
description="Groups scope.")
|
307
|
-
test_oidc_provider = vault.identity.OidcProvider("
|
308
|
-
name="my-provider",
|
304
|
+
test_oidc_provider = vault.identity.OidcProvider("testOidcProvider",
|
309
305
|
https_enabled=False,
|
310
306
|
issuer_host="127.0.0.1:8200",
|
311
307
|
allowed_client_ids=[test_oidc_client.client_id],
|
312
308
|
scopes_supporteds=[test_oidc_scope.name])
|
313
309
|
```
|
310
|
+
<!--End PulumiCodeChooser -->
|
314
311
|
|
315
312
|
## Import
|
316
313
|
|
@@ -345,23 +342,21 @@ class OidcProvider(pulumi.CustomResource):
|
|
345
342
|
|
346
343
|
## Example Usage
|
347
344
|
|
345
|
+
<!--Start PulumiCodeChooser -->
|
348
346
|
```python
|
349
347
|
import pulumi
|
350
348
|
import json
|
351
349
|
import pulumi_vault as vault
|
352
350
|
|
353
|
-
|
354
|
-
name="my-key",
|
351
|
+
test_oidc_key = vault.identity.OidcKey("testOidcKey",
|
355
352
|
allowed_client_ids=["*"],
|
356
353
|
rotation_period=3600,
|
357
354
|
verification_ttl=3600)
|
358
|
-
test_oidc_assignment = vault.identity.OidcAssignment("
|
359
|
-
name="my-assignment",
|
355
|
+
test_oidc_assignment = vault.identity.OidcAssignment("testOidcAssignment",
|
360
356
|
entity_ids=["fake-ascbascas-2231a-sdfaa"],
|
361
357
|
group_ids=["fake-sajkdsad-32414-sfsada"])
|
362
|
-
test_oidc_client = vault.identity.OidcClient("
|
363
|
-
name
|
364
|
-
key=test.name,
|
358
|
+
test_oidc_client = vault.identity.OidcClient("testOidcClient",
|
359
|
+
key=test_oidc_key.name,
|
365
360
|
redirect_uris=[
|
366
361
|
"http://127.0.0.1:9200/v1/auth-methods/oidc:authenticate:callback",
|
367
362
|
"http://127.0.0.1:8251/callback",
|
@@ -370,19 +365,18 @@ class OidcProvider(pulumi.CustomResource):
|
|
370
365
|
assignments=[test_oidc_assignment.name],
|
371
366
|
id_token_ttl=2400,
|
372
367
|
access_token_ttl=7200)
|
373
|
-
test_oidc_scope = vault.identity.OidcScope("
|
374
|
-
name="groups",
|
368
|
+
test_oidc_scope = vault.identity.OidcScope("testOidcScope",
|
375
369
|
template=json.dumps({
|
376
370
|
"groups": "{{identity.entity.groups.names}}",
|
377
371
|
}),
|
378
372
|
description="Groups scope.")
|
379
|
-
test_oidc_provider = vault.identity.OidcProvider("
|
380
|
-
name="my-provider",
|
373
|
+
test_oidc_provider = vault.identity.OidcProvider("testOidcProvider",
|
381
374
|
https_enabled=False,
|
382
375
|
issuer_host="127.0.0.1:8200",
|
383
376
|
allowed_client_ids=[test_oidc_client.client_id],
|
384
377
|
scopes_supporteds=[test_oidc_scope.name])
|
385
378
|
```
|
379
|
+
<!--End PulumiCodeChooser -->
|
386
380
|
|
387
381
|
## Import
|
388
382
|
|
@@ -270,42 +270,38 @@ class OidcRole(pulumi.CustomResource):
|
|
270
270
|
exist before the role can be used to issue tokens. You must also configure the key with the
|
271
271
|
role's Client ID to allow the role to use the key.
