venafi-connection API referencePreview

The URL to connect to the Venafi TPP instance. The two URLs https://tpp.example.com and https://tpp.example.com/vedsdk are equivalent. The ending /vedsdk is optional and is stripped out by venafi-connection-lib.

The list of steps to retrieve a TPP access token.

HashicorpVaultOAuth is a SecretSource that relies on a prior SecretSource step to provide an OAuth token, which this step uses to authenticate to Vault. The output of this step is a Vault token. This step allows you to use the step HashicorpVaultSecret afterwards.

HashicorpVaultSecret is a SecretSource step that requires a Vault token in the previous step, either using a step HashicorpVaultOAuth or Secret. It then fetches the requested secrets from Vault for use in the next step.

Secret is a SecretSource step meant to be the first step. It retrieves secret values from a Kubernetes Secret, and passes them to the next step.

ServiceAccountToken is a SecretSource step meant to be the first step. It uses the Kubernetes TokenRequest API to retrieve a token for a given service account, and passes it to the next step.

TPPOAuth is a SecretSource step that authenticates to a TPP server. This step is meant to be the last step and requires a prior step that depends on the authInputType.

AuthInputType is the authentication method to be used to authenticate with HashiCorp Vault. The only supported value is "OIDC".

Enum: OIDC

The login URL used for obtaining the Vault token. Example: "https://vault:8200/v1/auth/oidc/login".

The role defined in Vault that we want to use when authenticating to Vault.

ClientID is the clientId used to authenticate with Hashicorp Vault.

Default: cert-manager.io

The URL to connect to your HashiCorp Vault instance.

The fields are Vault keys pointing to the secrets passed to the next SecretSource step. Example 1 (TPP, username and password): imagining that you have stored the username and password for TPP under the keys "username" and "password", you will want to set this field to ["username", "password"]. The username is expected to be given first, the password second.

The full HTTP path to the secret in Vault. Example: /v1/secret/data/application-team-a/tpp-username-password

The URL to connect to your HashiCorp Vault instance.

The names of the fields we want to extract from the Kubernetes secret. These fields are passed to the next step in the chain.

The name of the Kubernetes secret.

Audiences are the intendend audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.

The name of the Kubernetes service account.

ExpirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.

Format: int64

AuthInputType is the authentication method to be used to authenticate with TPP. The supported values are "UsernamePassword" and "JWT".

Enum: UsernamePassword, JWT

ClientID is the clientId used to authenticate with TPP.

Default: cert-manager.io

The URL to connect to the Venafi TPP instance. The two URLs https://tpp.example.com and https://tpp.example.com/vedsdk are equivalent. The ending /vedsdk is optional and is stripped out by our client.

The list of steps to retrieve the API key that will be used to connect to Vaas.

The URL to connect to the Venafi VaaS instance. If not set, the default value https://api.venafi.cloud/v1/ is used.

HashicorpVaultOAuth is a SecretSource that relies on a prior SecretSource step to provide an OAuth token, which this step uses to authenticate to Vault. The output of this step is a Vault token. This step allows you to use the step HashicorpVaultSecret afterwards.

HashicorpVaultSecret is a SecretSource step that requires a Vault token in the previous step, either using a step HashicorpVaultOAuth or Secret. It then fetches the requested secrets from Vault for use in the next step.

Secret is a SecretSource step meant to be the first step. It retrieves secret values from a Kubernetes Secret, and passes them to the next step.

ServiceAccountToken is a SecretSource step meant to be the first step. It uses the Kubernetes TokenRequest API to retrieve a token for a given service account, and passes it to the next step.

TPPOAuth is a SecretSource step that authenticates to a TPP server. This step is meant to be the last step and requires a prior step that depends on the authInputType.

AuthInputType is the authentication method to be used to authenticate with HashiCorp Vault. The only supported value is "OIDC".

Enum: OIDC

The login URL used for obtaining the Vault token. Example: "https://vault:8200/v1/auth/oidc/login".

The role defined in Vault that we want to use when authenticating to Vault.

ClientID is the clientId used to authenticate with Hashicorp Vault.

Default: cert-manager.io

The URL to connect to your HashiCorp Vault instance.

The fields are Vault keys pointing to the secrets passed to the next SecretSource step. Example 1 (TPP, username and password): imagining that you have stored the username and password for TPP under the keys "username" and "password", you will want to set this field to ["username", "password"]. The username is expected to be given first, the password second.

The full HTTP path to the secret in Vault. Example: /v1/secret/data/application-team-a/tpp-username-password

The URL to connect to your HashiCorp Vault instance.

The names of the fields we want to extract from the Kubernetes secret. These fields are passed to the next step in the chain.

The name of the Kubernetes secret.

Audiences are the intendend audiences of the token. A recipient of a token must identify themself with an identifier in the list of audiences of the token, and otherwise should reject the token. A token issued for multiple audiences may be used to authenticate against any of the audiences listed but implies a high degree of trust between the target audiences.

The name of the Kubernetes service account.

ExpirationSeconds is the requested duration of validity of the request. The token issuer may return a token with a different validity duration so a client needs to check the 'expiration' field in a response.

Format: int64

AuthInputType is the authentication method to be used to authenticate with TPP. The supported values are "UsernamePassword" and "JWT".

Enum: UsernamePassword, JWT

ClientID is the clientId used to authenticate with TPP.

Default: cert-manager.io

The URL to connect to the Venafi TPP instance. The two URLs https://tpp.example.com and https://tpp.example.com/vedsdk are equivalent. The ending /vedsdk is optional and is stripped out by our client.

List of status conditions to indicate the status of a VenafiConnection.

Status of the condition, one of (True, False, Unknown).

Type of the condition, should be a combination of the unique name of the operator and the type of condition. eg. VenafiEnhancedIssuerReady

LastTransitionTime is the timestamp corresponding to the last status change of this condition.

Format: date-time

Message is a human readable description of the details of the last transition, complementing reason.

If set, this represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.condition[x].observedGeneration is 9, the condition is out of date with respect to the current state of the Issuer.

Format: int64

Reason is a brief machine readable explanation for the condition's last transition.

The ValidUntil time of the token used to authenticate with the Venafi Control Plane server.

Format: date-time