v1

package
v1.6.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 29, 2026 License: BSD-3-Clause Imports: 9 Imported by: 0

Documentation

Overview

Package v1 contains API Schema definitions for the github v1 API group +kubebuilder:object:generate=true +groupName=github.as-code.io

Index

Constants

View Source 
const (
	// ConditionTypeReady is used to signal whether a reconciliation has completed successfully.
	ConditionTypeReady = "Ready"

	// ConditionTypeKeyValid is set on an App when spec.validateKey is true and
	// reports the outcome of the signer's key validation. Absent when
	// spec.validateKey is false.
	ConditionTypeKeyValid = "KeyValid"

	// ConditionTypeExtraDataDegraded is an abnormal-true (kstatus-style)
	// condition: set True when spec.secret.extraData did not resolve in full
	// on the last reconcile — reason ReservedKeysIgnored when sources define
	// keys reserved by the operator-managed credential, KeysMissing when
	// optional listed keys are absent, or SourceUnavailable while the managed
	// Secret serves last-known-good extraData because a required source
	// cannot be read. Absent when extraData resolves cleanly or none is
	// configured.
	ConditionTypeExtraDataDegraded = "ExtraDataDegraded"

	// ReasonAppNotFound indicates the referenced App does not exist.
	ReasonAppNotFound = "AppNotFound"
	// ReasonAppNotReady indicates the referenced App exists but its Ready
	// condition is not True.
	ReasonAppNotReady = "AppNotReady"
	// ReasonNoStartupConfig indicates no spec.appRef was set and the operator
	// has no startup GitHub App configuration.
	ReasonNoStartupConfig = "NoStartupConfig"
	// ReasonReconciled indicates a successful reconciliation.
	ReasonReconciled = "Reconciled"
	// ReasonSetupFailed indicates construction of the GitHub App client failed.
	ReasonSetupFailed = "SetupFailed"
	// ReasonSecretNotFound indicates the Secret named by App.spec.keyRef
	// could not be fetched (typically NotFound).
	ReasonSecretNotFound = "SecretNotFound"
	// ReasonInvalidKey indicates the resolved key material is missing,
	// empty, or not a usable PEM-encoded RSA private key.
	ReasonInvalidKey = "InvalidKey"

	// ReasonKeysMissing indicates optional extraData keys were absent from
	// their source and skipped.
	ReasonKeysMissing = "KeysMissing"
	// ReasonReservedKeysIgnored indicates extraData sources defined keys
	// reserved by the operator-managed credential, which were ignored.
	ReasonReservedKeysIgnored = "ReservedKeysIgnored"
	// ReasonSourceUnavailable indicates a required extraData source could not
	// be resolved.
	ReasonSourceUnavailable = "SourceUnavailable"
)

Variables

View Source 
var (
	// GroupVersion is group version used to register these objects
	GroupVersion = schema.GroupVersion{Group: "github.as-code.io", Version: "v1"}

	// SchemeBuilder is used to add go types to the GroupVersionKind scheme
	//nolint:staticcheck // standard kubebuilder scaffolding; scheme.Builder deprecation has no drop-in replacement yet
	SchemeBuilder = &scheme.Builder{GroupVersion: GroupVersion}

	// AddToScheme adds the types in this group-version to the given scheme.
	AddToScheme = SchemeBuilder.AddToScheme
)

Functions

This section is empty.

Types

type App added in v1.5.0 

type App struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AppSpec   `json:"spec,omitempty"`
	Status AppStatus `json:"status,omitempty"`
}

App is the Schema for the apps API; it encapsulates a GitHub App configuration that Tokens and ClusterTokens may reference via spec.appRef.

func (*App) DeepCopy added in v1.5.0 

func (in *App) DeepCopy() *App

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new App.

func (*App) DeepCopyInto added in v1.5.0 

func (in *App) DeepCopyInto(out *App)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*App) DeepCopyObject added in v1.5.0 

func (in *App) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*App) GetStatusConditions added in v1.5.0 

func (a *App) GetStatusConditions() []metav1.Condition

GetStatusConditions returns the App's status conditions slice.

func (*App) SetStatusCondition added in v1.5.0 

func (a *App) SetStatusCondition(condition metav1.Condition) (changed bool)

SetStatusCondition updates the App's status conditions in place, returning true when the resulting slice differs from the prior value.

