pulumi-vault 7.1.0__py3-none-any.whl → 7.2.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- pulumi_vault/__init__.py +19 -1
- pulumi_vault/_inputs.py +873 -673
- pulumi_vault/ad/__init__.py +1 -1
- pulumi_vault/ad/get_access_credentials.py +27 -28
- pulumi_vault/ad/secret_backend.py +579 -580
- pulumi_vault/ad/secret_library.py +120 -121
- pulumi_vault/ad/secret_role.py +104 -105
- pulumi_vault/alicloud/__init__.py +1 -1
- pulumi_vault/alicloud/auth_backend_role.py +222 -223
- pulumi_vault/approle/__init__.py +1 -1
- pulumi_vault/approle/auth_backend_login.py +138 -139
- pulumi_vault/approle/auth_backend_role.py +292 -293
- pulumi_vault/approle/auth_backend_role_secret_id.py +202 -203
- pulumi_vault/approle/get_auth_backend_role_id.py +23 -24
- pulumi_vault/audit.py +103 -104
- pulumi_vault/audit_request_header.py +52 -53
- pulumi_vault/auth_backend.py +132 -133
- pulumi_vault/aws/__init__.py +1 -1
- pulumi_vault/aws/auth_backend_cert.py +86 -87
- pulumi_vault/aws/auth_backend_client.py +307 -308
- pulumi_vault/aws/auth_backend_config_identity.py +103 -104
- pulumi_vault/aws/auth_backend_identity_whitelist.py +69 -70
- pulumi_vault/aws/auth_backend_login.py +258 -259
- pulumi_vault/aws/auth_backend_role.py +486 -487
- pulumi_vault/aws/auth_backend_role_tag.py +155 -156
- pulumi_vault/aws/auth_backend_roletag_blacklist.py +69 -70
- pulumi_vault/aws/auth_backend_sts_role.py +86 -87
- pulumi_vault/aws/get_access_credentials.py +59 -60
- pulumi_vault/aws/get_static_access_credentials.py +19 -20
- pulumi_vault/aws/secret_backend.py +1016 -439
- pulumi_vault/aws/secret_backend_role.py +256 -257
- pulumi_vault/aws/secret_backend_static_role.py +137 -138
- pulumi_vault/azure/__init__.py +1 -1
- pulumi_vault/azure/_inputs.py +26 -27
- pulumi_vault/azure/auth_backend_config.py +222 -223
- pulumi_vault/azure/auth_backend_role.py +307 -308
- pulumi_vault/azure/backend.py +1057 -285
- pulumi_vault/azure/backend_role.py +194 -195
- pulumi_vault/azure/get_access_credentials.py +75 -76
- pulumi_vault/azure/outputs.py +16 -17
- pulumi_vault/cert_auth_backend_role.py +443 -444
- pulumi_vault/config/__init__.py +1 -1
- pulumi_vault/config/__init__.pyi +1 -2
- pulumi_vault/config/_inputs.py +13 -14
- pulumi_vault/config/outputs.py +380 -381
- pulumi_vault/config/ui_custom_message.py +140 -141
- pulumi_vault/config/vars.py +31 -32
- pulumi_vault/consul/__init__.py +1 -1
- pulumi_vault/consul/secret_backend.py +887 -256
- pulumi_vault/consul/secret_backend_role.py +222 -223
- pulumi_vault/database/__init__.py +1 -1
- pulumi_vault/database/_inputs.py +3167 -3168
- pulumi_vault/database/outputs.py +2123 -2124
- pulumi_vault/database/secret_backend_connection.py +259 -260
- pulumi_vault/database/secret_backend_role.py +205 -206
- pulumi_vault/database/secret_backend_static_role.py +218 -219
- pulumi_vault/database/secrets_mount.py +426 -380
- pulumi_vault/egp_policy.py +86 -87
- pulumi_vault/gcp/__init__.py +1 -1
- pulumi_vault/gcp/_inputs.py +98 -99
- pulumi_vault/gcp/auth_backend.py +322 -323
- pulumi_vault/gcp/auth_backend_role.py +347 -348
- pulumi_vault/gcp/get_auth_backend_role.py +91 -92
- pulumi_vault/gcp/outputs.py +66 -67
- pulumi_vault/gcp/secret_backend.py +878 -336
- pulumi_vault/gcp/secret_impersonated_account.py +112 -113
- pulumi_vault/gcp/secret_roleset.py +115 -116
- pulumi_vault/gcp/secret_static_account.py +115 -116
- pulumi_vault/generic/__init__.py +1 -1
- pulumi_vault/generic/endpoint.py +138 -139
- pulumi_vault/generic/get_secret.py +39 -40
- pulumi_vault/generic/secret.py +95 -96
- pulumi_vault/get_auth_backend.py +29 -30
- pulumi_vault/get_auth_backends.py +19 -20
- pulumi_vault/get_namespace.py +21 -22
- pulumi_vault/get_namespaces.py +19 -20
- pulumi_vault/get_nomad_access_token.py +25 -26
- pulumi_vault/get_policy_document.py +10 -11
- pulumi_vault/get_raft_autopilot_state.py +31 -32
- pulumi_vault/github/__init__.py +1 -1
- pulumi_vault/github/_inputs.py +50 -51
- pulumi_vault/github/auth_backend.py +285 -286
- pulumi_vault/github/outputs.py +34 -35
- pulumi_vault/github/team.py +69 -70
- pulumi_vault/github/user.py +69 -70
- pulumi_vault/identity/__init__.py +1 -1
- pulumi_vault/identity/entity.py +103 -104
- pulumi_vault/identity/entity_alias.py +86 -87
- pulumi_vault/identity/entity_policies.py +78 -79
- pulumi_vault/identity/get_entity.py +62 -63
- pulumi_vault/identity/get_group.py +75 -76
- pulumi_vault/identity/get_oidc_client_creds.py +19 -20
- pulumi_vault/identity/get_oidc_openid_config.py +39 -40
- pulumi_vault/identity/get_oidc_public_keys.py +17 -18
- pulumi_vault/identity/group.py +171 -172
- pulumi_vault/identity/group_alias.py +69 -70
- pulumi_vault/identity/group_member_entity_ids.py +69 -70
- pulumi_vault/identity/group_member_group_ids.py +69 -70
- pulumi_vault/identity/group_policies.py +78 -79
- pulumi_vault/identity/mfa_duo.py +183 -184
- pulumi_vault/identity/mfa_login_enforcement.py +147 -148
- pulumi_vault/identity/mfa_okta.py +166 -167
- pulumi_vault/identity/mfa_pingid.py +160 -161
- pulumi_vault/identity/mfa_totp.py +217 -218
- pulumi_vault/identity/oidc.py +35 -36
- pulumi_vault/identity/oidc_assignment.py +69 -70
- pulumi_vault/identity/oidc_client.py +155 -156
- pulumi_vault/identity/oidc_key.py +103 -104
- pulumi_vault/identity/oidc_key_allowed_client_id.py +52 -53
- pulumi_vault/identity/oidc_provider.py +112 -113
- pulumi_vault/identity/oidc_role.py +103 -104
- pulumi_vault/identity/oidc_scope.py +69 -70
- pulumi_vault/identity/outputs.py +42 -43
- pulumi_vault/jwt/__init__.py +1 -1
- pulumi_vault/jwt/_inputs.py +50 -51
- pulumi_vault/jwt/auth_backend.py +400 -354
- pulumi_vault/jwt/auth_backend_role.py +494 -495
- pulumi_vault/jwt/outputs.py +34 -35
- pulumi_vault/kmip/__init__.py +1 -1
- pulumi_vault/kmip/secret_backend.py +1006 -227
- pulumi_vault/kmip/secret_role.py +358 -359
- pulumi_vault/kmip/secret_scope.py +69 -70
- pulumi_vault/kubernetes/__init__.py +1 -1
- pulumi_vault/kubernetes/auth_backend_config.py +171 -172
- pulumi_vault/kubernetes/auth_backend_role.py +273 -274
- pulumi_vault/kubernetes/get_auth_backend_config.py +57 -58
- pulumi_vault/kubernetes/get_auth_backend_role.py +87 -88
- pulumi_vault/kubernetes/get_service_account_token.py +51 -52
- pulumi_vault/kubernetes/secret_backend.py +431 -385
- pulumi_vault/kubernetes/secret_backend_role.py +239 -240
- pulumi_vault/kv/__init__.py +1 -1
- pulumi_vault/kv/_inputs.py +25 -26
- pulumi_vault/kv/get_secret.py +25 -26
- pulumi_vault/kv/get_secret_subkeys_v2.py +39 -40
- pulumi_vault/kv/get_secret_v2.py +41 -42
- pulumi_vault/kv/get_secrets_list.py +17 -18
- pulumi_vault/kv/get_secrets_list_v2.py +25 -26
- pulumi_vault/kv/outputs.py +17 -18
- pulumi_vault/kv/secret.py +61 -62
- pulumi_vault/kv/secret_backend_v2.py +86 -87
- pulumi_vault/kv/secret_v2.py +184 -185
- pulumi_vault/ldap/__init__.py +1 -1
- pulumi_vault/ldap/auth_backend.py +716 -717
- pulumi_vault/ldap/auth_backend_group.py +69 -70
- pulumi_vault/ldap/auth_backend_user.py +86 -87
- pulumi_vault/ldap/get_dynamic_credentials.py +27 -28
- pulumi_vault/ldap/get_static_credentials.py +29 -30
- pulumi_vault/ldap/secret_backend.py +732 -693
- pulumi_vault/ldap/secret_backend_dynamic_role.py +154 -155
- pulumi_vault/ldap/secret_backend_library_set.py +120 -121
- pulumi_vault/ldap/secret_backend_static_role.py +120 -121
- pulumi_vault/managed/__init__.py +1 -1
- pulumi_vault/managed/_inputs.py +274 -275
- pulumi_vault/managed/keys.py +27 -28
- pulumi_vault/managed/outputs.py +184 -185
- pulumi_vault/mfa_duo.py +137 -138
- pulumi_vault/mfa_okta.py +137 -138
- pulumi_vault/mfa_pingid.py +149 -150
- pulumi_vault/mfa_totp.py +154 -155
- pulumi_vault/mongodbatlas/__init__.py +1 -1
- pulumi_vault/mongodbatlas/secret_backend.py +78 -79
- pulumi_vault/mongodbatlas/secret_role.py +188 -189
- pulumi_vault/mount.py +380 -334
- pulumi_vault/namespace.py +78 -79
- pulumi_vault/nomad_secret_backend.py +909 -271
- pulumi_vault/nomad_secret_role.py +103 -104
- pulumi_vault/oci_auth_backend.py +683 -0
- pulumi_vault/oci_auth_backend_role.py +798 -0
- pulumi_vault/okta/__init__.py +1 -1
- pulumi_vault/okta/_inputs.py +31 -32
- pulumi_vault/okta/auth_backend.py +305 -306
- pulumi_vault/okta/auth_backend_group.py +69 -70
- pulumi_vault/okta/auth_backend_user.py +86 -87
- pulumi_vault/okta/outputs.py +21 -22
- pulumi_vault/outputs.py +234 -82
- pulumi_vault/pkisecret/__init__.py +1 -1
- pulumi_vault/pkisecret/_inputs.py +55 -56
- pulumi_vault/pkisecret/backend_acme_eab.py +116 -117
- pulumi_vault/pkisecret/backend_config_acme.py +175 -176
- pulumi_vault/pkisecret/backend_config_auto_tidy.py +394 -395
- pulumi_vault/pkisecret/backend_config_cluster.py +71 -72
- pulumi_vault/pkisecret/backend_config_cmpv2.py +132 -133
- pulumi_vault/pkisecret/backend_config_est.py +149 -150
- pulumi_vault/pkisecret/backend_config_scep.py +205 -159
- pulumi_vault/pkisecret/get_backend_cert_metadata.py +37 -38
- pulumi_vault/pkisecret/get_backend_config_cmpv2.py +32 -33
- pulumi_vault/pkisecret/get_backend_config_est.py +30 -31
- pulumi_vault/pkisecret/get_backend_config_scep.py +50 -31
- pulumi_vault/pkisecret/get_backend_issuer.py +63 -64
- pulumi_vault/pkisecret/get_backend_issuers.py +23 -24
- pulumi_vault/pkisecret/get_backend_key.py +29 -30
- pulumi_vault/pkisecret/get_backend_keys.py +23 -24
- pulumi_vault/pkisecret/outputs.py +61 -62
- pulumi_vault/pkisecret/secret_backend_cert.py +415 -416
- pulumi_vault/pkisecret/secret_backend_config_ca.py +54 -55
- pulumi_vault/pkisecret/secret_backend_config_issuers.py +75 -76
- pulumi_vault/pkisecret/secret_backend_config_urls.py +105 -106
- pulumi_vault/pkisecret/secret_backend_crl_config.py +241 -242
- pulumi_vault/pkisecret/secret_backend_intermediate_cert_request.py +515 -516
- pulumi_vault/pkisecret/secret_backend_intermediate_set_signed.py +78 -79
- pulumi_vault/pkisecret/secret_backend_issuer.py +286 -287
- pulumi_vault/pkisecret/secret_backend_key.py +146 -147
- pulumi_vault/pkisecret/secret_backend_role.py +873 -874
- pulumi_vault/pkisecret/secret_backend_root_cert.py +677 -678
- pulumi_vault/pkisecret/secret_backend_root_sign_intermediate.py +660 -661
- pulumi_vault/pkisecret/secret_backend_sign.py +346 -347
- pulumi_vault/plugin.py +154 -155
- pulumi_vault/plugin_pinned_version.py +52 -53
- pulumi_vault/policy.py +52 -53
- pulumi_vault/provider.py +160 -161
- pulumi_vault/pulumi-plugin.json +1 -1
- pulumi_vault/quota_lease_count.py +103 -104
- pulumi_vault/quota_rate_limit.py +171 -172
- pulumi_vault/rabbitmq/__init__.py +1 -1
- pulumi_vault/rabbitmq/_inputs.py +50 -51
- pulumi_vault/rabbitmq/outputs.py +34 -35
- pulumi_vault/rabbitmq/secret_backend.py +902 -231
- pulumi_vault/rabbitmq/secret_backend_role.py +79 -80
- pulumi_vault/raft_autopilot.py +137 -138
- pulumi_vault/raft_snapshot_agent_config.py +477 -478
- pulumi_vault/rgp_policy.py +69 -70
- pulumi_vault/saml/__init__.py +1 -1
- pulumi_vault/saml/auth_backend.py +188 -189
- pulumi_vault/saml/auth_backend_role.py +290 -291
