pulumi-vault 6.2.0a1718953130__py3-none-any.whl → 6.3.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +26 -0
- pulumi_vault/_inputs.py +20 -0
- pulumi_vault/_utilities.py +40 -4
- pulumi_vault/auth_backend.py +47 -0
- pulumi_vault/aws/auth_backend_client.py +247 -7
- pulumi_vault/aws/secret_backend_role.py +169 -0
- pulumi_vault/azure/auth_backend_config.py +133 -0
- pulumi_vault/azure/backend.py +197 -0
- pulumi_vault/database/secrets_mount.py +282 -0
- pulumi_vault/gcp/auth_backend.py +244 -0
- pulumi_vault/gcp/secret_backend.py +271 -3
- pulumi_vault/generic/endpoint.py +6 -6
- pulumi_vault/identity/get_entity.py +2 -2
- pulumi_vault/jwt/auth_backend_role.py +28 -35
- pulumi_vault/kubernetes/secret_backend.py +282 -0
- pulumi_vault/ldap/secret_backend.py +282 -0
- pulumi_vault/mount.py +331 -0
- pulumi_vault/okta/auth_backend.py +441 -0
- pulumi_vault/outputs.py +20 -0
- pulumi_vault/pkisecret/__init__.py +2 -0
- pulumi_vault/pkisecret/_inputs.py +40 -0
- pulumi_vault/pkisecret/backend_config_est.py +614 -0
- pulumi_vault/pkisecret/get_backend_config_est.py +233 -0
- pulumi_vault/pkisecret/outputs.py +64 -0
- pulumi_vault/pkisecret/secret_backend_cert.py +2 -2
- pulumi_vault/pkisecret/secret_backend_config_ca.py +2 -2
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +2 -2
- pulumi_vault/pkisecret/secret_backend_root_cert.py +2 -2
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +2 -2
- pulumi_vault/pkisecret/secret_backend_sign.py +2 -2
- pulumi_vault/plugin.py +590 -0
- pulumi_vault/plugin_pinned_version.py +293 -0
- pulumi_vault/provider.py +1 -3
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +47 -0
- pulumi_vault/quota_rate_limit.py +47 -0
- pulumi_vault/ssh/secret_backend_ca.py +94 -0
- {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/METADATA +1 -1
- {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/RECORD +41 -37
- {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/WHEEL +1 -1
- {pulumi_vault-6.2.0a1718953130.dist-info → pulumi_vault-6.3.0.dist-info}/top_level.txt +0 -0
|
@@ -20,6 +20,8 @@ class AuthBackendConfigArgs:
|
|
|
20
20
|
client_id: Optional[pulumi.Input[str]] = None,
|
|
21
21
|
client_secret: Optional[pulumi.Input[str]] = None,
|
|
22
22
|
environment: Optional[pulumi.Input[str]] = None,
|
|
23
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
24
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
23
25
|
namespace: Optional[pulumi.Input[str]] = None):
|
|
24
26
|
"""
|
|
25
27
|
The set of arguments for constructing a AuthBackendConfig resource.
|
|
@@ -36,6 +38,9 @@ class AuthBackendConfigArgs:
|
|
|
36
38
|
:param pulumi.Input[str] environment: The Azure cloud environment. Valid values:
|
|
37
39
|
AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud,
|
|
38
40
|
AzureGermanCloud. Defaults to `AzurePublicCloud`.
|
|
41
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
42
|
+
*Available only for Vault Enterprise*
|
|
43
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds.
|
|
39
44
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
40
45
|
The value should not contain leading or trailing forward slashes.
|
|
41
46
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -51,6 +56,10 @@ class AuthBackendConfigArgs:
|
|
|
51
56
|
pulumi.set(__self__, "client_secret", client_secret)
|
|
52
57
|
if environment is not None:
|
|
53
58
|
pulumi.set(__self__, "environment", environment)
|
|
59
|
+
if identity_token_audience is not None:
|
|
60
|
+
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
61
|
+
if identity_token_ttl is not None:
|
|
62
|
+
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
54
63
|
if namespace is not None:
|
|
55
64
|
pulumi.set(__self__, "namespace", namespace)
|
|
56
65
|
|
|
@@ -133,6 +142,31 @@ class AuthBackendConfigArgs:
|
|
|
133
142
|
def environment(self, value: Optional[pulumi.Input[str]]):
|
|
134
143
|
pulumi.set(self, "environment", value)
|
|
135
144
|
|
|
145
|
+
@property
|
|
146
|
+
@pulumi.getter(name="identityTokenAudience")
|
|
147
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
|
|
148
|
+
"""
|
|
149
|
+
The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
150
|
+
*Available only for Vault Enterprise*
|
|
151
|
+
"""
|
|
152
|
+
return pulumi.get(self, "identity_token_audience")
|
|
153
|
+
|
|
154
|
+
@identity_token_audience.setter
|
|
155
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
|
|
156
|
+
pulumi.set(self, "identity_token_audience", value)
|
|
157
|
+
|
|
158
|
+
@property
|
|
159
|
+
@pulumi.getter(name="identityTokenTtl")
|
|
160
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
|
|
161
|
+
"""
|
|
162
|
+
The TTL of generated identity tokens in seconds.
