{ "description": "SecretManagerSecret is the Schema for the SecretManagerSecret API", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "SecretManagerSecretSpec defines the desired state of SecretManagerSecret", "properties": { "annotations": { "additionalProperties": { "type": "string" }, "description": "Optional. Custom metadata about the secret.\n\n Annotations are distinct from various forms of labels.\n Annotations exist to allow client tools to store their own state\n information without requiring a database.\n\n Annotation keys must be between 1 and 63 characters long, have a UTF-8\n encoding of maximum 128 bytes, begin and end with an alphanumeric character\n ([a-z0-9A-Z]), and may have dashes (-), underscores (_), dots (.), and\n alphanumerics in between these symbols.\n\n The total size of annotation keys and values must be less than 16KiB.", "type": "object" }, "expireTime": { "description": "Optional. Timestamp in UTC when the [Secret][google.cloud.secretmanager.v1.Secret] is scheduled to expire. This is always provided on output, regardless of what was sent on input.", "type": "string" }, "labels": { "additionalProperties": { "type": "string" }, "description": "The labels assigned to this Secret.\n\nLabel keys must be between 1 and 63 characters long, have a UTF-8 encoding\nof maximum 128 bytes, and must conform to the following PCRE regular\nexpression: `[\\p{Ll}\\p{Lo}][\\p{Ll}\\p{Lo}\\p{N}_-]{0,62}`\n\nLabel values must be between 0 and 63 characters long, have a UTF-8\nencoding of maximum 128 bytes, and must conform to the following PCRE\nregular expression: `[\\p{Ll}\\p{Lo}\\p{N}_-]{0,63}`\n\nNo more than 64 labels can be assigned to a given resource.", "type": "object" }, "replication": { "description": "Optional. Immutable. The replication policy of the secret data attached to\n the [Secret][google.cloud.secretmanager.v1.Secret].\n\n The replication policy cannot be changed after the Secret has been created.", "properties": { "auto": { "description": "The [Secret][google.cloud.secretmanager.v1.Secret] will automatically be replicated without any restrictions.", "properties": { "customerManagedEncryption": { "description": "Optional. The customer-managed encryption configuration of the\n [Secret][google.cloud.secretmanager.v1.Secret]. If no configuration is\n provided, Google-managed default encryption is used.\n\n Updates to the [Secret][google.cloud.secretmanager.v1.Secret] encryption\n configuration only apply to\n [SecretVersions][google.cloud.secretmanager.v1.SecretVersion] added\n afterwards. They do not apply retroactively to existing\n [SecretVersions][google.cloud.secretmanager.v1.SecretVersion].", "properties": { "kmsKeyRef": { "description": "Required. The resource name of the Cloud KMS CryptoKey used to encrypt\n secret payloads.\n\n For secrets using the\n [UserManaged][google.cloud.secretmanager.v1.Replication.UserManaged]\n replication policy type, Cloud KMS CryptoKeys must reside in the same\n location as the [replica location][Secret.UserManaged.Replica.location].\n\n For secrets using the\n [Automatic][google.cloud.secretmanager.v1.Replication.Automatic]\n replication policy type, Cloud KMS CryptoKeys must reside in `global`.\n\n The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`.", "oneOf": [ { "not": { "required": [ "external" ] }, "required": [ "name" ] }, { "not": { "anyOf": [ { "required": [ "name" ] }, { "required": [ "namespace" ] } ] }, "required": [ "external" ] } ], "properties": { "external": { "description": "A reference to an externally managed KMSCryptoKey. Should be in the format `projects/[kms_project_id]/locations/[region]/keyRings/[key_ring_id]/cryptoKeys/[key]`.", "type": "string" }, "name": { "description": "The `name` of a `KMSCryptoKey` resource.", "type": "string" }, "namespace": { "description": "The `namespace` of a `KMSCryptoKey` resource.", "type": "string" } }, "type": "object", "additionalProperties": false } }, "required": [ "kmsKeyRef" ], "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "automatic": { "description": "The Secret will automatically be replicated without any restrictions.", "type": "boolean" }, "userManaged": { "description": "The [Secret][google.cloud.secretmanager.v1.Secret] will only be replicated into the locations specified.", "properties": { "replicas": { "description": "Required. The list of Replicas for this\n [Secret][google.cloud.secretmanager.v1.Secret].\n\n Cannot be empty.", "items": { "properties": { "customerManagedEncryption": { "description": "Optional. The customer-managed encryption configuration of the\n [User-Managed Replica][Replication.UserManaged.Replica]. If no\n configuration is provided, Google-managed default encryption is used.\n\n Updates to the [Secret][google.cloud.secretmanager.v1.Secret]\n encryption configuration only apply to\n [SecretVersions][google.cloud.secretmanager.v1.SecretVersion] added\n afterwards. They do not apply retroactively to existing\n [SecretVersions][google.cloud.secretmanager.v1.SecretVersion].", "properties": { "kmsKeyRef": { "description": "Required. The resource name of the Cloud KMS CryptoKey used to encrypt\n secret payloads.\n\n For secrets using the\n [UserManaged][google.cloud.secretmanager.v1.Replication.UserManaged]\n replication policy type, Cloud KMS CryptoKeys must reside in the same\n location as the [replica location][Secret.UserManaged.Replica.location].\n\n For secrets using the\n [Automatic][google.cloud.secretmanager.v1.Replication.Automatic]\n replication policy type, Cloud KMS CryptoKeys must reside in `global`.