- pulumi_vault/scep_auth_backend_role.py +252 -253
- pulumi_vault/secrets/__init__.py +1 -1
- pulumi_vault/secrets/_inputs.py +19 -20
- pulumi_vault/secrets/outputs.py +13 -14
- pulumi_vault/secrets/sync_association.py +88 -89
- pulumi_vault/secrets/sync_aws_destination.py +180 -181
- pulumi_vault/secrets/sync_azure_destination.py +180 -181
- pulumi_vault/secrets/sync_config.py +52 -53
- pulumi_vault/secrets/sync_gcp_destination.py +129 -130
- pulumi_vault/secrets/sync_gh_destination.py +163 -164
- pulumi_vault/secrets/sync_github_apps.py +78 -79
- pulumi_vault/secrets/sync_vercel_destination.py +146 -147
- pulumi_vault/ssh/__init__.py +1 -1
- pulumi_vault/ssh/_inputs.py +13 -14
- pulumi_vault/ssh/get_secret_backend_sign.py +65 -66
- pulumi_vault/ssh/outputs.py +9 -10
- pulumi_vault/ssh/secret_backend_ca.py +217 -124
- pulumi_vault/ssh/secret_backend_role.py +446 -447
- pulumi_vault/terraformcloud/__init__.py +1 -1
- pulumi_vault/terraformcloud/secret_backend.py +833 -155
- pulumi_vault/terraformcloud/secret_creds.py +93 -94
- pulumi_vault/terraformcloud/secret_role.py +117 -118
- pulumi_vault/token.py +301 -302
- pulumi_vault/tokenauth/__init__.py +1 -1
- pulumi_vault/tokenauth/auth_backend_role.py +324 -325
- pulumi_vault/transform/__init__.py +1 -1
- pulumi_vault/transform/alphabet.py +69 -70
- pulumi_vault/transform/get_decode.py +57 -58
- pulumi_vault/transform/get_encode.py +57 -58
- pulumi_vault/transform/role.py +69 -70
- pulumi_vault/transform/template.py +137 -138
- pulumi_vault/transform/transformation.py +171 -172
- pulumi_vault/transit/__init__.py +1 -1
- pulumi_vault/transit/get_cmac.py +47 -48
- pulumi_vault/transit/get_decrypt.py +25 -26
- pulumi_vault/transit/get_encrypt.py +29 -30
- pulumi_vault/transit/get_sign.py +71 -72
- pulumi_vault/transit/get_verify.py +83 -84
- pulumi_vault/transit/secret_backend_key.py +377 -350
- pulumi_vault/transit/secret_cache_config.py +52 -53
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/METADATA +1 -1
- pulumi_vault-7.2.0.dist-info/RECORD +270 -0
- pulumi_vault-7.1.0.dist-info/RECORD +0 -268
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/WHEEL +0 -0
- {pulumi_vault-7.1.0.dist-info → pulumi_vault-7.2.0.dist-info}/top_level.txt +0 -0
|
@@ -2,8 +2,7 @@
|
|
|
2
2
|
# *** WARNING: this file was generated by pulumi-language-python. ***
|
|
3
3
|
# *** Do not edit by hand unless you're certain you know what you are doing! ***
|
|
4
4
|
|
|
5
|
-
import builtins
|
|
6
|
-
import copy
|
|
5
|
+
import builtins as _builtins
|
|
7
6
|
import warnings
|
|
8
7
|
import sys
|
|
9
8
|
import pulumi
|
|
@@ -20,55 +19,119 @@ __all__ = ['SecretBackendArgs', 'SecretBackend']
|
|
|
20
19
|
@pulumi.input_type
|
|
21
20
|
class SecretBackendArgs:
|
|
22
21
|
def __init__(__self__, *,
|
|
23
|
-
path: pulumi.Input[
|
|
24
|
-
|
|
25
|
-
|
|
26
|
-
|
|
27
|
-
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
22
|
+
path: pulumi.Input[_builtins.str],
|
|
23
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
24
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
25
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
26
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
27
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
28
|
+
default_tls_client_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
29
|
+
default_tls_client_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
30
|
+
default_tls_client_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
31
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
32
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
33
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
34
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
35
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
36
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
37
|
+
listen_addrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
38
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
39
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
40
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
41
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
42
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
43
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
44
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
45
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
46
|
+
server_hostnames: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
47
|
+
server_ips: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
48
|
+
tls_ca_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
49
|
+
tls_ca_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
50
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None):
|
|
36
51
|
"""
|
|
37
52
|
The set of arguments for constructing a SecretBackend resource.
|
|
38
|
-
:param pulumi.Input[
|
|
53
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
39
54
|
not begin or end with a `/`. Defaults to `kmip`.
|
|
40
|
-
:param pulumi.Input[
|
|
41
|
-
:param pulumi.Input[
|
|
42
|
-
:param pulumi.Input[
|
|
43
|
-
:param pulumi.Input[
|
|
44
|
-
:param pulumi.Input[
|
|
55
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
56
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
57
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
58
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
59
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
60
|
+
:param pulumi.Input[_builtins.int] default_tls_client_key_bits: Client certificate key bits, valid values depend on key type.
|
|
61
|
+
:param pulumi.Input[_builtins.str] default_tls_client_key_type: Client certificate key type, `rsa` or `ec`.
|
|
62
|
+
:param pulumi.Input[_builtins.int] default_tls_client_ttl: Client certificate TTL in seconds
|
|
63
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
64
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend
|
|
65
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
45
66
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
46
|
-
:param pulumi.Input[
|
|
47
|
-
:param pulumi.Input[
|
|
67
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
68
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
69
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
70
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] listen_addrs: Addresses the KMIP server should listen on (`host:port`).
|
|
71
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
72
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
73
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
74
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
48
75
|
The value should not contain leading or trailing forward slashes.
|
|
49
76
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
50
77
|
*Available only for Vault Enterprise*.
|
|
51
|
-
:param pulumi.Input[
|
|
52
|
-
:param pulumi.Input[Sequence[pulumi.Input[
|
|
53
|
-
:param pulumi.Input[
|
|
54
|
-
:param pulumi.Input[
|
|
55
|
-
:param pulumi.Input[
|
|
78
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
79
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
80
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
81
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
82
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_hostnames: Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
|
|
83
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_ips: IPs to include in the server's TLS certificate as SAN IP addresses.
|
|
84
|
+
:param pulumi.Input[_builtins.int] tls_ca_key_bits: CA key bits, valid values depend on key type.
|
|
85
|
+
:param pulumi.Input[_builtins.str] tls_ca_key_type: CA key type, rsa or ec.
|
|
86
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum TLS version to accept.
|
|
56
87
|
"""
|
|
57
88
|
pulumi.set(__self__, "path", path)
|
|
89
|
+
if allowed_managed_keys is not None:
|
|
90
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
91
|
+
if allowed_response_headers is not None:
|
|
92
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
93
|
+
if audit_non_hmac_request_keys is not None:
|
|
94
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
95
|
+
if audit_non_hmac_response_keys is not None:
|
|
96
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
97
|
+
if default_lease_ttl_seconds is not None:
|
|
98
|
+
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
58
99
|
if default_tls_client_key_bits is not None:
|
|
59
100
|
pulumi.set(__self__, "default_tls_client_key_bits", default_tls_client_key_bits)
|
|
60
101
|
if default_tls_client_key_type is not None:
|
|
61
102
|
pulumi.set(__self__, "default_tls_client_key_type", default_tls_client_key_type)
|
|
62
103
|
if default_tls_client_ttl is not None:
|
|
63
104
|
pulumi.set(__self__, "default_tls_client_ttl", default_tls_client_ttl)
|
|
105
|
+
if delegated_auth_accessors is not None:
|
|
106
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
64
107
|
if description is not None:
|
|
65
108
|
pulumi.set(__self__, "description", description)
|
|
66
109
|
if disable_remount is not None:
|
|
67
110
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
111
|
+
if external_entropy_access is not None:
|
|
112
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
113
|
+
if force_no_cache is not None:
|
|
114
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
115
|
+
if identity_token_key is not None:
|
|
116
|
+
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
68
117
|
if listen_addrs is not None:
|
|
69
118
|
pulumi.set(__self__, "listen_addrs", listen_addrs)
|
|
119
|
+
if listing_visibility is not None:
|
|
120
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
121
|
+
if local is not None:
|
|
122
|
+
pulumi.set(__self__, "local", local)
|
|
123
|
+
if max_lease_ttl_seconds is not None:
|
|
124
|
+
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
70
125
|
if namespace is not None:
|
|
71
126
|
pulumi.set(__self__, "namespace", namespace)
|
|
127
|
+
if options is not None:
|
|
128
|
+
pulumi.set(__self__, "options", options)
|
|
129
|
+
if passthrough_request_headers is not None:
|
|
130
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
131
|
+
if plugin_version is not None:
|
|
132
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
133
|
+
if seal_wrap is not None:
|
|
134
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
72
135
|
if server_hostnames is not None:
|
|
73
136
|
pulumi.set(__self__, "server_hostnames", server_hostnames)
|
|
74
137
|
if server_ips is not None:
|
|
@@ -80,9 +143,9 @@ class SecretBackendArgs:
|
|
|
80
143
|
if tls_min_version is not None:
|
|
81
144
|
pulumi.set(__self__, "tls_min_version", tls_min_version)
|
|
82
145
|
|
|
83
|
-
@property
|
|
146
|
+
@_builtins.property
|
|
84
147
|
@pulumi.getter
|
|
85
|
-
def path(self) -> pulumi.Input[
|
|
148
|
+
def path(self) -> pulumi.Input[_builtins.str]:
|
|
86
149
|
"""
|
|
87
150
|
The unique path this backend should be mounted at. Must
|
|
88
151
|
not begin or end with a `/`. Defaults to `kmip`.