|
|
163
|
+
"""
|
|
164
|
+
return pulumi.get(self, "identity_token_ttl")
|
|
165
|
+
|
|
166
|
+
@identity_token_ttl.setter
|
|
167
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
|
|
168
|
+
pulumi.set(self, "identity_token_ttl", value)
|
|
169
|
+
|
|
136
170
|
@property
|
|
137
171
|
@pulumi.getter
|
|
138
172
|
def namespace(self) -> Optional[pulumi.Input[str]]:
|
|
@@ -156,6 +190,8 @@ class _AuthBackendConfigState:
|
|
|
156
190
|
client_id: Optional[pulumi.Input[str]] = None,
|
|
157
191
|
client_secret: Optional[pulumi.Input[str]] = None,
|
|
158
192
|
environment: Optional[pulumi.Input[str]] = None,
|
|
193
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
194
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
159
195
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
160
196
|
resource: Optional[pulumi.Input[str]] = None,
|
|
161
197
|
tenant_id: Optional[pulumi.Input[str]] = None):
|
|
@@ -170,6 +206,9 @@ class _AuthBackendConfigState:
|
|
|
170
206
|
:param pulumi.Input[str] environment: The Azure cloud environment. Valid values:
|
|
171
207
|
AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud,
|
|
172
208
|
AzureGermanCloud. Defaults to `AzurePublicCloud`.
|
|
209
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
210
|
+
*Available only for Vault Enterprise*
|
|
211
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds.
|
|
173
212
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
174
213
|
The value should not contain leading or trailing forward slashes.
|
|
175
214
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -187,6 +226,10 @@ class _AuthBackendConfigState:
|
|
|
187
226
|
pulumi.set(__self__, "client_secret", client_secret)
|
|
188
227
|
if environment is not None:
|
|
189
228
|
pulumi.set(__self__, "environment", environment)
|
|
229
|
+
if identity_token_audience is not None:
|
|
230
|
+
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
231
|
+
if identity_token_ttl is not None:
|
|
232
|
+
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
190
233
|
if namespace is not None:
|
|
191
234
|
pulumi.set(__self__, "namespace", namespace)
|
|
192
235
|
if resource is not None:
|
|
@@ -247,6 +290,31 @@ class _AuthBackendConfigState:
|
|
|
247
290
|
def environment(self, value: Optional[pulumi.Input[str]]):
|
|
248
291
|
pulumi.set(self, "environment", value)
|
|
249
292
|
|
|
293
|
+
@property
|
|
294
|
+
@pulumi.getter(name="identityTokenAudience")
|
|
295
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
|
|
296
|
+
"""
|
|
297
|
+
The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
298
|
+
*Available only for Vault Enterprise*
|
|
299
|
+
"""
|
|
300
|
+
return pulumi.get(self, "identity_token_audience")
|
|
301
|
+
|
|
302
|
+
@identity_token_audience.setter
|
|
303
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
|
|
304
|
+
pulumi.set(self, "identity_token_audience", value)
|
|
305
|
+
|
|
306
|
+
@property
|
|
307
|
+
@pulumi.getter(name="identityTokenTtl")
|
|
308
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
|
|
309
|
+
"""
|
|
310
|
+
The TTL of generated identity tokens in seconds.