\n\n The expected format is `projects/*/locations/*/keyRings/*/cryptoKeys/*`.", "oneOf": [ { "not": { "required": [ "external" ] }, "required": [ "name" ] }, { "not": { "anyOf": [ { "required": [ "name" ] }, { "required": [ "namespace" ] } ] }, "required": [ "external" ] } ], "properties": { "external": { "description": "A reference to an externally managed KMSCryptoKey. Should be in the format `projects/[kms_project_id]/locations/[region]/keyRings/[key_ring_id]/cryptoKeys/[key]`.", "type": "string" }, "name": { "description": "The `name` of a `KMSCryptoKey` resource.", "type": "string" }, "namespace": { "description": "The `namespace` of a `KMSCryptoKey` resource.", "type": "string" } }, "type": "object", "additionalProperties": false } }, "required": [ "kmsKeyRef" ], "type": "object", "additionalProperties": false }, "location": { "description": "The canonical IDs of the location to replicate data. For example: `\"us-east1\"`.", "type": "string" } }, "required": [ "location" ], "type": "object", "additionalProperties": false }, "type": "array" } }, "required": [ "replicas" ], "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "resourceID": { "description": "The SecretManagerSecret name. If not given, the metadata.name will be used.", "type": "string" }, "rotation": { "description": "Optional. Rotation policy attached to the [Secret][google.cloud.secretmanager.v1.Secret]. May be excluded if there is no rotation policy.", "properties": { "nextRotationTime": { "description": "Optional. Timestamp in UTC at which the\n [Secret][google.cloud.secretmanager.v1.Secret] is scheduled to rotate.\n Cannot be set to less than 300s (5 min) in the future and at most\n 3153600000s (100 years).\n\n [next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time]\n MUST be set if\n [rotation_period][google.cloud.secretmanager.v1.Rotation.rotation_period]\n is set.", "type": "string" }, "rotationPeriod": { "description": "Input only. The Duration between rotation notifications. Must be in seconds\n and at least 3600s (1h) and at most 3153600000s (100 years).\n\n If\n [rotation_period][google.cloud.secretmanager.v1.Rotation.rotation_period]\n is set,\n [next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time]\n must be set.\n [next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time]\n will be advanced by this period when the service automatically sends\n rotation notifications.", "type": "string" } }, "type": "object", "additionalProperties": false }, "topics": { "description": "Optional. A list of up to 10 Pub/Sub topics to which messages are published when control plane operations are called on the secret or its versions.", "items": { "properties": { "topicRef": { "description": "PubSubTopicRef defines the resource reference to PubSubTopic, which \"External\" field holds the GCP identifier for the KRM object.", "oneOf": [ { "not": { "required": [ "external" ] }, "required": [ "name" ] }, { "not": { "anyOf": [ { "required": [ "name" ] }, { "required": [ "namespace" ] } ] }, "required": [ "external" ] } ], "properties": { "external": { "description": "A reference to an externally managed PubSubTopic resource. Should be in the format \"projects/{{projectID}}/topics/{{topicID}}\".", "type": "string" }, "name": { "description": "The name of a PubSubTopic resource.", "type": "string" }, "namespace": { "description": "The namespace of a PubSubTopic resource.", "type": "string" } }, "type": "object", "additionalProperties": false } }, "required": [ "topicRef" ], "type": "object", "additionalProperties": false }, "type": "array" }, "ttl": { "description": "Input only. A duration in seconds with up to nine fractional digits, ending with 's'. Example: \"3.5s\".", "type": "string" }, "versionAliases": { "additionalProperties": { "type": "string" }, "description": "Optional. Mapping from version alias to version name.\n\n A version alias is a string with a maximum length of 63 characters and can\n contain uppercase and lowercase letters, numerals, and the hyphen (`-`)\n and underscore ('_') characters. An alias string must start with a\n letter and cannot be the string 'latest' or 'NEW'.\n No more than 50 aliases can be assigned to a given secret.\n\n Version-Alias pairs will be viewable via GetSecret and modifiable via\n UpdateSecret. Access by alias is only be supported on\n GetSecretVersion and AccessSecretVersion.", "type": "object" } }, "type": "object", "additionalProperties": false }, "status": { "description": "SecretManagerSecretStatus defines the config connector machine state of SecretManagerSecret", "properties": { "conditions": { "description": "Conditions represent the latest available observations of the object's current state.", "items": { "properties": { "lastTransitionTime": { "description": "Last time the condition transitioned from one status to another.", "type": "string" }, "message": { "description": "Human-readable message indicating details about last transition.", "type": "string" }, "reason": { "description": "Unique, one-word, CamelCase reason for the condition's last transition.", "type": "string" }, "status": { "description": "Status is the status of the condition. Can be True, False, Unknown.", "type": "string" }, "type": { "description": "Type is the type of the condition.", "type": "string" } }, "type": "object", "additionalProperties": false }, "type": "array" }, "externalRef": { "description": "A unique specifier for the SecretManagerSecret resource in GCP.", "type": "string" }, "name": { "description": "[DEPRECATED] Please read from `.status.externalRef` instead. Config Connector will remove the `.status.name` in v1 Version.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.", "format": "int64", "type": "integer" }, "observedState": { "description": "ObservedState is the state of the resource as most recently observed in GCP.", "properties": { "versionAliases": { "additionalProperties": { "type": "string" }, "type": "object" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false } }, "type": "object" }