|
|
@@ -90,60 +153,132 @@ class SecretBackendArgs:
|
|
|
90
153
|
return pulumi.get(self, "path")
|
|
91
154
|
|
|
92
155
|
@path.setter
|
|
93
|
-
def path(self, value: pulumi.Input[
|
|
156
|
+
def path(self, value: pulumi.Input[_builtins.str]):
|
|
94
157
|
pulumi.set(self, "path", value)
|
|
95
158
|
|
|
96
|
-
@property
|
|
159
|
+
@_builtins.property
|
|
160
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
161
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
162
|
+
"""
|
|
163
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
164
|
+
"""
|
|
165
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
166
|
+
|
|
167
|
+
@allowed_managed_keys.setter
|
|
168
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
169
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
170
|
+
|
|
171
|
+
@_builtins.property
|
|
172
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
173
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
174
|
+
"""
|
|
175
|
+
List of headers to allow and pass from the request to the plugin
|
|
176
|
+
"""
|
|
177
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
178
|
+
|
|
179
|
+
@allowed_response_headers.setter
|
|
180
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
181
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
182
|
+
|
|
183
|
+
@_builtins.property
|
|
184
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
185
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
186
|
+
"""
|
|
187
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
188
|
+
"""
|
|
189
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
190
|
+
|
|
191
|
+
@audit_non_hmac_request_keys.setter
|
|
192
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
193
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
194
|
+
|
|
195
|
+
@_builtins.property
|
|
196
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
197
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
198
|
+
"""
|
|
199
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
200
|
+
"""
|
|
201
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
202
|
+
|
|
203
|
+
@audit_non_hmac_response_keys.setter
|
|
204
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
205
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
206
|
+
|
|
207
|
+
@_builtins.property
|
|
208
|
+
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
209
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
210
|
+
"""
|
|
211
|
+
Default lease duration for tokens and secrets in seconds
|
|
212
|
+
"""
|
|
213
|
+
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
214
|
+
|
|
215
|
+
@default_lease_ttl_seconds.setter
|
|
216
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
217
|
+
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
218
|
+
|
|
219
|
+
@_builtins.property
|
|
97
220
|
@pulumi.getter(name="defaultTlsClientKeyBits")
|
|
98
|
-
def default_tls_client_key_bits(self) -> Optional[pulumi.Input[
|
|
221
|
+
def default_tls_client_key_bits(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
99
222
|
"""
|
|
100
223
|
Client certificate key bits, valid values depend on key type.
|
|
101
224
|
"""
|
|
102
225
|
return pulumi.get(self, "default_tls_client_key_bits")
|
|
103
226
|
|
|
104
227
|
@default_tls_client_key_bits.setter
|
|
105
|
-
def default_tls_client_key_bits(self, value: Optional[pulumi.Input[
|
|
228
|
+
def default_tls_client_key_bits(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
106
229
|
pulumi.set(self, "default_tls_client_key_bits", value)
|
|
107
230
|
|
|
108
|
-
@property
|
|
231
|
+
@_builtins.property
|
|
109
232
|
@pulumi.getter(name="defaultTlsClientKeyType")
|
|
110
|
-
def default_tls_client_key_type(self) -> Optional[pulumi.Input[
|
|
233
|
+
def default_tls_client_key_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
111
234
|
"""
|
|
112
235
|
Client certificate key type, `rsa` or `ec`.
|
|
113
236
|
"""
|
|
114
237
|
return pulumi.get(self, "default_tls_client_key_type")
|
|
115
238
|
|
|
116
239
|
@default_tls_client_key_type.setter
|
|
117
|
-
def default_tls_client_key_type(self, value: Optional[pulumi.Input[
|
|
240
|
+
def default_tls_client_key_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
118
241
|
pulumi.set(self, "default_tls_client_key_type", value)
|
|
119
242
|
|
|
120
|
-
@property
|
|
243
|
+
@_builtins.property
|
|
121
244
|
@pulumi.getter(name="defaultTlsClientTtl")
|
|
122
|
-
def default_tls_client_ttl(self) -> Optional[pulumi.Input[
|
|
245
|
+
def default_tls_client_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
123
246
|
"""
|
|
124
247
|
Client certificate TTL in seconds
|
|
125
248
|
"""
|
|
126
249
|
return pulumi.get(self, "default_tls_client_ttl")
|
|
127
250
|
|
|
128
251
|
@default_tls_client_ttl.setter
|
|
129
|
-
def default_tls_client_ttl(self, value: Optional[pulumi.Input[
|
|
252
|
+
def default_tls_client_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
130
253
|
pulumi.set(self, "default_tls_client_ttl", value)
|
|
131
254
|
|
|
132
|
-
@property
|
|
255
|
+
@_builtins.property
|
|
256
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
257
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
258
|
+
"""
|
|
259
|
+
List of headers to allow and pass from the request to the plugin
|
|
260
|
+
"""
|
|
261
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
262
|
+
|
|
263
|
+
@delegated_auth_accessors.setter
|
|
264
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
265
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
266
|
+
|
|
267
|
+
@_builtins.property
|
|
133
268
|
@pulumi.getter
|
|
134
|
-
def description(self) -> Optional[pulumi.Input[
|
|
269
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
135
270
|
"""
|
|
136
|
-
|
|
271
|
+
Human-friendly description of the mount for the backend
|
|
137
272
|
"""
|
|
138
273
|
return pulumi.get(self, "description")
|
|
139
274
|
|
|
140
275
|
@description.setter
|
|
141
|
-
def description(self, value: Optional[pulumi.Input[
|
|
276
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
142
277
|
pulumi.set(self, "description", value)
|
|
143
278
|
|
|
144
|
-
@property
|
|
279
|
+
@_builtins.property
|
|
145
280
|
@pulumi.getter(name="disableRemount")
|
|
146
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
281
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
147
282
|
"""
|
|
148
283
|
If set, opts out of mount migration on path updates.
|
|
149
284
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -151,24 +286,96 @@ class SecretBackendArgs:
|
|
|
151
286
|
return pulumi.get(self, "disable_remount")
|
|
152
287
|
|
|
153
288
|
@disable_remount.setter
|
|
154
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
289
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
155
290
|
pulumi.set(self, "disable_remount", value)
|
|
156
291
|
|
|
157
|
-
@property
|
|
292
|
+
@_builtins.property
|
|
293
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
294
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
295
|
+
"""
|
|
296
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
297
|
+
"""
|
|
298
|
+
return pulumi.get(self, "external_entropy_access")
|
|
299
|
+
|
|
300
|
+
@external_entropy_access.setter
|
|
301
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
302
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
303
|
+
|
|
304
|
+
@_builtins.property
|
|
305
|
+
@pulumi.getter(name="forceNoCache")
|
|
306
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
307
|
+
"""
|
|
308
|
+
If set to true, disables caching.
|
|
309
|
+
"""
|
|
310
|
+
return pulumi.get(self, "force_no_cache")
|
|
311
|
+
|
|
312
|
+
@force_no_cache.setter
|
|
313
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
314
|
+
pulumi.set(self, "force_no_cache", value)
|
|
315
|
+
|
|
316
|
+
@_builtins.property
|
|
317
|
+
@pulumi.getter(name="identityTokenKey")
|
|
318
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
319
|
+
"""
|
|
320
|
+
The key to use for signing plugin workload identity tokens
|
|
321
|
+
"""
|
|
322
|
+
return pulumi.get(self, "identity_token_key")
|
|
323
|
+
|
|
324
|
+
@identity_token_key.setter
|
|
325
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
326
|
+
pulumi.set(self, "identity_token_key", value)
|
|
327
|
+
|
|
328
|
+
@_builtins.property
|
|
158
329
|
@pulumi.getter(name="listenAddrs")
|
|
159
|
-
def listen_addrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
330
|
+
def listen_addrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
160
331
|
"""
|
|
161
332
|
Addresses the KMIP server should listen on (`host:port`).
|
|
162
333
|
"""
|
|
163
334
|
return pulumi.get(self, "listen_addrs")
|
|
164
335
|
|
|
165
336
|
@listen_addrs.setter
|
|
166
|
-
def listen_addrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
337
|
+
def listen_addrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
167
338
|
pulumi.set(self, "listen_addrs", value)
|
|
168
339
|
|
|
169
|
-
@property
|
|
340
|
+
@_builtins.property
|
|
341
|
+
@pulumi.getter(name="listingVisibility")
|
|
342
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
343
|
+
"""
|
|
344
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
345
|
+
"""
|
|
346
|
+
return pulumi.get(self, "listing_visibility")
|
|
347
|
+
|
|
348
|
+
@listing_visibility.setter
|
|
349
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
350
|
+
pulumi.set(self, "listing_visibility", value)
|
|
351
|
+
|
|
352
|
+
@_builtins.property
|
|
353
|
+
@pulumi.getter
|
|
354
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
355
|
+
"""
|
|
356
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
357
|
+
"""
|
|
358
|
+
return pulumi.get(self, "local")
|
|
359
|
+
|
|
360
|
+
@local.setter
|
|
361
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
362
|
+
pulumi.set(self, "local", value)
|
|
363
|
+
|
|
364
|
+
@_builtins.property
|
|
365
|
+
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
366
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
367
|
+
"""
|
|
368
|
+
Maximum possible lease duration for tokens and secrets in seconds
|
|
369
|
+
"""
|
|
370
|
+
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
371
|
+
|
|
372
|
+
@max_lease_ttl_seconds.setter
|
|
373
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
374
|
+
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
375
|
+
|
|
376
|
+
@_builtins.property
|
|
170
377
|
@pulumi.getter
|
|
171
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
378
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
172
379
|
"""
|
|
173
380
|
The namespace to provision the resource in.
|
|
174
381
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -178,123 +385,239 @@ class SecretBackendArgs:
|
|
|
178
385
|
return pulumi.get(self, "namespace")
|
|
179
386
|
|
|
180
387
|
@namespace.setter
|
|
181
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
388
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
182
389
|
pulumi.set(self, "namespace", value)
|
|
183
390
|
|
|
184
|
-
@property
|
|
391
|
+
@_builtins.property
|
|
392
|
+
@pulumi.getter
|
|
393
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
394
|
+
"""
|
|
395
|
+
Specifies mount type specific options that are passed to the backend
|
|
396
|
+
"""
|
|
397
|
+
return pulumi.get(self, "options")
|
|
398
|
+
|
|
399
|
+
@options.setter
|
|
400
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
401
|
+
pulumi.set(self, "options", value)
|
|
402
|
+
|
|
403
|
+
@_builtins.property
|
|
404
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
405
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
406
|
+
"""
|
|
407
|
+
List of headers to allow and pass from the request to the plugin
|
|
408
|
+
"""
|
|
409
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
410
|
+
|
|
411
|
+
@passthrough_request_headers.setter
|
|
412
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
413
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
414
|
+
|
|
415
|
+
@_builtins.property
|
|
416
|
+
@pulumi.getter(name="pluginVersion")
|
|
417
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
418
|
+
"""
|
|
419
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
420
|
+
"""
|
|
421
|
+
return pulumi.get(self, "plugin_version")
|
|
422
|
+
|
|
423
|
+
@plugin_version.setter
|
|
424
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
425
|
+
pulumi.set(self, "plugin_version", value)
|
|
426
|
+
|
|
427
|
+
@_builtins.property
|
|
428
|
+
@pulumi.getter(name="sealWrap")
|
|
429
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
430
|
+
"""
|
|
431
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
432
|
+
"""
|
|
433
|
+
return pulumi.get(self, "seal_wrap")
|
|
434
|
+
|
|
435
|
+
@seal_wrap.setter
|
|
436
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
437
|
+
pulumi.set(self, "seal_wrap", value)
|
|
438
|
+
|
|
439
|
+
@_builtins.property
|
|
185
440
|
@pulumi.getter(name="serverHostnames")
|
|
186
|
-
def server_hostnames(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
441
|
+
def server_hostnames(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
187
442
|
"""
|
|
188
443
|
Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
|
|
189
444
|
"""
|
|
190
445
|
return pulumi.get(self, "server_hostnames")
|
|
191
446
|
|
|
192
447
|
@server_hostnames.setter
|
|
193
|
-
def server_hostnames(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
448
|
+
def server_hostnames(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
194
449
|
pulumi.set(self, "server_hostnames", value)
|
|
195
450
|
|
|
196
|
-
@property
|
|
451
|
+
@_builtins.property
|
|
197
452
|
@pulumi.getter(name="serverIps")
|
|
198
|
-
def server_ips(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
453
|
+
def server_ips(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
199
454
|
"""
|
|
200
455
|
IPs to include in the server's TLS certificate as SAN IP addresses.