|
|
311
|
+
"""
|
|
312
|
+
return pulumi.get(self, "identity_token_ttl")
|
|
313
|
+
|
|
314
|
+
@identity_token_ttl.setter
|
|
315
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
|
|
316
|
+
pulumi.set(self, "identity_token_ttl", value)
|
|
317
|
+
|
|
250
318
|
@property
|
|
251
319
|
@pulumi.getter
|
|
252
320
|
def namespace(self) -> Optional[pulumi.Input[str]]:
|
|
@@ -298,6 +366,8 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
298
366
|
client_id: Optional[pulumi.Input[str]] = None,
|
|
299
367
|
client_secret: Optional[pulumi.Input[str]] = None,
|
|
300
368
|
environment: Optional[pulumi.Input[str]] = None,
|
|
369
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
370
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
301
371
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
302
372
|
resource: Optional[pulumi.Input[str]] = None,
|
|
303
373
|
tenant_id: Optional[pulumi.Input[str]] = None,
|
|
@@ -305,6 +375,22 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
305
375
|
"""
|
|
306
376
|
## Example Usage
|
|
307
377
|
|
|
378
|
+
You can setup the Azure auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
379
|
+
```python
|
|
380
|
+
import pulumi
|
|
381
|
+
import pulumi_vault as vault
|
|
382
|
+
|
|
383
|
+
example = vault.AuthBackend("example",
|
|
384
|
+
type="azure",
|
|
385
|
+
identity_token_key="example-key")
|
|
386
|
+
example_auth_backend_config = vault.azure.AuthBackendConfig("example",
|
|
387
|
+
backend=example.path,
|
|
388
|
+
tenant_id="11111111-2222-3333-4444-555555555555",
|
|
389
|
+
client_id="11111111-2222-3333-4444-555555555555",
|
|
390
|
+
identity_token_audience="<TOKEN_AUDIENCE>",
|
|
391
|
+
identity_token_ttl="<TOKEN_TTL>")
|
|
392
|
+
```
|
|
393
|
+
|
|
308
394
|
```python
|
|
309
395
|
import pulumi
|
|
310
396
|
import pulumi_vault as vault
|
|
@@ -337,6 +423,9 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
337
423
|
:param pulumi.Input[str] environment: The Azure cloud environment. Valid values:
|
|
338
424
|
AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud,
|
|
339
425
|
AzureGermanCloud. Defaults to `AzurePublicCloud`.
|
|
426
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
427
|
+
*Available only for Vault Enterprise*
|
|
428
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds.
|
|
340
429
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
341
430
|
The value should not contain leading or trailing forward slashes.
|
|
342
431
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -355,6 +444,22 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
355
444
|
"""
|
|
356
445
|
## Example Usage
|
|
357
446
|
|
|
447
|
+
You can setup the Azure auth engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
448
|
+
```python
|
|
449
|
+
import pulumi
|
|
450
|
+
import pulumi_vault as vault
|
|
451
|
+
|
|
452
|
+
example = vault.AuthBackend("example",
|
|
453
|
+
type="azure",
|
|
454
|
+
identity_token_key="example-key")
|
|
455
|
+
example_auth_backend_config = vault.azure.AuthBackendConfig("example",
|
|
456
|
+
backend=example.path,
|
|
457
|
+
tenant_id="11111111-2222-3333-4444-555555555555",
|
|
458
|
+
client_id="11111111-2222-3333-4444-555555555555",
|
|
459
|
+
identity_token_audience="<TOKEN_AUDIENCE>",
|
|
460
|
+
identity_token_ttl="<TOKEN_TTL>")
|
|
461
|
+
```
|
|
462
|
+
|
|
358
463
|
```python
|
|
359
464
|
import pulumi
|
|
360
465
|
import pulumi_vault as vault
|
|
@@ -395,6 +500,8 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
395
500
|
client_id: Optional[pulumi.Input[str]] = None,
|
|
396
501
|
client_secret: Optional[pulumi.Input[str]] = None,
|
|
397
502
|
environment: Optional[pulumi.Input[str]] = None,
|
|
503
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
504
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
398
505
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
399
506
|
resource: Optional[pulumi.Input[str]] = None,
|
|
400
507
|
tenant_id: Optional[pulumi.Input[str]] = None,
|
|
@@ -411,6 +518,8 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
411
518
|
__props__.__dict__["client_id"] = None if client_id is None else pulumi.Output.secret(client_id)
|
|
412
519
|
__props__.__dict__["client_secret"] = None if client_secret is None else pulumi.Output.secret(client_secret)
|
|
413
520
|
__props__.__dict__["environment"] = environment
|
|
521
|
+
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
522
|
+
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
414
523
|
__props__.__dict__["namespace"] = namespace
|
|
415
524
|
if resource is None and not opts.urn:
|
|
416
525
|
raise TypeError("Missing required property 'resource'")
|
|
@@ -434,6 +543,8 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
434
543
|
client_id: Optional[pulumi.Input[str]] = None,
|
|
435
544
|
client_secret: Optional[pulumi.Input[str]] = None,
|
|
436
545
|
environment: Optional[pulumi.Input[str]] = None,
|
|
546
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
547
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
437
548
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
438
549
|
resource: Optional[pulumi.Input[str]] = None,
|
|
439
550
|
tenant_id: Optional[pulumi.Input[str]] = None) -> 'AuthBackendConfig':
|
|
@@ -453,6 +564,9 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
453
564
|
:param pulumi.Input[str] environment: The Azure cloud environment. Valid values:
|
|
454
565
|
AzurePublicCloud, AzureUSGovernmentCloud, AzureChinaCloud,
|
|
455
566
|
AzureGermanCloud. Defaults to `AzurePublicCloud`.