type AppList added in v1.5.0 

type AppList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []App `json:"items"`
}

AppList contains a list of App.

func (*AppList) DeepCopy added in v1.5.0 

func (in *AppList) DeepCopy() *AppList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppList.

func (*AppList) DeepCopyInto added in v1.5.0 

func (in *AppList) DeepCopyInto(out *AppList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*AppList) DeepCopyObject added in v1.5.0 

func (in *AppList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type AppReference added in v1.5.0 

type AppReference struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength:=253
	// Name of the App resource.
	Name string `json:"name"`

	// +optional
	// +kubebuilder:validation:MaxLength:=253
	// Namespace containing the App resource. If empty, defaults to the
	// operator's own namespace.
	Namespace string `json:"namespace,omitempty"`
}

AppReference identifies an App resource, optionally in a different namespace. Used by the cluster-scoped ClusterToken kind. When Namespace is empty the controller resolves it to the operator's own namespace.

func (*AppReference) DeepCopy added in v1.5.0 

func (in *AppReference) DeepCopy() *AppReference

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppReference.

func (*AppReference) DeepCopyInto added in v1.5.0 

func (in *AppReference) DeepCopyInto(out *AppReference)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AppSpec added in v1.5.0 

type AppSpec struct {

	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:example:=12345
	// The AppID of the GitHub App.
	AppID int64 `json:"appID"`

	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:example:=123456789
	// The default InstallationID of the GitHub App; Tokens/ClusterTokens may
	// override this via spec.installationID to target a different installation.
	InstallationID int64 `json:"installationID"`

	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=secret;aws;azure;gcp;vault
	// Private key provider. One of "secret" (PEM material in a same-namespace
	// Secret, referenced by keyRef), "aws" (AWS KMS), "azure" (Azure Key
	// Vault), "gcp" (Google Cloud KMS), or "vault" (HashiCorp Vault transit).
	// The "file" provider is intentionally not supported on an App; use the
	// operator's startup configuration for file-based keys.
	Provider string `json:"provider"`

	// +optional
	// Cloud-KMS key reference. Required when provider is "aws", "azure",
	// "gcp", or "vault"; forbidden when provider is "secret". The exact
	// shape depends on the provider: KMS key alias/ID/ARN (aws), Azure Key
	// Vault key URL (azure), GCP KMS resource name (gcp), or Vault transit
	// sign path (vault).
	Key string `json:"key,omitempty"`

	// +optional
	// Same-namespace Secret reference holding the PEM-encoded RSA private
	// key. Required when provider is "secret"; forbidden otherwise.
	KeyRef *KeySecretReference `json:"keyRef,omitempty"`

	// +optional
	// +kubebuilder:default:=false
	// If true, the operator validates the private key at reconcile time by
	// attempting a test sign. Failures surface as a KeyValid=False condition.
	ValidateKey bool `json:"validateKey,omitempty"`
}

AppSpec defines the desired state of an App.

Provider selects how the App's RSA private key is materialised. For cloud KMS (aws/azure/gcp/vault) the key reference is supplied inline via Key. For "secret" the key bytes live in a same-namespace Secret named by KeyRef; this is the only supported way to use an inline PEM with an App, because allowing arbitrary filesystem paths from a namespaced resource would let any namespace owner read key material mounted on the controller Pod.

+kubebuilder:validation:XValidation:rule="(self.provider == 'secret') == has(self.keyRef)",message="keyRef must be set if and only if provider is 'secret'" +kubebuilder:validation:XValidation:rule="(self.provider != 'secret') == has(self.key)",message="key must be set if and only if provider is not 'secret'"

func (*AppSpec) DeepCopy added in v1.5.0 

func (in *AppSpec) DeepCopy() *AppSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppSpec.

func (*AppSpec) DeepCopyInto added in v1.5.0 

func (in *AppSpec) DeepCopyInto(out *AppSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type AppStatus added in v1.5.0 

type AppStatus struct {

	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

AppStatus defines the observed state of an App.

func (*AppStatus) DeepCopy added in v1.5.0 

func (in *AppStatus) DeepCopy() *AppStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppStatus.

