{ "description": "SecretManagerSecretVersion is the Schema for the SecretManagerSecretVersion API", "properties": { "apiVersion": { "description": "APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources", "type": "string" }, "kind": { "description": "Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds", "type": "string" }, "metadata": { "type": "object" }, "spec": { "description": "SecretManagerSecretVersionSpec defines the desired state of SecretManagerSecretVersion", "properties": { "deletionPolicy": { "description": "DEPRECATED. You do not need to set this field in direct reconciler mode. Use delete-policy annotation instead. https://cloud.google.com/config-connector/docs/how-to/managing-deleting-resources#keeping_resources_after_deletion The deletion policy for the secret version. Setting 'ABANDON' allows the resource to be abandoned rather than deleted. Setting 'DISABLE' allows the resource to be disabled rather than deleted. Default is 'DELETE'. Possible values are: * DELETE * DISABLE * ABANDON.", "type": "string" }, "enabled": { "description": "Should enable or disable the current SecretVersion. - Enabled version can be accessed and described. - Disabled version cannot be accessed, but the secret's contents still exist", "type": "boolean" }, "isSecretDataBase64": { "description": "DEPRECATED. You do not need to set this field in direct reconciler mode.", "type": "boolean" }, "resourceID": { "description": "The SecretVersion number. If given, Config Connector acquires the resource from the Secret Manager service. If not given, Config Connector adds a new secret version\u00a0to the GCP service, and you can find out the version number from `status.observedState.version`", "type": "string" }, "secretData": { "description": "The actual secret data. Config Connector supports secret data stored in Kubernetes secret or plain data (base64)", "properties": { "value": { "description": "Value of the field. Cannot be used if 'valueFrom' is specified.", "type": "string" }, "valueFrom": { "description": "Source for the field's value. Cannot be used if 'value' is specified.", "properties": { "secretKeyRef": { "description": "Reference to a value with the given key in the given Secret in the resource's namespace.", "properties": { "key": { "description": "Key that identifies the value to be extracted.", "type": "string" }, "name": { "description": "Name of the Secret to extract a value from.", "type": "string" } }, "required": [ "key", "name" ], "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "secretRef": { "description": "The resource name of the [Secret][google.cloud.secretmanager.v1.Secret] to create a [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] for.", "oneOf": [ { "not": { "required": [ "external" ] }, "required": [ "name" ] }, { "not": { "anyOf": [ { "required": [ "name" ] }, { "required": [ "namespace" ] } ] }, "required": [ "external" ] } ], "properties": { "external": { "description": "A reference to an externally managed SecretManagerSecret resource. Should be in the format \"projects/{{projectID}}/locations/{{location}}/secrets/{{secretID}}\".", "type": "string" }, "name": { "description": "The name of a SecretManagerSecret resource.", "type": "string" }, "namespace": { "description": "The namespace of a SecretManagerSecret resource.", "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "status": { "description": "SecretManagerSecretVersionStatus defines the config connector machine state of SecretManagerSecretVersion", "properties": { "conditions": { "description": "Conditions represent the latest available observations of the object's current state.", "items": { "properties": { "lastTransitionTime": { "description": "Last time the condition transitioned from one status to another.", "type": "string" }, "message": { "description": "Human-readable message indicating details about last transition.", "type": "string" }, "reason": { "description": "Unique, one-word, CamelCase reason for the condition's last transition.", "type": "string" }, "status": { "description": "Status is the status of the condition. Can be True, False, Unknown.", "type": "string" }, "type": { "description": "Type is the type of the condition.", "type": "string" } }, "type": "object", "additionalProperties": false }, "type": "array" }, "createTime": { "description": "DEPRECATING NOTE: Please use status.observedState.createTime instead.", "type": "string" }, "destroyTime": { "description": "DEPRECATING NOTE: Please use status.observedState.destroyTime instead.", "type": "string" }, "externalRef": { "description": "A unique specifier for the SecretManagerSecretVersion resource in GCP.", "type": "string" }, "name": { "description": "DEPRECATING NOTE: Please use status.observedState.name instead.", "type": "string" }, "observedGeneration": { "description": "ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.", "format": "int64", "type": "integer" }, "observedState": { "description": "ObservedState