|
|
567
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
568
|
+
*Available only for Vault Enterprise*
|
|
569
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds.
|
|
456
570
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
457
571
|
The value should not contain leading or trailing forward slashes.
|
|
458
572
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -470,6 +584,8 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
470
584
|
__props__.__dict__["client_id"] = client_id
|
|
471
585
|
__props__.__dict__["client_secret"] = client_secret
|
|
472
586
|
__props__.__dict__["environment"] = environment
|
|
587
|
+
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
588
|
+
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
473
589
|
__props__.__dict__["namespace"] = namespace
|
|
474
590
|
__props__.__dict__["resource"] = resource
|
|
475
591
|
__props__.__dict__["tenant_id"] = tenant_id
|
|
@@ -512,6 +628,23 @@ class AuthBackendConfig(pulumi.CustomResource):
|
|
|
512
628
|
"""
|
|
513
629
|
return pulumi.get(self, "environment")
|
|
514
630
|
|
|
631
|
+
@property
|
|
632
|
+
@pulumi.getter(name="identityTokenAudience")
|
|
633
|
+
def identity_token_audience(self) -> pulumi.Output[Optional[str]]:
|
|
634
|
+
"""
|
|
635
|
+
The audience claim value for plugin identity tokens. Requires Vault 1.17+.
|
|
636
|
+
*Available only for Vault Enterprise*
|
|
637
|
+
"""
|
|
638
|
+
return pulumi.get(self, "identity_token_audience")
|
|
639
|
+
|
|
640
|
+
@property
|
|
641
|
+
@pulumi.getter(name="identityTokenTtl")
|
|
642
|
+
def identity_token_ttl(self) -> pulumi.Output[int]:
|
|
643
|
+
"""
|
|
644
|
+
The TTL of generated identity tokens in seconds.
|
|
645
|
+
"""
|
|
646
|
+
return pulumi.get(self, "identity_token_ttl")
|
|
647
|
+
|
|
515
648
|
@property
|
|
516
649
|
@pulumi.getter
|
|
517
650
|
def namespace(self) -> pulumi.Output[Optional[str]]:
|
pulumi_vault/azure/backend.py
CHANGED
|
@@ -21,6 +21,9 @@ class BackendArgs:
|
|
|
21
21
|
description: Optional[pulumi.Input[str]] = None,
|
|
22
22
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
23
23
|
environment: Optional[pulumi.Input[str]] = None,
|
|
24
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
25
|
+
identity_token_key: Optional[pulumi.Input[str]] = None,
|
|
26
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
24
27
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
25
28
|
path: Optional[pulumi.Input[str]] = None,
|
|
26
29
|
use_microsoft_graph_api: Optional[pulumi.Input[bool]] = None):
|
|
@@ -34,6 +37,12 @@ class BackendArgs:
|
|
|
34
37
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
35
38
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
36
39
|
:param pulumi.Input[str] environment: The Azure environment.
|
|
40
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.17+.
|
|
41
|
+
*Available only for Vault Enterprise*
|
|
42
|
+
:param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
43
|
+
*Available only for Vault Enterprise*
|
|
44
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
45
|
+
*Available only for Vault Enterprise*
|
|
37
46
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
38
47
|
The value should not contain leading or trailing forward slashes.
|
|
39
48
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -53,10 +62,19 @@ class BackendArgs:
|
|
|
53
62
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
54
63
|
if environment is not None:
|
|
55
64
|
pulumi.set(__self__, "environment", environment)
|
|
65
|
+
if identity_token_audience is not None:
|
|
66
|
+
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
67
|
+
if identity_token_key is not None:
|
|
68
|
+
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
69
|
+
if identity_token_ttl is not None:
|
|
70
|
+
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
56
71
|
if namespace is not None:
|
|
57
72
|
pulumi.set(__self__, "namespace", namespace)
|
|
58
73
|
if path is not None:
|
|
59
74
|
pulumi.set(__self__, "path", path)
|
|
75
|
+
if use_microsoft_graph_api is not None:
|
|
76
|
+
warnings.warn("""This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.""", DeprecationWarning)
|
|
77
|
+
pulumi.log.warn("""use_microsoft_graph_api is deprecated: This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.""")