func (*AppStatus) DeepCopyInto added in v1.5.0 

func (in *AppStatus) DeepCopyInto(out *AppStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ClusterToken 

type ClusterToken struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterTokenSpec   `json:"spec,omitempty"`
	Status ClusterTokenStatus `json:"status,omitempty"`
}

ClusterToken is the Schema for the clustertokens API

func (*ClusterToken) DeepCopy 

func (in *ClusterToken) DeepCopy() *ClusterToken

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterToken.

func (*ClusterToken) DeepCopyInto 

func (in *ClusterToken) DeepCopyInto(out *ClusterToken)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterToken) DeepCopyObject 

func (in *ClusterToken) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*ClusterToken) GetAppRef added in v1.5.0 

func (t *ClusterToken) GetAppRef() *AppReference

GetAppRef returns the raw *AppReference set on the ClusterToken, or nil if unset. The Namespace field may be empty; the caller (registry) defaults it to the operator's own namespace.

func (*ClusterToken) GetInstallationID 

func (t *ClusterToken) GetInstallationID() int64

func (*ClusterToken) GetInstallationTokenOptions 

func (t *ClusterToken) GetInstallationTokenOptions() *github.InstallationTokenOptions

func (*ClusterToken) GetManagedSecret 

func (t *ClusterToken) GetManagedSecret() ManagedSecret

func (*ClusterToken) GetRefreshInterval 

func (t *ClusterToken) GetRefreshInterval() time.Duration

func (*ClusterToken) GetRetryInterval added in v0.5.0 

func (t *ClusterToken) GetRetryInterval() time.Duration

func (*ClusterToken) GetSecretAnnotations 

func (t *ClusterToken) GetSecretAnnotations() map[string]string

func (*ClusterToken) GetSecretBasicAuth 

func (t *ClusterToken) GetSecretBasicAuth() bool

func (*ClusterToken) GetSecretDataSources added in v1.6.0 

func (t *ClusterToken) GetSecretDataSources() []SecretDataSource

GetSecretDataSources returns the extraData sources for this ClusterToken, defaulting any configMap/secret ref's empty namespace to the target Secret's namespace. Sources are deep-copied so the defaulting never mutates the caller's spec.

func (*ClusterToken) GetSecretLabels 

func (t *ClusterToken) GetSecretLabels() map[string]string

func (*ClusterToken) GetSecretName 

func (t *ClusterToken) GetSecretName() string

GetSecretName returns the name of the Secret for the Token

func (*ClusterToken) GetSecretNamespace 

func (t *ClusterToken) GetSecretNamespace() string

func (*ClusterToken) GetStatusConditions 

func (t *ClusterToken) GetStatusConditions() []metav1.Condition

func (*ClusterToken) GetStatusTimestamps 

func (t *ClusterToken) GetStatusTimestamps() (createdAt, expiresAt time.Time)

func (*ClusterToken) GetType 

func (t *ClusterToken) GetType() string

func (*ClusterToken) RemoveStatusCondition added in v1.6.0 

func (t *ClusterToken) RemoveStatusCondition(conditionType string) (changed bool)

func (*ClusterToken) SetStatusCondition 

func (t *ClusterToken) SetStatusCondition(condition metav1.Condition) (changed bool)

func (*ClusterToken) SetStatusTimestamps 

func (t *ClusterToken) SetStatusTimestamps(expiresAt time.Time)

func (*ClusterToken) UpdateManagedSecret 

func (t *ClusterToken) UpdateManagedSecret() (changed bool)

type ClusterTokenList 

type ClusterTokenList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []ClusterToken `json:"items"`
}

ClusterTokenList contains a list of ClusterToken

func (*ClusterTokenList) DeepCopy 

func (in *ClusterTokenList) DeepCopy() *ClusterTokenList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTokenList.

func (*ClusterTokenList) DeepCopyInto 

func (in *ClusterTokenList) DeepCopyInto(out *ClusterTokenList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*ClusterTokenList) DeepCopyObject 

func (in *ClusterTokenList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type ClusterTokenSecretSpec 

type ClusterTokenSecretSpec struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength:=253
	// +kubebuilder:example:="default"
	// Namespace for the Secret managed by this ClusterToken
	Namespace string `json:"namespace"`

	// +optional
	// +kubebuilder:validation:MaxLength:=253
	// Name for the Secret managed by this ClusterToken (defaults to the name of the ClusterToken)
	Name string `json:"name,omitempty"`

