TDEConfig v1.9.0 custom resource definition

Select a documentation version:

Spec schema

TdeConfigSpec defines the selected state of TDEConfig.

kekUrlRef:
  key: string
  name: string
  optional: boolean
kmsProvider:
  ciphertrust:
    authType: string
    credentialsSecretRef:
      name: string
  vault:
    authMount: string
    authType: string
    jwt:
      pathRef:
        key: string
        name: string
        optional: boolean
      role: string
tls:
  certSecret:
    name: string

Field

Type
Required or optional

 

Description
kekUrlRef
object
Required 		KekUrlRef is a reference to the Key Encryption Key (KEK) URL stored in a ConfigMap.
kekUrlRef.key
string
Required 		The key to select.
kekUrlRef.name
string
Optional 		Name of the referent. For more information, see Names.
kekUrlRef.optional
boolean
Optional 		Specify whether the ConfigMap or its key must be defined.
kmsProvider
object
Required 		KmsProvider specifies the Key Management Server (such as Vault or CipherTrust) that hosts encryption keys.
kmsProvider.ciphertrust
object
Optional 		CipherTrust specifies the Thales CipherTrust Manager provider.
kmsProvider.ciphertrust.authType
string
Required 		Authentication method. The only accepted value is password.
kmsProvider.ciphertrust.credentialsSecretRef
object
Required 		CredentialsSecretRef references a Secret in the same namespace that contains the username and password for CipherTrust authentication. The Secret must contain the username and password keys.
kmsProvider.ciphertrust.credentialsSecretRef.name
string
Optional 		Name of the referent. For more information, see Names.
kmsProvider.vault
object
Optional 		Vault specifies the Hashicorp Vault provider.
kmsProvider.vault.authMount
string
Required 		Path on the Vault server where the authentication engine is mounted.
kmsProvider.vault.authType
string
Required 		Authentication method. The only accepted value is jwt.
kmsProvider.vault.jwt
object
Required 		JWT specifies the JWT authentication method.
kmsProvider.vault.jwt.pathRef
object
Required 		PathRef is a reference to the path to the JWT token on the host stored in a ConfigMap.
kmsProvider.vault.jwt.pathRef.key
string
Required 		The key to select.
kmsProvider.vault.jwt.pathRef.name
string
Optional 		Name of the referent. For more information, see Names.
kmsProvider.vault.jwt.pathRef.optional
boolean
Optional 		Specify whether the ConfigMap or its key must be defined.
kmsProvider.vault.jwt.role
string
Optional 		Role is the role for JWT authentication.
tls
object
Optional 		Certificate Secret for encrypted communication between AlloyDB Omni and the Key Management Server (such as Vault or CipherTrust).
tls.certSecret
object
Optional 		CertSecret references the certificate Secret within the same namespace. The Secret must contain the ca.crt (CA certificate), tls.key (private key), and tls.crt (leaf certificate) keys.
tls.certSecret.name
string
Optional 		Name of the referent. For more information, see Names.