is the state of the resource as most recently observed in GCP.", "properties": { "clientSpecifiedPayloadChecksum": { "description": "Output only. True if payload checksum specified in [SecretPayload][google.cloud.secretmanager.v1.SecretPayload] object has been received by [SecretManagerService][google.cloud.secretmanager.v1.SecretManagerService] on [SecretManagerService.AddSecretVersion][google.cloud.secretmanager.v1.SecretManagerService.AddSecretVersion].", "type": "boolean" }, "createTime": { "description": "Output only. The time at which the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] was created.", "type": "string" }, "customerManagedEncryption": { "description": "Output only. The customer-managed encryption status of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion]. Only populated if customer-managed encryption is used and [Secret][google.cloud.secretmanager.v1.Secret] is a Regionalised Secret.", "properties": { "kmsKeyVersionName": { "description": "Required. The resource name of the Cloud KMS CryptoKeyVersion used to encrypt the secret payload, in the following format: `projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/*`.", "type": "string" } }, "type": "object", "additionalProperties": false }, "destroyTime": { "description": "Output only. The time this [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] was destroyed. Only present if [state][google.cloud.secretmanager.v1.SecretVersion.state] is [DESTROYED][google.cloud.secretmanager.v1.SecretVersion.State.DESTROYED].", "type": "string" }, "name": { "description": "Output only. The resource name of the\n[SecretVersion][google.cloud.secretmanager.v1.SecretVersion] in the\nformat `projects/*/secrets/*/versions/*`.\n\n[SecretVersion][google.cloud.secretmanager.v1.SecretVersion] IDs in a\n[Secret][google.cloud.secretmanager.v1.Secret] start at 1 and are\nincremented for each subsequent version of the secret.", "type": "string" }, "replicationStatus": { "description": "The replication status of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion].", "properties": { "automatic": { "description": "Describes the replication status of a\n [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] with\n automatic replication.\n\n Only populated if the parent\n [Secret][google.cloud.secretmanager.v1.Secret] has an automatic\n replication policy.", "properties": { "customerManagedEncryption": { "description": "Output only. The customer-managed encryption status of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion]. Only populated if customer-managed encryption is used.", "properties": { "kmsKeyVersionName": { "description": "Required. The resource name of the Cloud KMS CryptoKeyVersion used to encrypt the secret payload, in the following format: `projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/*`.", "type": "string" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "userManaged": { "description": "Describes the replication status of a\n [SecretVersion][google.cloud.secretmanager.v1.SecretVersion] with\n user-managed replication.\n\n Only populated if the parent\n [Secret][google.cloud.secretmanager.v1.Secret] has a user-managed\n replication policy.", "properties": { "replicas": { "description": "Output only. The list of replica statuses for the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion].", "items": { "properties": { "customerManagedEncryption": { "description": "Output only. The customer-managed encryption status of the [SecretVersion][google.cloud.secretmanager.v1.SecretVersion]. Only populated if customer-managed encryption is used.", "properties": { "kmsKeyVersionName": { "description": "Required. The resource name of the Cloud KMS CryptoKeyVersion used to encrypt the secret payload, in the following format: `projects/*/locations/*/keyRings/*/cryptoKeys/*/versions/*`.", "type": "string" } }, "type": "object", "additionalProperties": false }, "location": { "description": "Output only. The canonical ID of the replica location. For example: `\"us-east1\"`.", "type": "string" } }, "type": "object", "additionalProperties": false }, "type": "array" } }, "type": "object", "additionalProperties": false } }, "type": "object", "additionalProperties": false }, "scheduledDestroyTime": { "description": "Optional. Output only. Scheduled destroy time for secret version. This is a part of the Delayed secret version destroy feature. For a Secret with a valid version destroy TTL, when a secert version is destroyed, the version is moved to disabled state and it is scheduled for destruction. The version is destroyed only after the `scheduled_destroy_time`.", "type": "string" } }, "type": "object", "additionalProperties": false }, "version": { "description": "DEPRECATED.", "type": "string" } }, "type": "object", "additionalProperties": false } }, "required": [ "spec" ], "type": "object" }