|
272
272
|
|
273
|
+
<!--Start PulumiCodeChooser -->
|
273
274
|
```python
|
274
275
|
import pulumi
|
275
276
|
import pulumi_vault as vault
|
276
277
|
|
277
278
|
config = pulumi.Config()
|
278
|
-
# Name of the OIDC Key
|
279
279
|
key = config.get("key")
|
280
280
|
if key is None:
|
281
281
|
key = "key"
|
282
|
-
role = vault.identity.OidcRole("role",
|
283
|
-
|
284
|
-
key=key)
|
285
|
-
key_oidc_key = vault.identity.OidcKey("key",
|
286
|
-
name=key,
|
282
|
+
role = vault.identity.OidcRole("role", key=key)
|
283
|
+
key_oidc_key = vault.identity.OidcKey("keyOidcKey",
|
287
284
|
algorithm="RS256",
|
288
285
|
allowed_client_ids=[role.client_id])
|
289
286
|
```
|
287
|
+
<!--End PulumiCodeChooser -->
|
290
288
|
|
291
289
|
If you want to create the key first before creating the role, you can use a separate
|
292
290
|
resource to configure the allowed Client ID on
|
293
291
|
the key.
|
294
292
|
|
293
|
+
<!--Start PulumiCodeChooser -->
|
295
294
|
```python
|
296
295
|
import pulumi
|
297
296
|
import pulumi_vault as vault
|
298
297
|
|
299
|
-
key = vault.identity.OidcKey("key",
|
300
|
-
|
301
|
-
|
302
|
-
role = vault.identity.OidcRole("role",
|
303
|
-
name="role",
|
304
|
-
key=key.name)
|
305
|
-
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
|
298
|
+
key = vault.identity.OidcKey("key", algorithm="RS256")
|
299
|
+
role_oidc_role = vault.identity.OidcRole("roleOidcRole", key=key.name)
|
300
|
+
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("roleOidcKeyAllowedClientID",
|
306
301
|
key_name=key.name,
|
307
|
-
allowed_client_id=
|
302
|
+
allowed_client_id=role_oidc_role.client_id)
|
308
303
|
```
|
304
|
+
<!--End PulumiCodeChooser -->
|
309
305
|
|
310
306
|
## Import
|
311
307
|
|
@@ -346,42 +342,38 @@ class OidcRole(pulumi.CustomResource):
|
|
346
342
|
exist before the role can be used to issue tokens. You must also configure the key with the
|
347
343
|
role's Client ID to allow the role to use the key.
|
348
344
|
|
345
|
+
<!--Start PulumiCodeChooser -->
|
349
346
|
```python
|
350
347
|
import pulumi
|
351
348
|
import pulumi_vault as vault
|
352
349
|
|
353
350
|
config = pulumi.Config()
|
354
|
-
# Name of the OIDC Key
|
355
351
|
key = config.get("key")
|
356
352
|
if key is None:
|
357
353
|
key = "key"
|
358
|
-
role = vault.identity.OidcRole("role",
|
359
|
-
|
360
|
-
key=key)
|
361
|
-
key_oidc_key = vault.identity.OidcKey("key",
|
362
|
-
name=key,
|
354
|
+
role = vault.identity.OidcRole("role", key=key)
|
355
|
+
key_oidc_key = vault.identity.OidcKey("keyOidcKey",
|
363
356
|
algorithm="RS256",
|
364
357
|
allowed_client_ids=[role.client_id])
|
365
358
|
```
|
359
|
+
<!--End PulumiCodeChooser -->
|
366
360
|
|
367
361
|
If you want to create the key first before creating the role, you can use a separate
|
368
362
|
resource to configure the allowed Client ID on
|
369
363
|
the key.