|
|
60
78
|
if use_microsoft_graph_api is not None:
|
|
61
79
|
pulumi.set(__self__, "use_microsoft_graph_api", use_microsoft_graph_api)
|
|
62
80
|
|
|
@@ -145,6 +163,45 @@ class BackendArgs:
|
|
|
145
163
|
def environment(self, value: Optional[pulumi.Input[str]]):
|
|
146
164
|
pulumi.set(self, "environment", value)
|
|
147
165
|
|
|
166
|
+
@property
|
|
167
|
+
@pulumi.getter(name="identityTokenAudience")
|
|
168
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
|
|
169
|
+
"""
|
|
170
|
+
The audience claim value. Requires Vault 1.17+.
|
|
171
|
+
*Available only for Vault Enterprise*
|
|
172
|
+
"""
|
|
173
|
+
return pulumi.get(self, "identity_token_audience")
|
|
174
|
+
|
|
175
|
+
@identity_token_audience.setter
|
|
176
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
|
|
177
|
+
pulumi.set(self, "identity_token_audience", value)
|
|
178
|
+
|
|
179
|
+
@property
|
|
180
|
+
@pulumi.getter(name="identityTokenKey")
|
|
181
|
+
def identity_token_key(self) -> Optional[pulumi.Input[str]]:
|
|
182
|
+
"""
|
|
183
|
+
The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
184
|
+
*Available only for Vault Enterprise*
|
|
185
|
+
"""
|
|
186
|
+
return pulumi.get(self, "identity_token_key")
|
|
187
|
+
|
|
188
|
+
@identity_token_key.setter
|
|
189
|
+
def identity_token_key(self, value: Optional[pulumi.Input[str]]):
|
|
190
|
+
pulumi.set(self, "identity_token_key", value)
|
|
191
|
+
|
|
192
|
+
@property
|
|
193
|
+
@pulumi.getter(name="identityTokenTtl")
|
|
194
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
|
|
195
|
+
"""
|
|
196
|
+
The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
197
|
+
*Available only for Vault Enterprise*
|
|
198
|
+
"""
|
|
199
|
+
return pulumi.get(self, "identity_token_ttl")
|
|
200
|
+
|
|
201
|
+
@identity_token_ttl.setter
|
|
202
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
|
|
203
|
+
pulumi.set(self, "identity_token_ttl", value)
|
|
204
|
+
|
|
148
205
|
@property
|
|
149
206
|
@pulumi.getter
|
|
150
207
|
def namespace(self) -> Optional[pulumi.Input[str]]:
|
|
@@ -174,6 +231,7 @@ class BackendArgs:
|
|
|
174
231
|
|
|
175
232
|
@property
|
|
176
233
|
@pulumi.getter(name="useMicrosoftGraphApi")
|
|
234
|
+
@_utilities.deprecated("""This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.""")
|
|
177
235
|
def use_microsoft_graph_api(self) -> Optional[pulumi.Input[bool]]:
|
|
178
236
|
"""
|
|
179
237
|
Use the Microsoft Graph API. Should be set to true on vault-1.10+
|
|
@@ -193,6 +251,9 @@ class _BackendState:
|
|
|
193
251
|
description: Optional[pulumi.Input[str]] = None,
|
|
194
252
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
195
253
|
environment: Optional[pulumi.Input[str]] = None,
|
|
254
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
255
|
+
identity_token_key: Optional[pulumi.Input[str]] = None,
|
|
256
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
196
257
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
197
258
|
path: Optional[pulumi.Input[str]] = None,
|
|
198
259
|
subscription_id: Optional[pulumi.Input[str]] = None,
|
|
@@ -206,6 +267,12 @@ class _BackendState:
|
|
|
206
267
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
207
268
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
208
269
|
:param pulumi.Input[str] environment: The Azure environment.
|
|
270
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.17+.
|
|
271
|
+
*Available only for Vault Enterprise*
|
|
272
|
+
:param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
273
|
+
*Available only for Vault Enterprise*
|
|
274
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
275
|
+
*Available only for Vault Enterprise*
|
|
209
276
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
210
277
|
The value should not contain leading or trailing forward slashes.