|
|
201
456
|
"""
|
|
202
457
|
return pulumi.get(self, "server_ips")
|
|
203
458
|
|
|
204
459
|
@server_ips.setter
|
|
205
|
-
def server_ips(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
460
|
+
def server_ips(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
206
461
|
pulumi.set(self, "server_ips", value)
|
|
207
462
|
|
|
208
|
-
@property
|
|
463
|
+
@_builtins.property
|
|
209
464
|
@pulumi.getter(name="tlsCaKeyBits")
|
|
210
|
-
def tls_ca_key_bits(self) -> Optional[pulumi.Input[
|
|
465
|
+
def tls_ca_key_bits(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
211
466
|
"""
|
|
212
467
|
CA key bits, valid values depend on key type.
|
|
213
468
|
"""
|
|
214
469
|
return pulumi.get(self, "tls_ca_key_bits")
|
|
215
470
|
|
|
216
471
|
@tls_ca_key_bits.setter
|
|
217
|
-
def tls_ca_key_bits(self, value: Optional[pulumi.Input[
|
|
472
|
+
def tls_ca_key_bits(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
218
473
|
pulumi.set(self, "tls_ca_key_bits", value)
|
|
219
474
|
|
|
220
|
-
@property
|
|
475
|
+
@_builtins.property
|
|
221
476
|
@pulumi.getter(name="tlsCaKeyType")
|
|
222
|
-
def tls_ca_key_type(self) -> Optional[pulumi.Input[
|
|
477
|
+
def tls_ca_key_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
223
478
|
"""
|
|
224
479
|
CA key type, rsa or ec.
|
|
225
480
|
"""
|
|
226
481
|
return pulumi.get(self, "tls_ca_key_type")
|
|
227
482
|
|
|
228
483
|
@tls_ca_key_type.setter
|
|
229
|
-
def tls_ca_key_type(self, value: Optional[pulumi.Input[
|
|
484
|
+
def tls_ca_key_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
230
485
|
pulumi.set(self, "tls_ca_key_type", value)
|
|
231
486
|
|
|
232
|
-
@property
|
|
487
|
+
@_builtins.property
|
|
233
488
|
@pulumi.getter(name="tlsMinVersion")
|
|
234
|
-
def tls_min_version(self) -> Optional[pulumi.Input[
|
|
489
|
+
def tls_min_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
235
490
|
"""
|
|
236
491
|
Minimum TLS version to accept.
|
|
237
492
|
"""
|
|
238
493
|
return pulumi.get(self, "tls_min_version")
|
|
239
494
|
|
|
240
495
|
@tls_min_version.setter
|
|
241
|
-
def tls_min_version(self, value: Optional[pulumi.Input[
|
|
496
|
+
def tls_min_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
242
497
|
pulumi.set(self, "tls_min_version", value)
|
|
243
498
|
|
|
244
499
|
|
|
245
500
|
@pulumi.input_type
|
|
246
501
|
class _SecretBackendState:
|
|
247
502
|
def __init__(__self__, *,
|
|
248
|
-
|
|
249
|
-
|
|
250
|
-
|
|
251
|
-
|
|
252
|
-
|
|
253
|
-
|
|
254
|
-
|
|
255
|
-
|
|
256
|
-
|
|
257
|
-
|
|
258
|
-
|
|
259
|
-
|
|
260
|
-
|
|
503
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
504
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
505
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
506
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
507
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
508
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
509
|
+
default_tls_client_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
510
|
+
default_tls_client_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
511
|
+
default_tls_client_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
512
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
513
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
514
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
515
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
516
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
517
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
518
|
+
listen_addrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
519
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
520
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
521
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
522
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
523
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
524
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
525
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
526
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
527
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
528
|
+
server_hostnames: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
529
|
+
server_ips: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
530
|
+
tls_ca_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
531
|
+
tls_ca_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
532
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None):
|
|
261
533
|
"""
|
|
262
534
|
Input properties used for looking up and filtering SecretBackend resources.
|
|
263
|
-
:param pulumi.Input[
|
|
264
|
-
:param pulumi.Input[
|
|
265
|
-
:param pulumi.Input[
|
|
266
|
-
:param pulumi.Input[
|
|
267
|
-
:param pulumi.Input[
|
|
535
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
536
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
537
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
538
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
539
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
540
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
541
|
+
:param pulumi.Input[_builtins.int] default_tls_client_key_bits: Client certificate key bits, valid values depend on key type.
|
|
542
|
+
:param pulumi.Input[_builtins.str] default_tls_client_key_type: Client certificate key type, `rsa` or `ec`.
|
|
543
|
+
:param pulumi.Input[_builtins.int] default_tls_client_ttl: Client certificate TTL in seconds
|
|
544
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
545
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend
|
|
546
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
268
547
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
269
|
-
:param pulumi.Input[
|
|
270
|
-
:param pulumi.Input[
|
|
548
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
549
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
550
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
551
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] listen_addrs: Addresses the KMIP server should listen on (`host:port`).
|
|
552
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
553
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
554
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
555
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
271
556
|
The value should not contain leading or trailing forward slashes.
|
|
272
557
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
273
558
|
*Available only for Vault Enterprise*.
|
|
274
|
-
:param pulumi.Input[
|
|
559
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
560
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
561
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
275
562
|
not begin or end with a `/`. Defaults to `kmip`.
|
|
276
|
-
:param pulumi.Input[
|
|
277
|
-
:param pulumi.Input[
|
|
278
|
-
:param pulumi.Input[
|
|
279
|
-
:param pulumi.Input[
|
|
280
|
-
:param pulumi.Input[
|
|
281
|
-
|
|
563
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
564
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
565
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_hostnames: Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
|
|
566
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_ips: IPs to include in the server's TLS certificate as SAN IP addresses.
|
|
567
|
+
:param pulumi.Input[_builtins.int] tls_ca_key_bits: CA key bits, valid values depend on key type.
|
|
568
|
+
:param pulumi.Input[_builtins.str] tls_ca_key_type: CA key type, rsa or ec.
|
|
569
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum TLS version to accept.
|
|
570
|
+
"""
|
|
571
|
+
if accessor is not None:
|
|
572
|
+
pulumi.set(__self__, "accessor", accessor)
|
|
573
|
+
if allowed_managed_keys is not None:
|
|
574
|
+
pulumi.set(__self__, "allowed_managed_keys", allowed_managed_keys)
|
|
575
|
+
if allowed_response_headers is not None:
|
|
576
|
+
pulumi.set(__self__, "allowed_response_headers", allowed_response_headers)
|
|
577
|
+
if audit_non_hmac_request_keys is not None:
|
|
578
|
+
pulumi.set(__self__, "audit_non_hmac_request_keys", audit_non_hmac_request_keys)
|
|
579
|
+
if audit_non_hmac_response_keys is not None:
|
|
580
|
+
pulumi.set(__self__, "audit_non_hmac_response_keys", audit_non_hmac_response_keys)
|
|
581
|
+
if default_lease_ttl_seconds is not None:
|
|
582
|
+
pulumi.set(__self__, "default_lease_ttl_seconds", default_lease_ttl_seconds)
|
|
282
583
|
if default_tls_client_key_bits is not None:
|
|
283
584
|
pulumi.set(__self__, "default_tls_client_key_bits", default_tls_client_key_bits)
|
|
284
585
|
if default_tls_client_key_type is not None:
|
|
285
586
|
pulumi.set(__self__, "default_tls_client_key_type", default_tls_client_key_type)
|
|
286
587
|
if default_tls_client_ttl is not None:
|
|
287
588
|
pulumi.set(__self__, "default_tls_client_ttl", default_tls_client_ttl)
|
|
589
|
+
if delegated_auth_accessors is not None:
|
|
590
|
+
pulumi.set(__self__, "delegated_auth_accessors", delegated_auth_accessors)
|
|
288
591
|
if description is not None:
|
|
289
592
|
pulumi.set(__self__, "description", description)
|
|
290
593
|
if disable_remount is not None:
|
|
291
594
|
pulumi.set(__self__, "disable_remount", disable_remount)
|
|
595
|
+
if external_entropy_access is not None:
|
|
596
|
+
pulumi.set(__self__, "external_entropy_access", external_entropy_access)
|
|
597
|
+
if force_no_cache is not None:
|
|
598
|
+
pulumi.set(__self__, "force_no_cache", force_no_cache)
|
|
599
|
+
if identity_token_key is not None:
|
|
600
|
+
pulumi.set(__self__, "identity_token_key", identity_token_key)
|
|
292
601
|
if listen_addrs is not None:
|
|
293
602
|
pulumi.set(__self__, "listen_addrs", listen_addrs)
|
|
603
|
+
if listing_visibility is not None:
|
|
604
|
+
pulumi.set(__self__, "listing_visibility", listing_visibility)
|
|
605
|
+
if local is not None:
|
|
606
|
+
pulumi.set(__self__, "local", local)
|
|
607
|
+
if max_lease_ttl_seconds is not None:
|
|
608
|
+
pulumi.set(__self__, "max_lease_ttl_seconds", max_lease_ttl_seconds)
|
|
294
609
|
if namespace is not None:
|
|
295
610
|
pulumi.set(__self__, "namespace", namespace)
|
|
611
|
+
if options is not None:
|
|
612
|
+
pulumi.set(__self__, "options", options)
|
|
613
|
+
if passthrough_request_headers is not None:
|
|
614
|
+
pulumi.set(__self__, "passthrough_request_headers", passthrough_request_headers)
|
|
296
615
|
if path is not None:
|
|
297
616
|
pulumi.set(__self__, "path", path)
|
|
617
|
+
if plugin_version is not None:
|
|
618
|
+
pulumi.set(__self__, "plugin_version", plugin_version)
|
|
619
|
+
if seal_wrap is not None:
|
|
620
|
+
pulumi.set(__self__, "seal_wrap", seal_wrap)
|
|
298
621
|
if server_hostnames is not None:
|
|
299
622
|
pulumi.set(__self__, "server_hostnames", server_hostnames)
|
|
300
623
|
if server_ips is not None:
|
|
@@ -306,57 +629,141 @@ class _SecretBackendState:
|
|
|
306
629
|
if tls_min_version is not None:
|
|
307
630
|
pulumi.set(__self__, "tls_min_version", tls_min_version)
|
|
308
631
|
|
|
309
|
-
@property
|
|
632
|
+
@_builtins.property
|
|
633
|
+
@pulumi.getter
|
|
634
|
+
def accessor(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
635
|
+
"""
|
|
636
|
+
Accessor of the mount
|
|
637
|
+
"""
|
|
638
|
+
return pulumi.get(self, "accessor")
|
|
639
|
+
|
|
640
|
+
@accessor.setter
|
|
641
|
+
def accessor(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
642
|
+
pulumi.set(self, "accessor", value)
|
|
643
|
+
|
|
644
|
+
@_builtins.property
|
|
645
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
646
|
+
def allowed_managed_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
647
|
+
"""
|
|
648
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
649
|
+
"""
|
|
650
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
651
|
+
|
|
652
|
+
@allowed_managed_keys.setter
|
|
653
|
+
def allowed_managed_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
654
|
+
pulumi.set(self, "allowed_managed_keys", value)
|
|
655
|
+
|
|
656
|
+
@_builtins.property
|
|
657
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
658
|
+
def allowed_response_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
659
|
+
"""
|
|
660
|
+
List of headers to allow and pass from the request to the plugin
|
|
661
|
+
"""
|
|
662
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
663
|
+
|
|
664
|
+
@allowed_response_headers.setter
|
|
665
|
+
def allowed_response_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
666
|
+
pulumi.set(self, "allowed_response_headers", value)
|
|
667
|
+
|
|
668
|
+
@_builtins.property
|
|
669
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
670
|
+
def audit_non_hmac_request_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
671
|
+
"""
|
|
672
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
673
|
+
"""
|
|
674
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
675
|
+
|
|
676
|
+
@audit_non_hmac_request_keys.setter
|
|
677
|
+
def audit_non_hmac_request_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
678
|
+
pulumi.set(self, "audit_non_hmac_request_keys", value)
|
|
679
|
+
|
|
680
|
+
@_builtins.property
|
|
681
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
682
|
+
def audit_non_hmac_response_keys(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
683
|
+
"""
|
|
684
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
685
|
+
"""
|
|
686
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
687
|
+
|
|
688
|
+
@audit_non_hmac_response_keys.setter
|
|
689
|
+
def audit_non_hmac_response_keys(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
690
|
+
pulumi.set(self, "audit_non_hmac_response_keys", value)
|
|
691
|
+
|
|
692
|
+
@_builtins.property
|
|
693
|
+
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
694
|
+
def default_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
695
|
+
"""
|
|
696
|
+
Default lease duration for tokens and secrets in seconds
|
|
697
|
+
"""
|
|
698
|
+
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
699
|
+
|
|
700
|
+
@default_lease_ttl_seconds.setter
|
|
701
|
+
def default_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
702
|
+
pulumi.set(self, "default_lease_ttl_seconds", value)
|
|
703
|
+
|
|
704
|
+
@_builtins.property
|
|
310
705
|
@pulumi.getter(name="defaultTlsClientKeyBits")
|
|
311
|
-
def default_tls_client_key_bits(self) -> Optional[pulumi.Input[
|
|
706
|
+
def default_tls_client_key_bits(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
312
707
|
"""
|
|
313
708
|
Client certificate key bits, valid values depend on key type.