|
370
364
|
|
365
|
+
<!--Start PulumiCodeChooser -->
|
371
366
|
```python
|
372
367
|
import pulumi
|
373
368
|
import pulumi_vault as vault
|
374
369
|
|
375
|
-
key = vault.identity.OidcKey("key",
|
376
|
-
|
377
|
-
|
378
|
-
role = vault.identity.OidcRole("role",
|
379
|
-
name="role",
|
380
|
-
key=key.name)
|
381
|
-
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("role",
|
370
|
+
key = vault.identity.OidcKey("key", algorithm="RS256")
|
371
|
+
role_oidc_role = vault.identity.OidcRole("roleOidcRole", key=key.name)
|
372
|
+
role_oidc_key_allowed_client_id = vault.identity.OidcKeyAllowedClientID("roleOidcKeyAllowedClientID",
|
382
373
|
key_name=key.name,
|
383
|
-
allowed_client_id=
|
374
|
+
allowed_client_id=role_oidc_role.client_id)
|
384
375
|
```
|
376
|
+
<!--End PulumiCodeChooser -->
|
385
377
|
|
386
378
|
## Import
|
387
379
|
|
@@ -183,15 +183,16 @@ class OidcScope(pulumi.CustomResource):
|
|
183
183
|
|
184
184
|
## Example Usage
|
185
185
|
|
186
|
+
<!--Start PulumiCodeChooser -->
|
186
187
|
```python
|
187
188
|
import pulumi
|
188
189
|
import pulumi_vault as vault
|
189
190
|
|
190
191
|
groups = vault.identity.OidcScope("groups",
|
191
|
-
|
192
|
-
template="{\\"groups\\":{{identity.entity.groups.names}}}"
|
193
|
-
description="Vault OIDC Groups Scope")
|
192
|
+
description="Vault OIDC Groups Scope",
|
193
|
+
template="{\\"groups\\":{{identity.entity.groups.names}}}")
|
194
194
|
```
|
195
|
+
<!--End PulumiCodeChooser -->
|
195
196
|
|
196
197
|
## Import
|
197
198
|
|
@@ -223,15 +224,16 @@ class OidcScope(pulumi.CustomResource):
|
|
223
224
|
|
224
225
|
## Example Usage
|
225
226
|
|
227
|
+
<!--Start PulumiCodeChooser -->
|
226
228
|
```python
|
227
229
|
import pulumi
|
228
230
|
import pulumi_vault as vault
|
229
231
|
|
230
232
|
groups = vault.identity.OidcScope("groups",
|
231
|
-
|
232
|
-
template="{\\"groups\\":{{identity.entity.groups.names}}}"
|
233
|
-
description="Vault OIDC Groups Scope")
|
233
|
+
description="Vault OIDC Groups Scope",
|
234
|
+
template="{\\"groups\\":{{identity.entity.groups.names}}}")
|
234
235
|
```
|
236
|
+
<!--End PulumiCodeChooser -->
|
235
237
|
|
236
238
|
## Import
|
237
239
|
|
pulumi_vault/jwt/auth_backend.py
CHANGED
@@ -776,38 +776,43 @@ class AuthBackend(pulumi.CustomResource):
|
|
776
776
|
|
777
777
|
Manage JWT auth backend:
|
778
778
|
|
779
|
+
<!--Start PulumiCodeChooser -->
|
779
780
|
```python
|
780
781
|
import pulumi
|
781
782
|
import pulumi_vault as vault
|
782
783
|
|
783
784
|
example = vault.jwt.AuthBackend("example",
|
785
|
+
bound_issuer="https://myco.auth0.com/",
|
784
786
|
description="Demonstration of the Terraform JWT auth backend",
|
785
|
-
path="jwt",
|
786
787
|
oidc_discovery_url="https://myco.auth0.com/",
|
787
|
-
|
788
|
+
path="jwt")
|
788
789
|
```
|
790
|
+
<!--End PulumiCodeChooser -->
|
789
791
|
|
790
792
|
Manage OIDC auth backend:
|
791
793
|
|
794
|
+
<!--Start PulumiCodeChooser -->
|
792
795
|
```python
|
793
796
|
import pulumi
|
794
797
|
import pulumi_vault as vault
|
795
798
|
|
796
799
|
example = vault.jwt.AuthBackend("example",
|
800
|
+
bound_issuer="https://myco.auth0.com/",
|
797
801
|
description="Demonstration of the Terraform JWT auth backend",
|
798
|
-
path="oidc",
|
799
|
-
type="oidc",
|
800
|
-
oidc_discovery_url="https://myco.auth0.com/",
|
801
802
|
oidc_client_id="1234567890",
|
802
803
|