	// +optional
	// Extra labels for the Secret managed by this Token
	Labels map[string]string `json:"labels,omitempty"`

	// +optional
	// Extra annotations for the Secret managed by this Token
	Annotations map[string]string `json:"annotations,omitempty"`

	// +optional
	// Create a secret with 'username' and 'password' fields for HTTP Basic Auth rather than simply 'token'
	BasicAuth bool `json:"basicAuth,omitempty"`

	// +optional
	// +kubebuilder:validation:MaxItems:=16
	// Additional keys to project into the managed Secret, from inline values
	// and/or referenced ConfigMaps/Secrets. A configMap/secret ref's namespace
	// defaults to the target Secret's namespace when unset. Reserved keys
	// ('username'/'password' when basicAuth is true, 'token' otherwise) are
	// always overridden by the operator-managed values.
	ExtraData []SecretDataSource `json:"extraData,omitempty"`
}

+kubebuilder:validation:XValidation:rule="!has(self.extraData) || !(has(self.basicAuth) && self.basicAuth) || self.extraData.all(e, !has(e.inline) || !('username' in e.inline || 'password' in e.inline))",message="extraData inline must not contain 'username' or 'password' when basicAuth is true" +kubebuilder:validation:XValidation:rule="!has(self.extraData) || (has(self.basicAuth) && self.basicAuth) || self.extraData.all(e, !has(e.inline) || !('token' in e.inline))",message="extraData inline must not contain 'token' when basicAuth is false" +kubebuilder:validation:XValidation:rule="!has(self.extraData) || self.extraData.all(e, !has(e.inline) || e.inline.all(k, k.matches('^[-._a-zA-Z0-9]+$')))",message="extraData inline keys must consist of alphanumerics, '-', '_' or '.'"

func (*ClusterTokenSecretSpec) DeepCopy 

func (in *ClusterTokenSecretSpec) DeepCopy() *ClusterTokenSecretSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTokenSecretSpec.

func (*ClusterTokenSecretSpec) DeepCopyInto 

func (in *ClusterTokenSecretSpec) DeepCopyInto(out *ClusterTokenSecretSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ClusterTokenSpec 

type ClusterTokenSpec struct {
	// +optional
	// Reference to the App that provides the GitHub App credentials for this
	// ClusterToken. When spec.appRef.namespace is empty, the operator resolves
	// the reference in its own namespace. When unset, the operator's startup
	// configuration is used.
	AppRef *AppReference `json:"appRef,omitempty"`

	// +kubebuilder:validation:Required
	Secret ClusterTokenSecretSpec `json:"secret"`

	// +optional
	// +kubebuilder:example:="123456789"
	// Specify or override the InstallationID of the GitHub App for this Token
	InstallationID int64 `json:"installationID,omitempty"`

	// +optional
	// +kubebuilder:validation:Format:=duration
	// +kubebuilder:default:="30m"
	// +kubebuilder:example:="45m"
	// Specify how often to refresh the token (maximum: 1h)
	RefreshInterval metav1.Duration `json:"refreshInterval"`

	// +optional
	// +kubebuilder:validation:Format:=duration
	// +kubebuilder:default:="5m"
	// +kubebuilder:example:="1m"
	// Specify how long to wait before retrying on transient token retrieval error
	RetryInterval metav1.Duration `json:"retryInterval"`

	// +optional
	// +kubebuilder:example:={"metadata": "read", "contents": "read"}
	// Specify the permissions for the token as a subset of those of the GitHub App
	Permissions *Permissions `json:"permissions,omitempty"`

	// +optional
	// +kubebuilder:validation:MaxItems:=500
	// Specify the repositories for which the token should have access
	Repositories []string `json:"repositories,omitempty"`

	// +optional
	// +kubebuilder:validation:MaxItems:=500
	// Specify the repository IDs for which the token should have access
	RepositoryIDs []int64 `json:"repositoryIDs,omitempty"`
}

ClusterTokenSpec defines the desired state of ClusterToken

func (*ClusterTokenSpec) DeepCopy 

func (in *ClusterTokenSpec) DeepCopy() *ClusterTokenSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTokenSpec.