|
|
314
709
|
"""
|
|
315
710
|
return pulumi.get(self, "default_tls_client_key_bits")
|
|
316
711
|
|
|
317
712
|
@default_tls_client_key_bits.setter
|
|
318
|
-
def default_tls_client_key_bits(self, value: Optional[pulumi.Input[
|
|
713
|
+
def default_tls_client_key_bits(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
319
714
|
pulumi.set(self, "default_tls_client_key_bits", value)
|
|
320
715
|
|
|
321
|
-
@property
|
|
716
|
+
@_builtins.property
|
|
322
717
|
@pulumi.getter(name="defaultTlsClientKeyType")
|
|
323
|
-
def default_tls_client_key_type(self) -> Optional[pulumi.Input[
|
|
718
|
+
def default_tls_client_key_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
324
719
|
"""
|
|
325
720
|
Client certificate key type, `rsa` or `ec`.
|
|
326
721
|
"""
|
|
327
722
|
return pulumi.get(self, "default_tls_client_key_type")
|
|
328
723
|
|
|
329
724
|
@default_tls_client_key_type.setter
|
|
330
|
-
def default_tls_client_key_type(self, value: Optional[pulumi.Input[
|
|
725
|
+
def default_tls_client_key_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
331
726
|
pulumi.set(self, "default_tls_client_key_type", value)
|
|
332
727
|
|
|
333
|
-
@property
|
|
728
|
+
@_builtins.property
|
|
334
729
|
@pulumi.getter(name="defaultTlsClientTtl")
|
|
335
|
-
def default_tls_client_ttl(self) -> Optional[pulumi.Input[
|
|
730
|
+
def default_tls_client_ttl(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
336
731
|
"""
|
|
337
732
|
Client certificate TTL in seconds
|
|
338
733
|
"""
|
|
339
734
|
return pulumi.get(self, "default_tls_client_ttl")
|
|
340
735
|
|
|
341
736
|
@default_tls_client_ttl.setter
|
|
342
|
-
def default_tls_client_ttl(self, value: Optional[pulumi.Input[
|
|
737
|
+
def default_tls_client_ttl(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
343
738
|
pulumi.set(self, "default_tls_client_ttl", value)
|
|
344
739
|
|
|
345
|
-
@property
|
|
740
|
+
@_builtins.property
|
|
741
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
742
|
+
def delegated_auth_accessors(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
743
|
+
"""
|
|
744
|
+
List of headers to allow and pass from the request to the plugin
|
|
745
|
+
"""
|
|
746
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
747
|
+
|
|
748
|
+
@delegated_auth_accessors.setter
|
|
749
|
+
def delegated_auth_accessors(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
750
|
+
pulumi.set(self, "delegated_auth_accessors", value)
|
|
751
|
+
|
|
752
|
+
@_builtins.property
|
|
346
753
|
@pulumi.getter
|
|
347
|
-
def description(self) -> Optional[pulumi.Input[
|
|
754
|
+
def description(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
348
755
|
"""
|
|
349
|
-
|
|
756
|
+
Human-friendly description of the mount for the backend
|
|
350
757
|
"""
|
|
351
758
|
return pulumi.get(self, "description")
|
|
352
759
|
|
|
353
760
|
@description.setter
|
|
354
|
-
def description(self, value: Optional[pulumi.Input[
|
|
761
|
+
def description(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
355
762
|
pulumi.set(self, "description", value)
|
|
356
763
|
|
|
357
|
-
@property
|
|
764
|
+
@_builtins.property
|
|
358
765
|
@pulumi.getter(name="disableRemount")
|
|
359
|
-
def disable_remount(self) -> Optional[pulumi.Input[
|
|
766
|
+
def disable_remount(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
360
767
|
"""
|
|
361
768
|
If set, opts out of mount migration on path updates.
|
|
362
769
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
@@ -364,24 +771,96 @@ class _SecretBackendState:
|
|
|
364
771
|
return pulumi.get(self, "disable_remount")
|
|
365
772
|
|
|
366
773
|
@disable_remount.setter
|
|
367
|
-
def disable_remount(self, value: Optional[pulumi.Input[
|
|
774
|
+
def disable_remount(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
368
775
|
pulumi.set(self, "disable_remount", value)
|
|
369
776
|
|
|
370
|
-
@property
|
|
777
|
+
@_builtins.property
|
|
778
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
779
|
+
def external_entropy_access(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
780
|
+
"""
|
|
781
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
782
|
+
"""
|
|
783
|
+
return pulumi.get(self, "external_entropy_access")
|
|
784
|
+
|
|
785
|
+
@external_entropy_access.setter
|
|
786
|
+
def external_entropy_access(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
787
|
+
pulumi.set(self, "external_entropy_access", value)
|
|
788
|
+
|
|
789
|
+
@_builtins.property
|
|
790
|
+
@pulumi.getter(name="forceNoCache")
|
|
791
|
+
def force_no_cache(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
792
|
+
"""
|
|
793
|
+
If set to true, disables caching.
|
|
794
|
+
"""
|
|
795
|
+
return pulumi.get(self, "force_no_cache")
|
|
796
|
+
|
|
797
|
+
@force_no_cache.setter
|
|
798
|
+
def force_no_cache(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
799
|
+
pulumi.set(self, "force_no_cache", value)
|
|
800
|
+
|
|
801
|
+
@_builtins.property
|
|
802
|
+
@pulumi.getter(name="identityTokenKey")
|
|
803
|
+
def identity_token_key(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
804
|
+
"""
|
|
805
|
+
The key to use for signing plugin workload identity tokens
|
|
806
|
+
"""
|
|
807
|
+
return pulumi.get(self, "identity_token_key")
|
|
808
|
+
|
|
809
|
+
@identity_token_key.setter
|
|
810
|
+
def identity_token_key(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
811
|
+
pulumi.set(self, "identity_token_key", value)
|
|
812
|
+
|
|
813
|
+
@_builtins.property
|
|
371
814
|
@pulumi.getter(name="listenAddrs")
|
|
372
|
-
def listen_addrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
815
|
+
def listen_addrs(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
373
816
|
"""
|
|
374
817
|
Addresses the KMIP server should listen on (`host:port`).
|
|
375
818
|
"""
|
|
376
819
|
return pulumi.get(self, "listen_addrs")
|
|
377
820
|
|
|
378
821
|
@listen_addrs.setter
|
|
379
|
-
def listen_addrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
822
|
+
def listen_addrs(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
380
823
|
pulumi.set(self, "listen_addrs", value)
|
|
381
824
|
|
|
382
|
-
@property
|
|
825
|
+
@_builtins.property
|
|
826
|
+
@pulumi.getter(name="listingVisibility")
|
|
827
|
+
def listing_visibility(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
828
|
+
"""
|
|
829
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
830
|
+
"""
|
|
831
|
+
return pulumi.get(self, "listing_visibility")
|
|
832
|
+
|
|
833
|
+
@listing_visibility.setter
|
|
834
|
+
def listing_visibility(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
835
|
+
pulumi.set(self, "listing_visibility", value)
|
|
836
|
+
|
|
837
|
+
@_builtins.property
|
|
838
|
+
@pulumi.getter
|
|
839
|
+
def local(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
840
|
+
"""
|
|
841
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
842
|
+
"""
|
|
843
|
+
return pulumi.get(self, "local")
|
|
844
|
+
|
|
845
|
+
@local.setter
|
|
846
|
+
def local(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
847
|
+
pulumi.set(self, "local", value)
|
|
848
|
+
|
|
849
|
+
@_builtins.property
|
|
850
|
+
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
851
|
+
def max_lease_ttl_seconds(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
852
|
+
"""
|
|
853
|
+
Maximum possible lease duration for tokens and secrets in seconds
|
|
854
|
+
"""
|
|
855
|
+
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
856
|
+
|
|
857
|
+
@max_lease_ttl_seconds.setter
|
|
858
|
+
def max_lease_ttl_seconds(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
859
|
+
pulumi.set(self, "max_lease_ttl_seconds", value)
|
|
860
|
+
|
|
861
|
+
@_builtins.property
|
|
383
862
|
@pulumi.getter
|
|
384
|
-
def namespace(self) -> Optional[pulumi.Input[
|
|
863
|
+
def namespace(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
385
864
|
"""
|
|
386
865
|
The namespace to provision the resource in.
|
|
387
866
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -391,12 +870,36 @@ class _SecretBackendState:
|
|
|
391
870
|
return pulumi.get(self, "namespace")
|
|
392
871
|
|
|
393
872
|
@namespace.setter
|
|
394
|
-
def namespace(self, value: Optional[pulumi.Input[
|
|
873
|
+
def namespace(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
395
874
|
pulumi.set(self, "namespace", value)
|
|
396
875
|
|
|
397
|
-
@property
|
|
876
|
+
@_builtins.property
|
|
877
|
+
@pulumi.getter
|
|
878
|
+
def options(self) -> Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]:
|
|
879
|
+
"""
|
|
880
|
+
Specifies mount type specific options that are passed to the backend
|
|
881
|
+
"""
|
|
882
|
+
return pulumi.get(self, "options")
|
|
883
|
+
|
|
884
|
+
@options.setter
|
|
885
|
+
def options(self, value: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]]):
|
|
886
|
+
pulumi.set(self, "options", value)
|
|
887
|
+
|
|
888
|
+
@_builtins.property
|
|
889
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
890
|
+
def passthrough_request_headers(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
891
|
+
"""
|
|
892
|
+
List of headers to allow and pass from the request to the plugin
|
|
893
|
+
"""
|
|
894
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
895
|
+
|
|
896
|
+
@passthrough_request_headers.setter
|
|
897
|
+
def passthrough_request_headers(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
898
|
+
pulumi.set(self, "passthrough_request_headers", value)
|
|
899
|
+
|
|
900
|
+
@_builtins.property
|
|
398
901
|
@pulumi.getter
|
|
399
|
-
def path(self) -> Optional[pulumi.Input[
|
|
902
|
+
def path(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
400
903
|
"""
|
|
401
904
|
The unique path this backend should be mounted at. Must
|
|
402
905
|
not begin or end with a `/`. Defaults to `kmip`.