oidc_client_secret="secret123456",
|
803
|
-
|
804
|
+
oidc_discovery_url="https://myco.auth0.com/",
|
805
|
+
path="oidc",
|
804
806
|
tune=vault.jwt.AuthBackendTuneArgs(
|
805
807
|
listing_visibility="unauth",
|
806
|
-
)
|
808
|
+
),
|
809
|
+
type="oidc")
|
807
810
|
```
|
811
|
+
<!--End PulumiCodeChooser -->
|
808
812
|
|
809
813
|
Configuring the auth backend with a `provider_config:
|
810
814
|
|
815
|
+
<!--Start PulumiCodeChooser -->
|
811
816
|
```python
|
812
817
|
import pulumi
|
813
818
|
import pulumi_vault as vault
|
@@ -816,14 +821,15 @@ class AuthBackend(pulumi.CustomResource):
|
|
816
821
|
description="OIDC backend",
|
817
822
|
oidc_discovery_url="https://accounts.google.com",
|
818
823
|
path="oidc",
|
819
|
-
type="oidc",
|
820
824
|
provider_config={
|
821
|
-
"provider": "gsuite",
|
822
825
|
"fetch_groups": "true",
|
823
826
|
"fetch_user_info": "true",
|
824
827
|
"groups_recurse_max_depth": "1",
|
825
|
-
|
828
|
+
"provider": "gsuite",
|
829
|
+
},
|
830
|
+
type="oidc")
|
826
831
|
```
|
832
|
+
<!--End PulumiCodeChooser -->
|
827
833
|
|
828
834
|
## Import
|
829
835
|
|
@@ -883,38 +889,43 @@ class AuthBackend(pulumi.CustomResource):
|
|
883
889
|
|
884
890
|
Manage JWT auth backend:
|
885
891
|
|
892
|
+
<!--Start PulumiCodeChooser -->
|
886
893
|
```python
|
887
894
|
import pulumi
|
888
895
|
import pulumi_vault as vault
|
889
896
|
|
890
897
|
example = vault.jwt.AuthBackend("example",
|
898
|
+
bound_issuer="https://myco.auth0.com/",
|
891
899
|
description="Demonstration of the Terraform JWT auth backend",
|
892
|
-
path="jwt",
|
893
900
|
oidc_discovery_url="https://myco.auth0.com/",
|
894
|
-
|
901
|
+
path="jwt")
|
895
902
|
```
|
903
|
+
<!--End PulumiCodeChooser -->
|
896
904
|
|
897
905
|
Manage OIDC auth backend:
|
898
906
|
|
907
|
+
<!--Start PulumiCodeChooser -->
|
899
908
|
```python
|
900
909
|
import pulumi
|
901
910
|
import pulumi_vault as vault
|
902
911
|
|
903
912
|
example = vault.jwt.AuthBackend("example",
|
913
|
+
bound_issuer="https://myco.auth0.com/",
|
904
914
|
description="Demonstration of the Terraform JWT auth backend",
|
905
|
-
path="oidc",
|
906
|
-
type="oidc",
|
907
|
-
oidc_discovery_url="https://myco.auth0.com/",
|
908
915
|
oidc_client_id="1234567890",
|
909
916
|
oidc_client_secret="secret123456",
|
910
|
-
|
917
|
+
oidc_discovery_url="https://myco.auth0.com/",
|
918
|
+
path="oidc",
|
911
919
|
tune=vault.jwt.AuthBackendTuneArgs(
|
912
920
|
listing_visibility="unauth",
|
913
|
-
)
|
921
|
+
),
|
922
|
+
type="oidc")
|
914
923
|
```
|
924
|
+
<!--End PulumiCodeChooser -->
|
915
925
|
|
916
926
|
Configuring the auth backend with a `provider_config:
|
917
927
|
|
928
|
+
<!--Start PulumiCodeChooser -->
|
918
929
|
```python
|
919
930
|
import pulumi
|
920
931
|
import pulumi_vault as vault
|
@@ -923,14 +934,15 @@ class AuthBackend(pulumi.CustomResource):
|
|
923
934
|
description="OIDC backend",
|
924
935
|
oidc_discovery_url="https://accounts.google.com",
|
925
936
|
path="oidc",
|
926
|
-
type="oidc",
|
927
937
|
provider_config={
|
928
|
-
"provider": "gsuite",
|
929
938
|
"fetch_groups": "true",
|
930
939
|
"fetch_user_info": "true",
|
931
940
|
"groups_recurse_max_depth": "1",
|
932
|
-
|
941
|
+
"provider": "gsuite",
|
942
|
+
},
|
943
|
+
type="oidc")
|
933
944
|
```
|
945
|
+
<!--End PulumiCodeChooser -->
|
934
946
|
|
935
947
|
## Import
|
936
948
|
|