@@ -256,16 +256,54 @@ spec:
256256 a controller level fallback for when KustomizationSpec.ServiceAccountName
257257 is empty.
258258properties :
259+ configMapRef :
260+ description : |-
261+ ConfigMapRef holds an optional name of a ConfigMap that contains
262+ the following keys:
263+
264+ - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
265+ `generic`. Required.
266+ - `cluster`: the fully qualified resource name of the Kubernetes
267+ cluster in the cloud provider API. Not used by the `generic`
268+ provider. Required when one of `address` or `ca.crt` is not set.
269+ - `address`: the address of the Kubernetes API server. Required
270+ for `generic`. For the other providers, if not specified, the
271+ first address in the cluster resource will be used, and if
272+ specified, it must match one of the addresses in the cluster
273+ resource.
274+ If audiences is not set, will be used as the audience for the
275+ `generic` provider.
276+ - `ca.crt`: the optional PEM-encoded CA certificate for the
277+ Kubernetes API server. If not set, the controller will use the
278+ CA certificate from the cluster resource.
279+ - `audiences`: the optional audiences as a list of
280+ line-break-separated strings for the Kubernetes ServiceAccount
281+ token. Defaults to the `address` for the `generic` provider, or
282+ to specific values for the other providers depending on the
283+ provider.
284+ - `serviceAccountName`: the optional name of the Kubernetes
285+ ServiceAccount in the same namespace that should be used
286+ for authentication. If not specified, the controller
287+ ServiceAccount will be used.
288+
289+ Mutually exclusive with SecretRef.
290+ properties :
291+ name :
292+ description : Name of the referent.
293+ type : string
294+ required :
295+ - name
296+ type : object
259297 secretRef :
260298 description : |-
261- SecretRef holds the name of a secret that contains a key with
299+ SecretRef holds an optional name of a secret that contains a key with
262300 the kubeconfig file as the value. If no key is set, the key will default
263- to 'value'.
301+ to 'value'. Mutually exclusive with ConfigMapRef.
264302 It is recommended that the kubeconfig is self-contained, and the secret
265303 is regularly updated if credentials such as a cloud-access-token expire.
266304 Cloud specific `cmd-path` auth helpers will not function without adding
267305 binaries and credentials to the Pod that is responsible for reconciling
268- Kubernetes resources.
306+ Kubernetes resources. Supported only for the generic provider.
269307properties :
270308 key :
271309 description : Key in the Secret, when not specified an implementation-specific
@@ -277,9 +315,14 @@ spec:
277315 required :
278316 - name
279317 type : object
280- required :
281- - secretRef
282318 type : object
319+ x-kubernetes-validations :
320+ - message : exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
321+ must be specified
322+ rule : has(self.configMapRef) || has(self.secretRef)
323+ - message : exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
324+ must be specified
325+ rule : ' !has(self.configMapRef) || !has(self.secretRef)'
283326 namePrefix :
284327 description : NamePrefix will prefix the names of all managed resources.
285328 maxLength : 200
@@ -1347,16 +1390,54 @@ spec:
13471390 a controller level fallback for when KustomizationSpec.ServiceAccountName
13481391 is empty.
13491392properties :
1393+ configMapRef :
1394+ description : |-
1395+ ConfigMapRef holds an optional name of a ConfigMap that contains
1396+ the following keys:
1397+
1398+ - `provider`: the provider to use. One of `aws`, `azure`, `gcp`, or
1399+ `generic`. Required.
1400+ - `cluster`: the fully qualified resource name of the Kubernetes
1401+ cluster in the cloud provider API. Not used by the `generic`
1402+ provider. Required when one of `address` or `ca.crt` is not set.
1403+ - `address`: the address of the Kubernetes API server. Required
1404+ for `generic`. For the other providers, if not specified, the
1405+ first address in the cluster resource will be used, and if
1406+ specified, it must match one of the addresses in the cluster
1407+ resource.
1408+ If audiences is not set, will be used as the audience for the
1409+ `generic` provider.
1410+ - `ca.crt`: the optional PEM-encoded CA certificate for the
1411+ Kubernetes API server. If not set, the controller will use the
1412+ CA certificate from the cluster resource.
1413+ - `audiences`: the optional audiences as a list of
1414+ line-break-separated strings for the Kubernetes ServiceAccount
1415+ token. Defaults to the `address` for the `generic` provider, or
1416+ to specific values for the other providers depending on the
1417+ provider.
1418+ - `serviceAccountName`: the optional name of the Kubernetes
1419+ ServiceAccount in the same namespace that should be used
1420+ for authentication. If not specified, the controller
1421+ ServiceAccount will be used.
1422+
1423+ Mutually exclusive with SecretRef.
1424+ properties :
1425+ name :
1426+ description : Name of the referent.
1427+ type : string
1428+ required :
1429+ - name
1430+ type : object
13501431 secretRef :
13511432 description : |-
1352- SecretRef holds the name of a secret that contains a key with
1433+ SecretRef holds an optional name of a secret that contains a key with
13531434 the kubeconfig file as the value. If no key is set, the key will default
1354- to 'value'.
1435+ to 'value'. Mutually exclusive with ConfigMapRef.
13551436 It is recommended that the kubeconfig is self-contained, and the secret
13561437 is regularly updated if credentials such as a cloud-access-token expire.
13571438 Cloud specific `cmd-path` auth helpers will not function without adding
13581439 binaries and credentials to the Pod that is responsible for reconciling
1359- Kubernetes resources.
1440+ Kubernetes resources. Supported only for the generic provider.
13601441properties :
13611442 key :
13621443 description : Key in the Secret, when not specified an implementation-specific
@@ -1368,9 +1449,14 @@ spec:
13681449 required :
13691450 - name
13701451 type : object
1371- required :
1372- - secretRef
13731452 type : object
1453+ x-kubernetes-validations :
1454+ - message : exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
1455+ must be specified
1456+ rule : has(self.configMapRef) || has(self.secretRef)
1457+ - message : exactly one of spec.kubeConfig.configMapRef or spec.kubeConfig.secretRef
1458+ must be specified
1459+ rule : ' !has(self.configMapRef) || !has(self.secretRef)'
13741460 patches :
13751461 description : |-
13761462 Strategic merge and JSON patches, defined as inline YAML objects,
0 commit comments