|
|
@@ -404,67 +907,91 @@ class _SecretBackendState:
|
|
|
404
907
|
return pulumi.get(self, "path")
|
|
405
908
|
|
|
406
909
|
@path.setter
|
|
407
|
-
def path(self, value: Optional[pulumi.Input[
|
|
910
|
+
def path(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
408
911
|
pulumi.set(self, "path", value)
|
|
409
912
|
|
|
410
|
-
@property
|
|
913
|
+
@_builtins.property
|
|
914
|
+
@pulumi.getter(name="pluginVersion")
|
|
915
|
+
def plugin_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
916
|
+
"""
|
|
917
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
918
|
+
"""
|
|
919
|
+
return pulumi.get(self, "plugin_version")
|
|
920
|
+
|
|
921
|
+
@plugin_version.setter
|
|
922
|
+
def plugin_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
923
|
+
pulumi.set(self, "plugin_version", value)
|
|
924
|
+
|
|
925
|
+
@_builtins.property
|
|
926
|
+
@pulumi.getter(name="sealWrap")
|
|
927
|
+
def seal_wrap(self) -> Optional[pulumi.Input[_builtins.bool]]:
|
|
928
|
+
"""
|
|
929
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
930
|
+
"""
|
|
931
|
+
return pulumi.get(self, "seal_wrap")
|
|
932
|
+
|
|
933
|
+
@seal_wrap.setter
|
|
934
|
+
def seal_wrap(self, value: Optional[pulumi.Input[_builtins.bool]]):
|
|
935
|
+
pulumi.set(self, "seal_wrap", value)
|
|
936
|
+
|
|
937
|
+
@_builtins.property
|
|
411
938
|
@pulumi.getter(name="serverHostnames")
|
|
412
|
-
def server_hostnames(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
939
|
+
def server_hostnames(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
413
940
|
"""
|
|
414
941
|
Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
|
|
415
942
|
"""
|
|
416
943
|
return pulumi.get(self, "server_hostnames")
|
|
417
944
|
|
|
418
945
|
@server_hostnames.setter
|
|
419
|
-
def server_hostnames(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
946
|
+
def server_hostnames(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
420
947
|
pulumi.set(self, "server_hostnames", value)
|
|
421
948
|
|
|
422
|
-
@property
|
|
949
|
+
@_builtins.property
|
|
423
950
|
@pulumi.getter(name="serverIps")
|
|
424
|
-
def server_ips(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
951
|
+
def server_ips(self) -> Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]:
|
|
425
952
|
"""
|
|
426
953
|
IPs to include in the server's TLS certificate as SAN IP addresses.
|
|
427
954
|
"""
|
|
428
955
|
return pulumi.get(self, "server_ips")
|
|
429
956
|
|
|
430
957
|
@server_ips.setter
|
|
431
|
-
def server_ips(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[
|
|
958
|
+
def server_ips(self, value: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]]):
|
|
432
959
|
pulumi.set(self, "server_ips", value)
|
|
433
960
|
|
|
434
|
-
@property
|
|
961
|
+
@_builtins.property
|
|
435
962
|
@pulumi.getter(name="tlsCaKeyBits")
|
|
436
|
-
def tls_ca_key_bits(self) -> Optional[pulumi.Input[
|
|
963
|
+
def tls_ca_key_bits(self) -> Optional[pulumi.Input[_builtins.int]]:
|
|
437
964
|
"""
|
|
438
965
|
CA key bits, valid values depend on key type.
|
|
439
966
|
"""
|
|
440
967
|
return pulumi.get(self, "tls_ca_key_bits")
|
|
441
968
|
|
|
442
969
|
@tls_ca_key_bits.setter
|
|
443
|
-
def tls_ca_key_bits(self, value: Optional[pulumi.Input[
|
|
970
|
+
def tls_ca_key_bits(self, value: Optional[pulumi.Input[_builtins.int]]):
|
|
444
971
|
pulumi.set(self, "tls_ca_key_bits", value)
|
|
445
972
|
|
|
446
|
-
@property
|
|
973
|
+
@_builtins.property
|
|
447
974
|
@pulumi.getter(name="tlsCaKeyType")
|
|
448
|
-
def tls_ca_key_type(self) -> Optional[pulumi.Input[
|
|
975
|
+
def tls_ca_key_type(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
449
976
|
"""
|
|
450
977
|
CA key type, rsa or ec.
|
|
451
978
|
"""
|
|
452
979
|
return pulumi.get(self, "tls_ca_key_type")
|
|
453
980
|
|
|
454
981
|
@tls_ca_key_type.setter
|
|
455
|
-
def tls_ca_key_type(self, value: Optional[pulumi.Input[
|
|
982
|
+
def tls_ca_key_type(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
456
983
|
pulumi.set(self, "tls_ca_key_type", value)
|
|
457
984
|
|
|
458
|
-
@property
|
|
985
|
+
@_builtins.property
|
|
459
986
|
@pulumi.getter(name="tlsMinVersion")
|
|
460
|
-
def tls_min_version(self) -> Optional[pulumi.Input[
|
|
987
|
+
def tls_min_version(self) -> Optional[pulumi.Input[_builtins.str]]:
|
|
461
988
|
"""
|
|
462
989
|
Minimum TLS version to accept.
|
|
463
990
|
"""
|
|
464
991
|
return pulumi.get(self, "tls_min_version")
|
|
465
992
|
|
|
466
993
|
@tls_min_version.setter
|
|
467
|
-
def tls_min_version(self, value: Optional[pulumi.Input[
|
|
994
|
+
def tls_min_version(self, value: Optional[pulumi.Input[_builtins.str]]):
|
|
468
995
|
pulumi.set(self, "tls_min_version", value)
|
|
469
996
|
|
|
470
997
|
|
|
@@ -474,19 +1001,35 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
474
1001
|
def __init__(__self__,
|
|
475
1002
|
resource_name: str,
|
|
476
1003
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
477
|
-
|
|
478
|
-
|
|
479
|
-
|
|
480
|
-
|
|
481
|
-
|
|
482
|
-
|
|
483
|
-
|
|
484
|
-
|
|
485
|
-
|
|
486
|
-
|
|
487
|
-
|
|
488
|
-
|
|
489
|
-
|
|
1004
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1005
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1006
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1007
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1008
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1009
|
+
default_tls_client_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1010
|
+
default_tls_client_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1011
|
+
default_tls_client_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1012
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1013
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1014
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1015
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1016
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1017
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1018
|
+
listen_addrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1019
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1020
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1021
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1022
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1023
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1024
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1025
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1026
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1027
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1028
|
+
server_hostnames: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1029
|
+
server_ips: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1030
|
+
tls_ca_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1031
|
+
tls_ca_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1032
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
490
1033
|
__props__=None):
|
|
491
1034
|
"""
|
|
492
1035
|
Manages KMIP Secret backends in a Vault server. This feature requires
|
|
@@ -523,24 +1066,40 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
523
1066
|
|
|
524
1067
|
:param str resource_name: The name of the resource.
|
|
525
1068
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
526
|
-
:param pulumi.Input[
|
|
527
|
-
:param pulumi.Input[
|
|
528
|
-
:param pulumi.Input[
|
|
529
|
-
:param pulumi.Input[
|
|
530
|
-
:param pulumi.Input[
|
|
1069
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1070
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1071
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1072
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1073
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
1074
|
+
:param pulumi.Input[_builtins.int] default_tls_client_key_bits: Client certificate key bits, valid values depend on key type.
|
|
1075
|
+
:param pulumi.Input[_builtins.str] default_tls_client_key_type: Client certificate key type, `rsa` or `ec`.
|
|
1076
|
+
:param pulumi.Input[_builtins.int] default_tls_client_ttl: Client certificate TTL in seconds
|
|
1077
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1078
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend
|
|
1079
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
531
1080
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
532
|
-
:param pulumi.Input[
|
|
533
|
-
:param pulumi.Input[
|
|
1081
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1082
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1083
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
1084
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] listen_addrs: Addresses the KMIP server should listen on (`host:port`).
|
|
1085
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1086
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1087
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
1088
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
534
1089
|
The value should not contain leading or trailing forward slashes.
|
|
535
1090
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
536
1091
|
*Available only for Vault Enterprise*.
|
|
537
|
-
:param pulumi.Input[
|
|
1092
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1093
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1094
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
538
1095
|
not begin or end with a `/`. Defaults to `kmip`.
|
|
539
|
-
:param pulumi.Input[
|
|
540
|
-
:param pulumi.Input[
|
|
541
|
-
:param pulumi.Input[
|
|
542
|
-
:param pulumi.Input[
|
|
543
|
-
:param pulumi.Input[
|
|
1096
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1097
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1098
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_hostnames: Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
|
|
1099
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_ips: IPs to include in the server's TLS certificate as SAN IP addresses.
|
|
1100
|
+
:param pulumi.Input[_builtins.int] tls_ca_key_bits: CA key bits, valid values depend on key type.
|
|
1101
|
+
:param pulumi.Input[_builtins.str] tls_ca_key_type: CA key type, rsa or ec.
|
|
1102
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum TLS version to accept.
|
|
544
1103
|
"""
|
|
545
1104
|
...
|
|
546
1105
|
@overload
|
|
@@ -596,19 +1155,35 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
596
1155
|
def _internal_init(__self__,
|
|
597
1156
|
resource_name: str,
|
|
598
1157
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
599
|
-
|
|
600
|
-
|
|
601
|
-
|
|
602
|
-
|
|
603
|
-
|
|
604
|
-
|
|
605
|
-
|
|
606
|
-
|
|
607
|
-
|
|
608
|
-
|
|
609
|
-
|
|
610
|
-
|
|
611
|
-
|
|
1158
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1159
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1160
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1161
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1162
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1163
|
+
default_tls_client_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1164
|
+
default_tls_client_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1165
|
+
default_tls_client_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1166
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1167
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1168
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1169
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1170
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1171
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1172
|
+
listen_addrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1173
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1174
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1175
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1176
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1177
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1178
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1179
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1180
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1181
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1182
|
+
server_hostnames: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1183
|
+
server_ips: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1184
|
+
tls_ca_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1185
|
+
tls_ca_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1186
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
612
1187
|
__props__=None):
|
|
613
1188
|
opts = pulumi.ResourceOptions.merge(_utilities.get_resource_opts_defaults(), opts)
|
|
614
1189
|
if not isinstance(opts, pulumi.ResourceOptions):
|
|
@@ -618,21 +1193,38 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
618
1193
|
raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
|
|
619
1194
|
__props__ = SecretBackendArgs.__new__(SecretBackendArgs)
|
|
620
1195
|
|
|
1196
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1197
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1198
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1199
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1200
|
+
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
621
1201
|
__props__.__dict__["default_tls_client_key_bits"] = default_tls_client_key_bits
|
|
622
1202
|
__props__.__dict__["default_tls_client_key_type"] = default_tls_client_key_type
|
|
623
1203
|
__props__.__dict__["default_tls_client_ttl"] = default_tls_client_ttl
|
|
1204
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
624
1205
|
__props__.__dict__["description"] = description
|
|
625
1206
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1207
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1208
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1209
|
+
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
626
1210
|
__props__.__dict__["listen_addrs"] = listen_addrs
|
|
1211
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1212
|
+
__props__.__dict__["local"] = local
|
|
1213
|
+
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
627
1214
|
__props__.__dict__["namespace"] = namespace
|
|
1215
|
+
__props__.__dict__["options"] = options
|
|
1216
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
628
1217
|
if path is None and not opts.urn:
|
|
629
1218
|
raise TypeError("Missing required property 'path'")
|
|
630
1219
|
__props__.__dict__["path"] = path
|
|
1220
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1221
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
631
1222
|
__props__.__dict__["server_hostnames"] = server_hostnames
|
|
632
1223
|
__props__.__dict__["server_ips"] = server_ips
|
|
633
1224
|
__props__.__dict__["tls_ca_key_bits"] = tls_ca_key_bits
|
|
634
1225
|
__props__.__dict__["tls_ca_key_type"] = tls_ca_key_type
|
|
635
1226
|
__props__.__dict__["tls_min_version"] = tls_min_version
|
|
1227
|
+
__props__.__dict__["accessor"] = None
|
|
636
1228
|
super(SecretBackend, __self__).__init__(
|
|
637
1229
|
'vault:kmip/secretBackend:SecretBackend',
|
|
638
1230
|
resource_name,
|
|
@@ -643,19 +1235,36 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
643
1235
|
def get(resource_name: str,
|
|
644
1236
|
id: pulumi.Input[str],
|
|
645
1237
|
opts: Optional[pulumi.ResourceOptions] = None,
|
|
646
|
-
|
|
647
|
-
|
|
648
|
-
|
|
649
|
-
|
|
650
|
-
|
|
651
|
-
|
|
652
|
-
|
|
653
|
-
|
|
654
|
-
|
|
655
|
-
|
|
656
|
-
|
|
657
|
-
|
|
658
|
-
|
|
1238
|
+
accessor: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1239
|
+
allowed_managed_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1240
|
+
allowed_response_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1241
|
+
audit_non_hmac_request_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1242
|
+
audit_non_hmac_response_keys: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1243
|
+
default_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1244
|
+
default_tls_client_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1245
|
+
default_tls_client_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1246
|
+
default_tls_client_ttl: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1247
|
+
delegated_auth_accessors: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1248
|
+
description: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1249
|
+
disable_remount: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1250
|
+
external_entropy_access: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1251
|
+
force_no_cache: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1252
|
+
identity_token_key: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1253
|
+
listen_addrs: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1254
|
+
listing_visibility: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1255
|
+
local: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1256
|
+
max_lease_ttl_seconds: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1257
|
+
namespace: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1258
|
+
options: Optional[pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]]] = None,
|
|
1259
|
+
passthrough_request_headers: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1260
|
+
path: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1261
|
+
plugin_version: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1262
|
+
seal_wrap: Optional[pulumi.Input[_builtins.bool]] = None,
|
|
1263
|
+
server_hostnames: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1264
|
+
server_ips: Optional[pulumi.Input[Sequence[pulumi.Input[_builtins.str]]]] = None,
|
|
1265
|
+
tls_ca_key_bits: Optional[pulumi.Input[_builtins.int]] = None,
|
|
1266
|
+
tls_ca_key_type: Optional[pulumi.Input[_builtins.str]] = None,
|
|
1267
|
+
tls_min_version: Optional[pulumi.Input[_builtins.str]] = None) -> 'SecretBackend':
|
|
659
1268
|
"""
|
|
660
1269
|
Get an existing SecretBackend resource's state with the given name, id, and optional extra
|
|
661
1270
|
properties used to qualify the lookup.