|
|
211
278
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -225,6 +292,12 @@ class _BackendState:
|
|
|
225
292
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
226
293
|
if environment is not None:
|
|
227
294
|
pulumi.set(__self__, "environment", environment)
|
|
295
|
+
if identity_token_audience is not None:
|
|
296
|
+
pulumi.set(__self__, "identity_token_audience", identity_token_audience)
|
|
297
|
+
if identity_token_key is not None:
|
|
298
|
+
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
299
|
+
if identity_token_ttl is not None:
|
|
300
|
+
pulumi.set(__self__, "identity_token_ttl", identity_token_ttl)
|
|
228
301
|
if namespace is not None:
|
|
229
302
|
pulumi.set(__self__, "namespace", namespace)
|
|
230
303
|
if path is not None:
|
|
@@ -233,6 +306,9 @@ class _BackendState:
|
|
|
233
306
|
pulumi.set(__self__, "subscription_id", subscription_id)
|
|
234
307
|
if tenant_id is not None:
|
|
235
308
|
pulumi.set(__self__, "tenant_id", tenant_id)
|
|
309
|
+
if use_microsoft_graph_api is not None:
|
|
310
|
+
warnings.warn("""This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.""", DeprecationWarning)
|
|
311
|
+
pulumi.log.warn("""use_microsoft_graph_api is deprecated: This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.""")
|
|
236
312
|
if use_microsoft_graph_api is not None:
|
|
237
313
|
pulumi.set(__self__, "use_microsoft_graph_api", use_microsoft_graph_api)
|
|
238
314
|
|
|
@@ -297,6 +373,45 @@ class _BackendState:
|
|
|
297
373
|
def environment(self, value: Optional[pulumi.Input[str]]):
|
|
298
374
|
pulumi.set(self, "environment", value)
|
|
299
375
|
|
|
376
|
+
@property
|
|
377
|
+
@pulumi.getter(name="identityTokenAudience")
|
|
378
|
+
def identity_token_audience(self) -> Optional[pulumi.Input[str]]:
|
|
379
|
+
"""
|
|
380
|
+
The audience claim value. Requires Vault 1.17+.
|
|
381
|
+
*Available only for Vault Enterprise*
|
|
382
|
+
"""
|
|
383
|
+
return pulumi.get(self, "identity_token_audience")
|
|
384
|
+
|
|
385
|
+
@identity_token_audience.setter
|
|
386
|
+
def identity_token_audience(self, value: Optional[pulumi.Input[str]]):
|
|
387
|
+
pulumi.set(self, "identity_token_audience", value)
|
|
388
|
+
|
|
389
|
+
@property
|
|
390
|
+
@pulumi.getter(name="identityTokenKey")
|
|
391
|
+
def identity_token_key(self) -> Optional[pulumi.Input[str]]:
|
|
392
|
+
"""
|
|
393
|
+
The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
394
|
+
*Available only for Vault Enterprise*
|
|
395
|
+
"""
|
|
396
|
+
return pulumi.get(self, "identity_token_key")
|
|
397
|
+
|
|
398
|
+
@identity_token_key.setter
|
|
399
|
+
def identity_token_key(self, value: Optional[pulumi.Input[str]]):
|
|
400
|
+
pulumi.set(self, "identity_token_key", value)
|
|
401
|
+
|
|
402
|
+
@property
|
|
403
|
+
@pulumi.getter(name="identityTokenTtl")
|
|
404
|
+
def identity_token_ttl(self) -> Optional[pulumi.Input[int]]:
|
|
405
|
+
"""
|
|
406
|
+
The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
407
|
+
*Available only for Vault Enterprise*
|
|
408
|
+
"""
|
|
409
|
+
return pulumi.get(self, "identity_token_ttl")
|
|
410
|
+
|
|
411
|
+
@identity_token_ttl.setter
|
|
412
|
+
def identity_token_ttl(self, value: Optional[pulumi.Input[int]]):
|
|
413
|
+
pulumi.set(self, "identity_token_ttl", value)
|
|
414
|
+
|
|
300
415
|
@property
|
|
301
416
|
@pulumi.getter
|
|
302
417
|
def namespace(self) -> Optional[pulumi.Input[str]]:
|
|
@@ -350,6 +465,7 @@ class _BackendState:
|
|
|
350
465
|
|
|
351
466
|
@property
|
|
352
467
|
@pulumi.getter(name="useMicrosoftGraphApi")
|
|
468
|
+
@_utilities.deprecated("""This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.""")
