apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  name: vaultsecrets.ricoberger.de
spec:
  group: ricoberger.de
  names:
    kind: VaultSecret
    listKind: VaultSecretList
    plural: vaultsecrets
    singular: vaultsecret
  scope: Namespaced
  versions:
  - name: v1alpha1
    schema:
      openAPIV3Schema:
        description: VaultSecret is the Schema for the vaultsecrets API
        properties:
          apiVersion:
            description: 'APIVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
            type: string
          kind:
            description: 'Kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            description: VaultSecretSpec defines the desired state of VaultSecret
            properties:
              isBinary:
                description: isBinary is a flag indicates if data stored in vault
                  is binary data. Since vault does not store binary data natively,
                  the binary data is stored as base64 encoded. However, same data
                  get encoded again when operator stored them as secret in k8s which
                  caused the data to get double encoded. This flag will skip the base64
                  encode which is needed for string data to avoid the double encode
                  problem.
                type: boolean
              keys:
                description: Keys is an array of Keys, which should be included in
                  the Kubernetes secret. If the Keys field is ommitted all keys from
                  the Vault secret will be included in the Kubernetes secret.
                items:
                  type: string
                type: array
              path:
                description: Path is the path of the corresponding secret in Vault.
                type: string
              reconcileStrategy:
                description: ReconcileStrategy defines the strategy for reconcilation.
                  The default value is "Replace", which replaces any existing data
                  keys in a secret with the loaded keys from Vault. The second valid
                  value is "Merge" wiche merges the loaded keys from Vault with the
                  existing keys in a secret. Duplicated keys will be replaced with
                  the value from Vault. Other values are not valid for this field.
                type: string
              secretEngine:
                description: SecretEngine specifies the type of the Vault secret engine
                  in which the secret is stored. Currently the 'KV Secrets Engine
                  - Version 1' and 'KV Secrets Engine - Version 2' are supported.
                  The value must be 'kv'. If the value is omitted or an other values
                  is used the Vault Secrets Operator will try to use the KV secret
                  engine.
                type: string
              type:
                description: Type is the type of the Kubernetes secret, which will
                  be created by the Vault Secrets Operator.
                type: string
              version:
                description: Version sets the version of the secret which should be
                  used. The version is only used if the KVv2 secret engine is used.
                  If the version is omitted the Operator uses the latest version of
                  the secret. If the version omitted and the VAULT_RECONCILIATION_TIME
                  environment variable is set, the Kubernetes secret will be updated
                  if the Vault secret changes.
                type: integer
            required:
            - path
            - type
            type: object
          status:
            description: VaultSecretStatus defines the observed state of VaultSecret
            type: object
        type: object
    served: true
    storage: true
    subresources:
      status: {}