|
|
@@ -663,37 +1272,71 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
663
1272
|
:param str resource_name: The unique name of the resulting resource.
|
|
664
1273
|
:param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
|
|
665
1274
|
:param pulumi.ResourceOptions opts: Options for the resource.
|
|
666
|
-
:param pulumi.Input[
|
|
667
|
-
:param pulumi.Input[
|
|
668
|
-
:param pulumi.Input[
|
|
669
|
-
:param pulumi.Input[
|
|
670
|
-
:param pulumi.Input[
|
|
1275
|
+
:param pulumi.Input[_builtins.str] accessor: Accessor of the mount
|
|
1276
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_managed_keys: List of managed key registry entry names that the mount in question is allowed to access
|
|
1277
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] allowed_response_headers: List of headers to allow and pass from the request to the plugin
|
|
1278
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_request_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1279
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] audit_non_hmac_response_keys: Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1280
|
+
:param pulumi.Input[_builtins.int] default_lease_ttl_seconds: Default lease duration for tokens and secrets in seconds
|
|
1281
|
+
:param pulumi.Input[_builtins.int] default_tls_client_key_bits: Client certificate key bits, valid values depend on key type.
|
|
1282
|
+
:param pulumi.Input[_builtins.str] default_tls_client_key_type: Client certificate key type, `rsa` or `ec`.
|
|
1283
|
+
:param pulumi.Input[_builtins.int] default_tls_client_ttl: Client certificate TTL in seconds
|
|
1284
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] delegated_auth_accessors: List of headers to allow and pass from the request to the plugin
|
|
1285
|
+
:param pulumi.Input[_builtins.str] description: Human-friendly description of the mount for the backend
|
|
1286
|
+
:param pulumi.Input[_builtins.bool] disable_remount: If set, opts out of mount migration on path updates.
|
|
671
1287
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
672
|
-
:param pulumi.Input[
|
|
673
|
-
:param pulumi.Input[
|
|
1288
|
+
:param pulumi.Input[_builtins.bool] external_entropy_access: Enable the secrets engine to access Vault's external entropy source
|
|
1289
|
+
:param pulumi.Input[_builtins.bool] force_no_cache: If set to true, disables caching.
|
|
1290
|
+
:param pulumi.Input[_builtins.str] identity_token_key: The key to use for signing plugin workload identity tokens
|
|
1291
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] listen_addrs: Addresses the KMIP server should listen on (`host:port`).
|
|
1292
|
+
:param pulumi.Input[_builtins.str] listing_visibility: Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1293
|
+
:param pulumi.Input[_builtins.bool] local: Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1294
|
+
:param pulumi.Input[_builtins.int] max_lease_ttl_seconds: Maximum possible lease duration for tokens and secrets in seconds
|
|
1295
|
+
:param pulumi.Input[_builtins.str] namespace: The namespace to provision the resource in.
|
|
674
1296
|
The value should not contain leading or trailing forward slashes.
|
|
675
1297
|
The `namespace` is always relative to the provider's configured [namespace](https://www.terraform.io/docs/providers/vault/index.html#namespace).
|
|
676
1298
|
*Available only for Vault Enterprise*.
|
|
677
|
-
:param pulumi.Input[
|
|
1299
|
+
:param pulumi.Input[Mapping[str, pulumi.Input[_builtins.str]]] options: Specifies mount type specific options that are passed to the backend
|
|
1300
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] passthrough_request_headers: List of headers to allow and pass from the request to the plugin
|
|
1301
|
+
:param pulumi.Input[_builtins.str] path: The unique path this backend should be mounted at. Must
|
|
678
1302
|
not begin or end with a `/`. Defaults to `kmip`.
|
|
679
|
-
:param pulumi.Input[
|
|
680
|
-
:param pulumi.Input[
|
|
681
|
-
:param pulumi.Input[
|
|
682
|
-
:param pulumi.Input[
|
|
683
|
-
:param pulumi.Input[
|
|
1303
|
+
:param pulumi.Input[_builtins.str] plugin_version: Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1304
|
+
:param pulumi.Input[_builtins.bool] seal_wrap: Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1305
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_hostnames: Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
|
|
1306
|
+
:param pulumi.Input[Sequence[pulumi.Input[_builtins.str]]] server_ips: IPs to include in the server's TLS certificate as SAN IP addresses.
|
|
1307
|
+
:param pulumi.Input[_builtins.int] tls_ca_key_bits: CA key bits, valid values depend on key type.
|
|
1308
|
+
:param pulumi.Input[_builtins.str] tls_ca_key_type: CA key type, rsa or ec.
|
|
1309
|
+
:param pulumi.Input[_builtins.str] tls_min_version: Minimum TLS version to accept.
|
|
684
1310
|
"""
|
|
685
1311
|
opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))
|
|
686
1312
|
|
|
687
1313
|
__props__ = _SecretBackendState.__new__(_SecretBackendState)
|
|
688
1314
|
|
|
1315
|
+
__props__.__dict__["accessor"] = accessor
|
|
1316
|
+
__props__.__dict__["allowed_managed_keys"] = allowed_managed_keys
|
|
1317
|
+
__props__.__dict__["allowed_response_headers"] = allowed_response_headers
|
|
1318
|
+
__props__.__dict__["audit_non_hmac_request_keys"] = audit_non_hmac_request_keys
|
|
1319
|
+
__props__.__dict__["audit_non_hmac_response_keys"] = audit_non_hmac_response_keys
|
|
1320
|
+
__props__.__dict__["default_lease_ttl_seconds"] = default_lease_ttl_seconds
|
|
689
1321
|
__props__.__dict__["default_tls_client_key_bits"] = default_tls_client_key_bits
|
|
690
1322
|
__props__.__dict__["default_tls_client_key_type"] = default_tls_client_key_type
|
|
691
1323
|
__props__.__dict__["default_tls_client_ttl"] = default_tls_client_ttl
|
|
1324
|
+
__props__.__dict__["delegated_auth_accessors"] = delegated_auth_accessors
|
|
692
1325
|
__props__.__dict__["description"] = description
|
|
693
1326
|
__props__.__dict__["disable_remount"] = disable_remount
|
|
1327
|
+
__props__.__dict__["external_entropy_access"] = external_entropy_access
|
|
1328
|
+
__props__.__dict__["force_no_cache"] = force_no_cache
|
|
1329
|
+
__props__.__dict__["identity_token_key"] = identity_token_key
|
|
694
1330
|
__props__.__dict__["listen_addrs"] = listen_addrs
|
|
1331
|
+
__props__.__dict__["listing_visibility"] = listing_visibility
|
|
1332
|
+
__props__.__dict__["local"] = local
|
|
1333
|
+
__props__.__dict__["max_lease_ttl_seconds"] = max_lease_ttl_seconds
|
|
695
1334
|
__props__.__dict__["namespace"] = namespace
|
|
1335
|
+
__props__.__dict__["options"] = options
|
|
1336
|
+
__props__.__dict__["passthrough_request_headers"] = passthrough_request_headers
|
|
696
1337
|
__props__.__dict__["path"] = path
|
|
1338
|
+
__props__.__dict__["plugin_version"] = plugin_version
|
|
1339
|
+
__props__.__dict__["seal_wrap"] = seal_wrap
|
|
697
1340
|
__props__.__dict__["server_hostnames"] = server_hostnames
|
|
698
1341
|
__props__.__dict__["server_ips"] = server_ips
|
|
699
1342
|
__props__.__dict__["tls_ca_key_bits"] = tls_ca_key_bits
|
|
@@ -701,58 +1344,162 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
701
1344
|
__props__.__dict__["tls_min_version"] = tls_min_version
|
|
702
1345
|
return SecretBackend(resource_name, opts=opts, __props__=__props__)
|
|
703
1346
|
|
|
704
|
-
@property
|
|
1347
|
+
@_builtins.property
|
|
1348
|
+
@pulumi.getter
|
|
1349
|
+
def accessor(self) -> pulumi.Output[_builtins.str]:
|
|
1350
|
+
"""
|
|
1351
|
+
Accessor of the mount
|
|
1352
|
+
"""
|
|
1353
|
+
return pulumi.get(self, "accessor")
|
|
1354
|
+
|
|
1355
|
+
@_builtins.property
|
|
1356
|
+
@pulumi.getter(name="allowedManagedKeys")
|
|
1357
|
+
def allowed_managed_keys(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1358
|
+
"""
|
|
1359
|
+
List of managed key registry entry names that the mount in question is allowed to access
|
|
1360
|
+
"""
|
|
1361
|
+
return pulumi.get(self, "allowed_managed_keys")
|
|
1362
|
+
|
|
1363
|
+
@_builtins.property
|
|
1364
|
+
@pulumi.getter(name="allowedResponseHeaders")
|
|
1365
|
+
def allowed_response_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1366
|
+
"""
|
|
1367
|
+
List of headers to allow and pass from the request to the plugin
|
|
1368
|
+
"""
|
|
1369
|
+
return pulumi.get(self, "allowed_response_headers")
|
|
1370
|
+
|
|
1371
|
+
@_builtins.property
|
|
1372
|
+
@pulumi.getter(name="auditNonHmacRequestKeys")
|
|
1373
|
+
def audit_non_hmac_request_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1374
|
+
"""
|
|
1375
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the request data object.
|
|
1376
|
+
"""
|
|
1377
|
+
return pulumi.get(self, "audit_non_hmac_request_keys")
|
|
1378
|
+
|
|
1379
|
+
@_builtins.property
|
|
1380
|
+
@pulumi.getter(name="auditNonHmacResponseKeys")
|
|
1381
|
+
def audit_non_hmac_response_keys(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
1382
|
+
"""
|
|
1383
|
+
Specifies the list of keys that will not be HMAC'd by audit devices in the response data object.
|
|
1384
|
+
"""
|
|
1385
|
+
return pulumi.get(self, "audit_non_hmac_response_keys")
|
|
1386
|
+
|
|
1387
|
+
@_builtins.property
|
|
1388
|
+
@pulumi.getter(name="defaultLeaseTtlSeconds")
|
|
1389
|
+
def default_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
1390
|
+
"""
|
|
1391
|
+
Default lease duration for tokens and secrets in seconds
|
|
1392
|
+
"""
|
|
1393
|
+
return pulumi.get(self, "default_lease_ttl_seconds")
|
|
1394
|
+
|
|
1395
|
+
@_builtins.property
|
|
705
1396
|
@pulumi.getter(name="defaultTlsClientKeyBits")
|
|
706
|
-
def default_tls_client_key_bits(self) -> pulumi.Output[
|
|
1397
|
+
def default_tls_client_key_bits(self) -> pulumi.Output[_builtins.int]:
|
|
707
1398
|
"""
|
|
708
1399
|
Client certificate key bits, valid values depend on key type.