|
|
353
469
|
def use_microsoft_graph_api(self) -> Optional[pulumi.Input[bool]]:
|
|
354
470
|
"""
|
|
355
471
|
Use the Microsoft Graph API. Should be set to true on vault-1.10+
|
|
@@ -371,6 +487,9 @@ class Backend(pulumi.CustomResource):
|
|
|
371
487
|
description: Optional[pulumi.Input[str]] = None,
|
|
372
488
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
373
489
|
environment: Optional[pulumi.Input[str]] = None,
|
|
490
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
491
|
+
identity_token_key: Optional[pulumi.Input[str]] = None,
|
|
492
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
374
493
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
375
494
|
path: Optional[pulumi.Input[str]] = None,
|
|
376
495
|
subscription_id: Optional[pulumi.Input[str]] = None,
|
|
@@ -382,6 +501,19 @@ class Backend(pulumi.CustomResource):
|
|
|
382
501
|
|
|
383
502
|
### *Vault-1.9 And Above*
|
|
384
503
|
|
|
504
|
+
You can setup the Azure secrets engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
505
|
+
```python
|
|
506
|
+
import pulumi
|
|
507
|
+
import pulumi_vault as vault
|
|
508
|
+
|
|
509
|
+
azure = vault.azure.Backend("azure",
|
|
510
|
+
subscription_id="11111111-2222-3333-4444-111111111111",
|
|
511
|
+
tenant_id="11111111-2222-3333-4444-222222222222",
|
|
512
|
+
client_id="11111111-2222-3333-4444-333333333333",
|
|
513
|
+
identity_token_audience="<TOKEN_AUDIENCE>",
|
|
514
|
+
identity_token_ttl="<TOKEN_TTL>")
|
|
515
|
+
```
|
|
516
|
+
|
|
385
517
|
```python
|
|
386
518
|
import pulumi
|
|
387
519
|
import pulumi_vault as vault
|
|
@@ -418,6 +550,12 @@ class Backend(pulumi.CustomResource):
|
|
|
418
550
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
419
551
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
420
552
|
:param pulumi.Input[str] environment: The Azure environment.
|
|
553
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.17+.
|
|
554
|
+
*Available only for Vault Enterprise*
|
|
555
|
+
:param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
556
|
+
*Available only for Vault Enterprise*
|
|
557
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
558
|
+
*Available only for Vault Enterprise*
|
|
421
559
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
422
560
|
The value should not contain leading or trailing forward slashes.
|
|
423
561
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -438,6 +576,19 @@ class Backend(pulumi.CustomResource):
|
|
|
438
576
|
|
|
439
577
|
### *Vault-1.9 And Above*
|
|
440
578
|
|
|
579
|
+
You can setup the Azure secrets engine with Workload Identity Federation (WIF) for a secret-less configuration:
|
|
580
|
+
```python
|
|
581
|
+
import pulumi
|
|
582
|
+
import pulumi_vault as vault
|
|
583
|
+
|
|
584
|
+
azure = vault.azure.Backend("azure",
|
|
585
|
+
subscription_id="11111111-2222-3333-4444-111111111111",
|
|
586
|
+
tenant_id="11111111-2222-3333-4444-222222222222",
|
|
587
|
+
client_id="11111111-2222-3333-4444-333333333333",
|
|
588
|
+
identity_token_audience="<TOKEN_AUDIENCE>",
|
|
589
|
+
identity_token_ttl="<TOKEN_TTL>")
|
|
590
|
+
```
|
|
591
|
+
|
|
441
592
|
```python
|
|
442
593
|
import pulumi
|
|
443
594
|
import pulumi_vault as vault
|
|
@@ -486,6 +637,9 @@ class Backend(pulumi.CustomResource):
|
|
|
486
637
|
description: Optional[pulumi.Input[str]] = None,
|
|
487
638
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
488
639
|
environment: Optional[pulumi.Input[str]] = None,
|
|
640
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
641
|
+
identity_token_key: Optional[pulumi.Input[str]] = None,
|
|
642
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
489
643
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
490
644
|
path: Optional[pulumi.Input[str]] = None,
|
|
491
645
|
subscription_id: Optional[pulumi.Input[str]] = None,
|
|
@@ -505,6 +659,9 @@ class Backend(pulumi.CustomResource):
|
|
|
505
659
|
__props__.__dict__["description"] = description
|
|
506
660
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
507
661
|
__props__.__dict__["environment"] = environment
|
|
662
|
+
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
663
|
+
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
664
|
+
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
508
665
|
__props__.__dict__["namespace"] = namespace
|
|
509
666
|
__props__.__dict__["path"] = path
|
|
510
667
|
if subscription_id is None and not opts.urn:
|
|
@@ -531,6 +688,9 @@ class Backend(pulumi.CustomResource):
|
|
|
531
688
|
description: Optional[pulumi.Input[str]] = None,
|
|
532
689
|
disable_remount: Optional[pulumi.Input[bool]] = None,
|
|
533
690
|
environment: Optional[pulumi.Input[str]] = None,
|
|
691
|
+
identity_token_audience: Optional[pulumi.Input[str]] = None,
|
|
692
|
+
identity_token_key: Optional[pulumi.Input[str]] = None,
|
|
693
|
+
identity_token_ttl: Optional[pulumi.Input[int]] = None,
|
|
534
694
|
namespace: Optional[pulumi.Input[str]] = None,
|
|
535
695
|
path: Optional[pulumi.Input[str]] = None,
|
|
536
696
|
subscription_id: Optional[pulumi.Input[str]] = None,
|
|
@@ -549,6 +709,12 @@ class Backend(pulumi.CustomResource):
|
|
|
549
709
|
:param pulumi.Input[bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
550
710
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
551
711
|
:param pulumi.Input[str] environment: The Azure environment.