func (*ClusterTokenSpec) DeepCopyInto 

func (in *ClusterTokenSpec) DeepCopyInto(out *ClusterTokenSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ClusterTokenStatus 

type ClusterTokenStatus struct {
	ManagedSecret ManagedSecret `json:"managedSecret,omitempty"`

	IAT InstallationAccessToken `json:"installationAccessToken,omitempty"`

	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

ClusterTokenStatus defines the observed state of ClusterToken

func (*ClusterTokenStatus) DeepCopy 

func (in *ClusterTokenStatus) DeepCopy() *ClusterTokenStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClusterTokenStatus.

func (*ClusterTokenStatus) DeepCopyInto 

func (in *ClusterTokenStatus) DeepCopyInto(out *ClusterTokenStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type InstallationAccessToken 

type InstallationAccessToken struct {
	CreatedAt metav1.Time `json:"updatedAt,omitempty"`
	ExpiresAt metav1.Time `json:"expiresAt,omitempty"`
}

func (*InstallationAccessToken) DeepCopy 

func (in *InstallationAccessToken) DeepCopy() *InstallationAccessToken

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new InstallationAccessToken.

func (*InstallationAccessToken) DeepCopyInto 

func (in *InstallationAccessToken) DeepCopyInto(out *InstallationAccessToken)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type KeySecretReference added in v1.5.0 

type KeySecretReference struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength:=253
	// Name of the Secret in the App's namespace.
	Name string `json:"name"`

	// +optional
	// +kubebuilder:default:="private-key.pem"
	// Key within the Secret's data map containing the PEM-encoded RSA
	// private key. Defaults to "private-key.pem", which matches the
	// filename GitHub uses when downloading App keys.
	Key string `json:"key,omitempty"`
}

KeySecretReference identifies a same-namespace Secret holding a PEM-encoded RSA private key for a GitHub App.

func (*KeySecretReference) DeepCopy added in v1.5.0 

func (in *KeySecretReference) DeepCopy() *KeySecretReference

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KeySecretReference.

func (*KeySecretReference) DeepCopyInto added in v1.5.0 

func (in *KeySecretReference) DeepCopyInto(out *KeySecretReference)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type LocalAppReference added in v1.5.0 

type LocalAppReference struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength:=253
	// Name of the App resource in the same namespace as the referring Token.
	Name string `json:"name"`
}

LocalAppReference is a same-namespace reference to an App resource used by the namespaced Token kind. A Token may only reference an App in its own namespace.

func (*LocalAppReference) DeepCopy added in v1.5.0 

func (in *LocalAppReference) DeepCopy() *LocalAppReference

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalAppReference.

func (*LocalAppReference) DeepCopyInto added in v1.5.0 

func (in *LocalAppReference) DeepCopyInto(out *LocalAppReference)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type LocalSecretDataSource added in v1.6.0 

type LocalSecretDataSource struct {
	// +optional
	// +kubebuilder:validation:MaxProperties:=16
	// Static key/value pairs to merge in verbatim.
	Inline map[string]string `json:"inline,omitempty"`

	// +optional
	// Project keys from a ConfigMap in the same namespace as the Token.
	ConfigMap *LocalSecretDataSourceRef `json:"configMap,omitempty"`

	// +optional
	// Project keys from a Secret in the same namespace as the Token.
	Secret *LocalSecretDataSourceRef `json:"secret,omitempty"`
}

LocalSecretDataSource is the same-namespace form of SecretDataSource used by the namespaced Token kind. A Token may only reference ConfigMaps and Secrets in its own namespace.

func (*LocalSecretDataSource) DeepCopy added in v1.6.0 

func (in *LocalSecretDataSource) DeepCopy() *LocalSecretDataSource

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalSecretDataSource.

func (*LocalSecretDataSource) DeepCopyInto added in v1.6.0 

func (in *LocalSecretDataSource) DeepCopyInto(out *LocalSecretDataSource)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type LocalSecretDataSourceRef added in v1.6.0 

type LocalSecretDataSourceRef struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength:=253
	// Name of the referenced ConfigMap or Secret.
	Name string `json:"name"`

	// +optional
	// +kubebuilder:validation:MaxItems:=64
	// +kubebuilder:validation:items:MaxLength:=253
	// Restrict projection to these keys. When empty, every key in the
	// referenced object is projected.
	Keys []string `json:"keys,omitempty"`