|
|
709
1400
|
"""
|
|
710
1401
|
return pulumi.get(self, "default_tls_client_key_bits")
|
|
711
1402
|
|
|
712
|
-
@property
|
|
1403
|
+
@_builtins.property
|
|
713
1404
|
@pulumi.getter(name="defaultTlsClientKeyType")
|
|
714
|
-
def default_tls_client_key_type(self) -> pulumi.Output[
|
|
1405
|
+
def default_tls_client_key_type(self) -> pulumi.Output[_builtins.str]:
|
|
715
1406
|
"""
|
|
716
1407
|
Client certificate key type, `rsa` or `ec`.
|
|
717
1408
|
"""
|
|
718
1409
|
return pulumi.get(self, "default_tls_client_key_type")
|
|
719
1410
|
|
|
720
|
-
@property
|
|
1411
|
+
@_builtins.property
|
|
721
1412
|
@pulumi.getter(name="defaultTlsClientTtl")
|
|
722
|
-
def default_tls_client_ttl(self) -> pulumi.Output[
|
|
1413
|
+
def default_tls_client_ttl(self) -> pulumi.Output[_builtins.int]:
|
|
723
1414
|
"""
|
|
724
1415
|
Client certificate TTL in seconds
|
|
725
1416
|
"""
|
|
726
1417
|
return pulumi.get(self, "default_tls_client_ttl")
|
|
727
1418
|
|
|
728
|
-
@property
|
|
1419
|
+
@_builtins.property
|
|
1420
|
+
@pulumi.getter(name="delegatedAuthAccessors")
|
|
1421
|
+
def delegated_auth_accessors(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1422
|
+
"""
|
|
1423
|
+
List of headers to allow and pass from the request to the plugin
|
|
1424
|
+
"""
|
|
1425
|
+
return pulumi.get(self, "delegated_auth_accessors")
|
|
1426
|
+
|
|
1427
|
+
@_builtins.property
|
|
729
1428
|
@pulumi.getter
|
|
730
|
-
def description(self) -> pulumi.Output[Optional[
|
|
1429
|
+
def description(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
731
1430
|
"""
|
|
732
|
-
|
|
1431
|
+
Human-friendly description of the mount for the backend
|
|
733
1432
|
"""
|
|
734
1433
|
return pulumi.get(self, "description")
|
|
735
1434
|
|
|
736
|
-
@property
|
|
1435
|
+
@_builtins.property
|
|
737
1436
|
@pulumi.getter(name="disableRemount")
|
|
738
|
-
def disable_remount(self) -> pulumi.Output[Optional[
|
|
1437
|
+
def disable_remount(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
739
1438
|
"""
|
|
740
1439
|
If set, opts out of mount migration on path updates.
|
|
741
1440
|
See here for more info on [Mount Migration](https://www.vaultproject.io/docs/concepts/mount-migration)
|
|
742
1441
|
"""
|
|
743
1442
|
return pulumi.get(self, "disable_remount")
|
|
744
1443
|
|
|
745
|
-
@property
|
|
1444
|
+
@_builtins.property
|
|
1445
|
+
@pulumi.getter(name="externalEntropyAccess")
|
|
1446
|
+
def external_entropy_access(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1447
|
+
"""
|
|
1448
|
+
Enable the secrets engine to access Vault's external entropy source
|
|
1449
|
+
"""
|
|
1450
|
+
return pulumi.get(self, "external_entropy_access")
|
|
1451
|
+
|
|
1452
|
+
@_builtins.property
|
|
1453
|
+
@pulumi.getter(name="forceNoCache")
|
|
1454
|
+
def force_no_cache(self) -> pulumi.Output[_builtins.bool]:
|
|
1455
|
+
"""
|
|
1456
|
+
If set to true, disables caching.
|
|
1457
|
+
"""
|
|
1458
|
+
return pulumi.get(self, "force_no_cache")
|
|
1459
|
+
|
|
1460
|
+
@_builtins.property
|
|
1461
|
+
@pulumi.getter(name="identityTokenKey")
|
|
1462
|
+
def identity_token_key(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1463
|
+
"""
|
|
1464
|
+
The key to use for signing plugin workload identity tokens
|
|
1465
|
+
"""
|
|
1466
|
+
return pulumi.get(self, "identity_token_key")
|
|
1467
|
+
|
|
1468
|
+
@_builtins.property
|
|
746
1469
|
@pulumi.getter(name="listenAddrs")
|
|
747
|
-
def listen_addrs(self) -> pulumi.Output[Sequence[
|
|
1470
|
+
def listen_addrs(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
748
1471
|
"""
|
|
749
1472
|
Addresses the KMIP server should listen on (`host:port`).
|
|
750
1473
|
"""
|
|
751
1474
|
return pulumi.get(self, "listen_addrs")
|
|
752
1475
|
|
|
753
|
-
@property
|
|
1476
|
+
@_builtins.property
|
|
1477
|
+
@pulumi.getter(name="listingVisibility")
|
|
1478
|
+
def listing_visibility(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1479
|
+
"""
|
|
1480
|
+
Specifies whether to show this mount in the UI-specific listing endpoint
|
|
1481
|
+
"""
|
|
1482
|
+
return pulumi.get(self, "listing_visibility")
|
|
1483
|
+
|
|
1484
|
+
@_builtins.property
|
|
1485
|
+
@pulumi.getter
|
|
1486
|
+
def local(self) -> pulumi.Output[Optional[_builtins.bool]]:
|
|
1487
|
+
"""
|
|
1488
|
+
Local mount flag that can be explicitly set to true to enforce local mount in HA environment
|
|
1489
|
+
"""
|
|
1490
|
+
return pulumi.get(self, "local")
|
|
1491
|
+
|
|
1492
|
+
@_builtins.property
|
|
1493
|
+
@pulumi.getter(name="maxLeaseTtlSeconds")
|
|
1494
|
+
def max_lease_ttl_seconds(self) -> pulumi.Output[_builtins.int]:
|
|
1495
|
+
"""
|
|
1496
|
+
Maximum possible lease duration for tokens and secrets in seconds
|
|
1497
|
+
"""
|
|
1498
|
+
return pulumi.get(self, "max_lease_ttl_seconds")
|
|
1499
|
+
|
|
1500
|
+
@_builtins.property
|
|
754
1501
|
@pulumi.getter
|
|
755
|
-
def namespace(self) -> pulumi.Output[Optional[
|
|
1502
|
+
def namespace(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
756
1503
|
"""
|
|
757
1504
|
The namespace to provision the resource in.
|
|
758
1505
|
The value should not contain leading or trailing forward slashes.
|
|
@@ -761,50 +1508,82 @@ class SecretBackend(pulumi.CustomResource):
|
|
|
761
1508
|
"""
|
|
762
1509
|
return pulumi.get(self, "namespace")
|
|
763
1510
|
|
|
764
|
-
@property
|
|
1511
|
+
@_builtins.property
|
|
1512
|
+
@pulumi.getter
|
|
1513
|
+
def options(self) -> pulumi.Output[Optional[Mapping[str, _builtins.str]]]:
|
|
1514
|
+
"""
|
|
1515
|
+
Specifies mount type specific options that are passed to the backend
|
|
1516
|
+
"""
|
|
1517
|
+
return pulumi.get(self, "options")
|
|
1518
|
+
|
|
1519
|
+
@_builtins.property
|
|
1520
|
+
@pulumi.getter(name="passthroughRequestHeaders")
|
|
1521
|
+
def passthrough_request_headers(self) -> pulumi.Output[Optional[Sequence[_builtins.str]]]:
|
|
1522
|
+
"""
|
|
1523
|
+
List of headers to allow and pass from the request to the plugin
|
|
1524
|
+
"""
|
|
1525
|
+
return pulumi.get(self, "passthrough_request_headers")
|
|
1526
|
+
|
|
1527
|
+
@_builtins.property
|
|
765
1528
|
@pulumi.getter
|
|
766
|
-
def path(self) -> pulumi.Output[
|
|
1529
|
+
def path(self) -> pulumi.Output[_builtins.str]:
|
|
767
1530
|
"""
|
|
768
1531
|
The unique path this backend should be mounted at. Must
|
|
769
1532
|
not begin or end with a `/`. Defaults to `kmip`.
|
|
770
1533
|
"""
|
|
771
1534
|
return pulumi.get(self, "path")
|
|
772
1535
|
|
|
773
|
-
@property
|
|
1536
|
+
@_builtins.property
|
|
1537
|
+
@pulumi.getter(name="pluginVersion")
|
|
1538
|
+
def plugin_version(self) -> pulumi.Output[Optional[_builtins.str]]:
|
|
1539
|
+
"""
|
|
1540
|
+
Specifies the semantic version of the plugin to use, e.g. 'v1.0.0'
|
|
1541
|
+
"""
|
|
1542
|
+
return pulumi.get(self, "plugin_version")
|
|
1543
|
+
|
|
1544
|
+
@_builtins.property
|
|
1545
|
+
@pulumi.getter(name="sealWrap")
|
|
1546
|
+
def seal_wrap(self) -> pulumi.Output[_builtins.bool]:
|
|
1547
|
+
"""
|
|
1548
|
+
Enable seal wrapping for the mount, causing values stored by the mount to be wrapped by the seal's encryption capability
|
|
1549
|
+
"""
|
|
1550
|
+
return pulumi.get(self, "seal_wrap")
|
|
1551
|
+
|
|
1552
|
+
@_builtins.property
|
|
774
1553
|
@pulumi.getter(name="serverHostnames")
|
|
775
|
-
def server_hostnames(self) -> pulumi.Output[Sequence[
|
|
1554
|
+
def server_hostnames(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
776
1555
|
"""
|
|
777
1556
|
Hostnames to include in the server's TLS certificate as SAN DNS names. The first will be used as the common name (CN).
|
|
778
1557
|
"""
|
|
779
1558
|
return pulumi.get(self, "server_hostnames")
|
|
780
1559
|
|
|
781
|
-
@property
|
|
1560
|
+
@_builtins.property
|
|
782
1561
|
@pulumi.getter(name="serverIps")
|
|
783
|
-
def server_ips(self) -> pulumi.Output[Sequence[
|
|
1562
|
+
def server_ips(self) -> pulumi.Output[Sequence[_builtins.str]]:
|
|
784
1563
|
"""
|
|
785
1564
|
IPs to include in the server's TLS certificate as SAN IP addresses.
|
|
786
1565
|
"""
|
|
787
1566
|
return pulumi.get(self, "server_ips")
|
|
788
1567
|
|
|
789
|
-
@property
|
|
1568
|
+
@_builtins.property
|
|
790
1569
|
@pulumi.getter(name="tlsCaKeyBits")
|
|
791
|
-
def tls_ca_key_bits(self) -> pulumi.Output[
|
|
1570
|
+
def tls_ca_key_bits(self) -> pulumi.Output[_builtins.int]:
|
|
792
1571
|
"""
|
|
793
1572
|
CA key bits, valid values depend on key type.
|
|
794
1573
|
"""
|
|
795
1574
|
return pulumi.get(self, "tls_ca_key_bits")
|
|
796
1575
|
|
|
797
|
-
@property
|
|
1576
|
+
@_builtins.property
|
|
798
1577
|
@pulumi.getter(name="tlsCaKeyType")
|
|
799
|
-
def tls_ca_key_type(self) -> pulumi.Output[
|
|
1578
|
+
def tls_ca_key_type(self) -> pulumi.Output[_builtins.str]:
|
|
800
1579
|
"""
|
|
801
1580
|
CA key type, rsa or ec.
|
|
802
1581
|
"""
|
|
803
1582
|
return pulumi.get(self, "tls_ca_key_type")
|
|
804
1583
|
|
|
805
|
-
@property
|
|
1584
|
+
@_builtins.property
|
|
806
1585
|
@pulumi.getter(name="tlsMinVersion")
|
|
807
|
-
def tls_min_version(self) -> pulumi.Output[
|
|
1586
|
+
def tls_min_version(self) -> pulumi.Output[_builtins.str]:
|
|
808
1587
|
"""
|
|
809
1588
|
Minimum TLS version to accept.
|
|
810
1589
|
"""
|