|
|
712
|
+
:param pulumi.Input[str] identity_token_audience: The audience claim value. Requires Vault 1.17+.
|
|
713
|
+
*Available only for Vault Enterprise*
|
|
714
|
+
:param pulumi.Input[str] identity_token_key: The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
715
|
+
*Available only for Vault Enterprise*
|
|
716
|
+
:param pulumi.Input[int] identity_token_ttl: The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
717
|
+
*Available only for Vault Enterprise*
|
|
552
718
|
:param pulumi.Input[str] namespace: The namespace to provision the resource in.
|
|
553
719
|
The value should not contain leading or trailing forward slashes.
|
|
554
720
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
@@ -567,6 +733,9 @@ class Backend(pulumi.CustomResource):
|
|
|
567
733
|
__props__.__dict__["description"] = description
|
|
568
734
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
569
735
|
__props__.__dict__["environment"] = environment
|
|
736
|
+
__props__.__dict__["identity_token_audience"] = identity_token_audience
|
|
737
|
+
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
738
|
+
__props__.__dict__["identity_token_ttl"] = identity_token_ttl
|
|
570
739
|
__props__.__dict__["namespace"] = namespace
|
|
571
740
|
__props__.__dict__["path"] = path
|
|
572
741
|
__props__.__dict__["subscription_id"] = subscription_id
|
|
@@ -615,6 +784,33 @@ class Backend(pulumi.CustomResource):
|
|
|
615
784
|
"""
|
|
616
785
|
return pulumi.get(self, "environment")
|
|
617
786
|
|
|
787
|
+
@property
|
|
788
|
+
@pulumi.getter(name="identityTokenAudience")
|
|
789
|
+
def identity_token_audience(self) -> pulumi.Output[Optional[str]]:
|
|
790
|
+
"""
|
|
791
|
+
The audience claim value. Requires Vault 1.17+.
|
|
792
|
+
*Available only for Vault Enterprise*
|
|
793
|
+
"""
|
|
794
|
+
return pulumi.get(self, "identity_token_audience")
|
|
795
|
+
|
|
796
|
+
@property
|
|
797
|
+
@pulumi.getter(name="identityTokenKey")
|
|
798
|
+
def identity_token_key(self) -> pulumi.Output[Optional[str]]:
|
|
799
|
+
"""
|
|
800
|
+
The key to use for signing identity tokens. Requires Vault 1.17+.
|
|
801
|
+
*Available only for Vault Enterprise*
|
|
802
|
+
"""
|
|
803
|
+
return pulumi.get(self, "identity_token_key")
|
|
804
|
+
|
|
805
|
+
@property
|
|
806
|
+
@pulumi.getter(name="identityTokenTtl")
|
|
807
|
+
def identity_token_ttl(self) -> pulumi.Output[int]:
|
|
808
|
+
"""
|
|
809
|
+
The TTL of generated identity tokens in seconds. Requires Vault 1.17+.
|
|
810
|
+
*Available only for Vault Enterprise*
|
|
811
|
+
"""
|
|
812
|
+
return pulumi.get(self, "identity_token_ttl")
|
|
813
|
+
|
|
618
814
|
@property
|
|
619
815
|
@pulumi.getter
|
|
620
816
|
def namespace(self) -> pulumi.Output[Optional[str]]:
|
|
@@ -652,6 +848,7 @@ class Backend(pulumi.CustomResource):
|
|
|
652
848
|
|
|
653
849
|
@property
|
|
654
850
|
@pulumi.getter(name="useMicrosoftGraphApi")
|
|
851
|
+
@_utilities.deprecated("""This field is not supported in Vault-1.12+ and is the default behavior. This field will be removed in future version of the provider.""")
|
|
655
852
|
def use_microsoft_graph_api(self) -> pulumi.Output[bool]:
|
|
656
853
|
"""
|
|
657
854
|
Use the Microsoft Graph API. Should be set to true on vault-1.10+
|