---
apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    controller-gen.kubebuilder.io/version: v0.3.0
    meta.helm.sh/release-name: vault-secrets-operator
    meta.helm.sh/release-namespace: kube-system
  labels:
    app.kubernetes.io/managed-by: Helm
  name: vaultsecrets.ricoberger.de
spec:
  group: ricoberger.de
  names:
    kind: VaultSecret
    listKind: VaultSecretList
    plural: vaultsecrets
    singular: vaultsecret
  scope: Namespaced
  versions:
    - name: v1alpha1
      schema:
        openAPIV3Schema:
          description: VaultSecret is the Schema for the vaultsecrets API
          properties:
            apiVersion:
              description:
                "APIVersion defines the versioned schema of this representation
                of an object. Servers should convert recognized schemas to the latest
                internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources"
              type: string
            kind:
              description:
                "Kind is a string value representing the REST resource this
                object represents. Servers may infer this from the endpoint the client
                submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds"
              type: string
            metadata:
              type: object
            spec:
              description: VaultSecretSpec defines the desired state of VaultSecret
              properties:
                isBinary:
                  description:
                    isBinary is a flag indicates if data stored in vault
                    is binary data. Since vault does not store binary data natively,
                    the binary data is stored as base64 encoded. However, same data
                    get encoded again when operator stored them as secret in k8s which
                    caused the data to get double encoded. This flag will skip the base64
                    encode which is needed for string data to avoid the double encode
                    problem.
                  type: boolean
                keys:
                  description:
                    Keys is an array of Keys, which should be included in
                    the Kubernetes secret. If the Keys field is ommitted all keys from
                    the Vault secret will be included in the Kubernetes secret.
                  items:
                    type: string
                  type: array
                path:
                  description: Path is the path of the corresponding secret in Vault.
                  type: string
                reconcileStrategy:
                  description:
                    ReconcileStrategy defines the strategy for reconcilation.
                    The default value is "Replace", which replaces any existing data
                    keys in a secret with the loaded keys from Vault. The second valid
                    value is "Merge" wiche merges the loaded keys from Vault with the
                    existing keys in a secret. Duplicated keys will be replaced with
                    the value from Vault. Other values are not valid for this field.
                  type: string
                secretEngine:
                  description:
                    SecretEngine specifies the type of the Vault secret engine
                    in which the secret is stored. Currently the 'KV Secrets Engine
                    - Version 1' and 'KV Secrets Engine - Version 2' are supported.
                    The value must be 'kv'. If the value is omitted or an other values
                    is used the Vault Secrets Operator will try to use the KV secret
                    engine.
                  type: string
                templates:
                  additionalProperties:
                    type: string
                  description:
                    Templates, if not empty will be run through the the Go
                    templating engine, with `.Secrets` being mapped to the list of secrets
                    received from Vault. When omitted set, all secrets will be added
                    as key/val pairs under Secret.data.
                  type: object
                type:
                  description:
                    Type is the type of the Kubernetes secret, which will
                    be created by the Vault Secrets Operator.
                  type: string
                vaultRole:
                  description:
                    VaultRole can be used to specify the Vault role, which
                    should be used to get the secret from Vault. If the vaultRole property
                    is set a new client with the specified Vault Role will be created
                    and the shared client is ignored. If the operator is configured
                    using the token auth method this property has no effect.
                  type: string
                version:
                  description:
                    Version sets the version of the secret which should be
                    used. The version is only used if the KVv2 secret engine is used.
                    If the version is omitted the Operator uses the latest version of
                    the secret. If the version omitted and the VAULT_RECONCILIATION_TIME
                    environment variable is set, the Kubernetes secret will be updated
                    if the Vault secret changes.
                  type: integer
              required:
                - path
                - type
              type: object
            status:
              description: VaultSecretStatus defines the observed state of VaultSecret
              type: object
          type: object
      served: true
      storage: true
      subresources:
        status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