	// +optional
	// When false (the default), an unresolvable reference — a missing or
	// unreadable object, or a listed key absent from it — blocks creation of
	// the managed Secret; once the Secret exists, its last-known-good
	// extraData is retained (while the credential keeps refreshing) and the
	// failure is surfaced via the ExtraDataDegraded condition. When true, a
	// missing object or key is skipped instead and reported via the same
	// condition.
	Optional bool `json:"optional,omitempty"`
}

LocalSecretDataSourceRef references a ConfigMap or Secret in the same namespace as the referring Token to project keys from.

func (*LocalSecretDataSourceRef) DeepCopy added in v1.6.0 

func (in *LocalSecretDataSourceRef) DeepCopy() *LocalSecretDataSourceRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new LocalSecretDataSourceRef.

func (*LocalSecretDataSourceRef) DeepCopyInto added in v1.6.0 

func (in *LocalSecretDataSourceRef) DeepCopyInto(out *LocalSecretDataSourceRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type ManagedSecret 

type ManagedSecret struct {
	BasicAuth bool   `json:"basicAuth"`
	Namespace string `json:"namespace,omitempty"`
	Name      string `json:"name,omitempty"`
}

func (*ManagedSecret) DeepCopy 

func (in *ManagedSecret) DeepCopy() *ManagedSecret

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ManagedSecret.

func (*ManagedSecret) DeepCopyInto 

func (in *ManagedSecret) DeepCopyInto(out *ManagedSecret)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (ManagedSecret) IsUnset 

func (m ManagedSecret) IsUnset() bool

func (ManagedSecret) Key 

func (m ManagedSecret) Key() types.NamespacedName

func (ManagedSecret) MatchesSpec 

func (m ManagedSecret) MatchesSpec(owner secretOwner) bool

type Permissions 

type Permissions struct {
	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Actions *string `json:"actions,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Administration *string `json:"administration,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Checks *string `json:"checks,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Codespaces *string `json:"codespaces,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Contents *string `json:"contents,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	DependabotSecrets *string `json:"dependabot_secrets,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Deployments *string `json:"deployments,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	EmailAddresses *string `json:"email_addresses,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Environments *string `json:"environments,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Followers *string `json:"followers,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Issues *string `json:"issues,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Metadata *string `json:"metadata,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Members *string `json:"members,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationAdministration *string `json:"organization_administration,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationCustomRoles *string `json:"organization_custom_roles,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationHooks *string `json:"organization_hooks,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationPackages *string `json:"organization_packages,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationPlan *string `json:"organization_plan,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationProjects *string `json:"organization_projects,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationSecrets *string `json:"organization_secrets,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationSelfHostedRunners *string `json:"organization_self_hosted_runners,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	OrganizationUserBlocking *string `json:"organization_user_blocking,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Packages *string `json:"packages,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Pages *string `json:"pages,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	PullRequests *string `json:"pull_requests,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	RepositoryCustomProperties *string `json:"repository_custom_properties,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	RepositoryHooks *string `json:"repository_hooks,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write;admin
	RepositoryProjects *string `json:"repository_projects,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Secrets *string `json:"secrets,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	SecretScanningAlerts *string `json:"secret_scanning_alerts,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	SecurityEvents *string `json:"security_events,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	SingleFile *string `json:"single_file,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	Statuses *string `json:"statuses,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	TeamDiscussions *string `json:"team_discussions,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=read;write
	VulnerabilityAlerts *string `json:"vulnerability_alerts,omitempty"`

	// +optional
	// +kubebuilder:validation:Enum:=write
	Workflows *string `json:"workflows,omitempty"`
}

func (*Permissions) DeepCopy 

func (in *Permissions) DeepCopy() *Permissions

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Permissions.

func (*Permissions) DeepCopyInto 

func (in *Permissions) DeepCopyInto(out *Permissions)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Permissions) ToInstallationPermissions 

func (p *Permissions) ToInstallationPermissions() *github.InstallationPermissions

type SecretDataSource added in v1.6.0 

type SecretDataSource struct {
	// +optional
	// +kubebuilder:validation:MaxProperties:=16
	// Static key/value pairs to merge in verbatim.
	Inline map[string]string `json:"inline,omitempty"`

	// +optional
	// Project keys from a ConfigMap.
	ConfigMap *SecretDataSourceRef `json:"configMap,omitempty"`

	// +optional
	// Project keys from a Secret.
	Secret *SecretDataSourceRef `json:"secret,omitempty"`
}

SecretDataSource projects additional keys into a managed Secret from exactly one of an inline map, a ConfigMap, or another Secret. Used by the cluster-scoped ClusterToken kind. Entries are merged in list order; later entries win on key collision, and keys reserved by the token type (e.g. 'token', or 'username'/'password' under basicAuth) are always overridden by the operator-managed values.

func (*SecretDataSource) DeepCopy added in v1.6.0 

func (in *SecretDataSource) DeepCopy() *SecretDataSource

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretDataSource.

func (*SecretDataSource) DeepCopyInto added in v1.6.0 

func (in *SecretDataSource) DeepCopyInto(out *SecretDataSource)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type SecretDataSourceRef added in v1.6.0 

type SecretDataSourceRef struct {
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength:=253
	// Name of the referenced ConfigMap or Secret.
	Name string `json:"name"`

	// +optional
	// +kubebuilder:validation:MaxLength:=253
	// Namespace of the referenced ConfigMap or Secret. If empty, defaults to
	// the target Secret's namespace.
	Namespace string `json:"namespace,omitempty"`

	// +optional
	// +kubebuilder:validation:MaxItems:=64
	// +kubebuilder:validation:items:MaxLength:=253
	// Restrict projection to these keys. When empty, every key in the
	// referenced object is projected.
	Keys []string `json:"keys,omitempty"`

	// +optional
	// When false (the default), an unresolvable reference — a missing or
	// unreadable object, or a listed key absent from it — blocks creation of
	// the managed Secret; once the Secret exists, its last-known-good
	// extraData is retained (while the credential keeps refreshing) and the
	// failure is surfaced via the ExtraDataDegraded condition. When true, a
	// missing object or key is skipped instead and reported via the same
	// condition.
	Optional bool `json:"optional,omitempty"`
}

SecretDataSourceRef references a ConfigMap or Secret, optionally in a different namespace, to project keys from.

func (*SecretDataSourceRef) DeepCopy added in v1.6.0 

func (in *SecretDataSourceRef) DeepCopy() *SecretDataSourceRef

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretDataSourceRef.

func (*SecretDataSourceRef) DeepCopyInto added in v1.6.0 

func (in *SecretDataSourceRef) DeepCopyInto(out *SecretDataSourceRef)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type Token 

type Token struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TokenSpec   `json:"spec,omitempty"`
	Status TokenStatus `json:"status,omitempty"`
}

Token is the Schema for the Tokens API

func (*Token) DeepCopy 

func (in *Token) DeepCopy() *Token

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Token.

func (*Token) DeepCopyInto 

func (in *Token) DeepCopyInto(out *Token)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*Token) DeepCopyObject 

func (in *Token) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

func (*Token) GetAppRef added in v1.5.0 

func (t *Token) GetAppRef() *AppReference

GetAppRef returns a normalized *AppReference for the App backing this Token, or nil when no AppRef is set (falling back to the startup config). The namespace is always the Token's own namespace, since Tokens cannot reference Apps cross-namespace.

func (*Token) GetInstallationID 

func (t *Token) GetInstallationID() int64

func (*Token) GetInstallationTokenOptions 

func (t *Token) GetInstallationTokenOptions() *github.InstallationTokenOptions

func (*Token) GetManagedSecret 

func (t *Token) GetManagedSecret() ManagedSecret

func (*Token) GetRefreshInterval 

func (t *Token) GetRefreshInterval() time.Duration

func (*Token) GetRetryInterval added in v0.5.0 

func (t *Token) GetRetryInterval() time.Duration

func (*Token) GetSecretAnnotations 

func (t *Token) GetSecretAnnotations() map[string]string

func (*Token) GetSecretBasicAuth 

func (t *Token) GetSecretBasicAuth() bool

func (*Token) GetSecretDataSources added in v1.6.0 

func (t *Token) GetSecretDataSources() []SecretDataSource

GetSecretDataSources returns the extraData sources for this Token, converted to the common SecretDataSource shape with every configMap/secret ref placed in the Token's own namespace (the LocalSecretDataSourceRef schema has no namespace field, so no other namespace is expressible).

func (*Token) GetSecretLabels 

func (t *Token) GetSecretLabels() map[string]string

func (*Token) GetSecretName 

func (t *Token) GetSecretName() string

GetSecretName returns the name of the Secret for the Token

func (*Token) GetSecretNamespace 

func (t *Token) GetSecretNamespace() string

func (*Token) GetStatusConditions 

func (t *Token) GetStatusConditions() []metav1.Condition

func (*Token) GetStatusTimestamps 

func (t *Token) GetStatusTimestamps() (createdAt, expiresAt time.Time)

func (*Token) GetType 

func (t *Token) GetType() string

func (*Token) RemoveStatusCondition added in v1.6.0 

func (t *Token) RemoveStatusCondition(conditionType string) (changed bool)

func (*Token) SetStatusCondition 

func (t *Token) SetStatusCondition(condition metav1.Condition) (changed bool)

func (*Token) SetStatusTimestamps 

func (t *Token) SetStatusTimestamps(expiresAt time.Time)

func (*Token) UpdateManagedSecret 

func (t *Token) UpdateManagedSecret() (changed bool)

type TokenList 

type TokenList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata"`
	Items           []Token `json:"items"`
}

TokenList contains a list of Token

func (*TokenList) DeepCopy 

func (in *TokenList) DeepCopy() *TokenList

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TokenList.

func (*TokenList) DeepCopyInto 

func (in *TokenList) DeepCopyInto(out *TokenList)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

func (*TokenList) DeepCopyObject 

func (in *TokenList) DeepCopyObject() runtime.Object

DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

type TokenSecretSpec 

type TokenSecretSpec struct {
	// +optional
	// +kubebuilder:validation:MaxLength:=253
	// Name for the Secret managed by this Token (defaults to the name of the Token)
	Name string `json:"name,omitempty"`

	// +optional
	// Extra labels for the Secret managed by this Token
	Labels map[string]string `json:"labels,omitempty"`

	// +optional
	// Extra annotations for the Secret managed by this Token
	Annotations map[string]string `json:"annotations,omitempty"`

	// +optional
	// Create a secret with 'username' and 'password' fields for HTTP Basic Auth rather than simply 'token'
	BasicAuth bool `json:"basicAuth,omitempty"`

	// +optional
	// +kubebuilder:validation:MaxItems:=16
	// Additional keys to project into the managed Secret, from inline values
	// and/or referenced ConfigMaps/Secrets in this Token's own namespace.
	// Reserved keys ('username'/'password' when basicAuth is true, 'token'
	// otherwise) are always overridden by the operator-managed values.
	ExtraData []LocalSecretDataSource `json:"extraData,omitempty"`
}

+kubebuilder:validation:XValidation:rule="!has(self.extraData) || !(has(self.basicAuth) && self.basicAuth) || self.extraData.all(e, !has(e.inline) || !('username' in e.inline || 'password' in e.inline))",message="extraData inline must not contain 'username' or 'password' when basicAuth is true" +kubebuilder:validation:XValidation:rule="!has(self.extraData) || (has(self.basicAuth) && self.basicAuth) || self.extraData.all(e, !has(e.inline) || !('token' in e.inline))",message="extraData inline must not contain 'token' when basicAuth is false" +kubebuilder:validation:XValidation:rule="!has(self.extraData) || self.extraData.all(e, !has(e.inline) || e.inline.all(k, k.matches('^[-._a-zA-Z0-9]+$')))",message="extraData inline keys must consist of alphanumerics, '-', '_' or '.'"

func (*TokenSecretSpec) DeepCopy 

func (in *TokenSecretSpec) DeepCopy() *TokenSecretSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TokenSecretSpec.

func (*TokenSecretSpec) DeepCopyInto 

func (in *TokenSecretSpec) DeepCopyInto(out *TokenSecretSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type TokenSpec 

type TokenSpec struct {
	// +optional
	// Reference to the App that provides the GitHub App credentials for this
	// Token. Must be in the same namespace as the Token. When unset, the
	// operator's startup configuration is used.
	AppRef *LocalAppReference `json:"appRef,omitempty"`

	// +optional
	// Override the default token secret name and type
	Secret TokenSecretSpec `json:"secret,omitempty"`

	// +optional
	// +kubebuilder:example:="123456789"
	// Specify or override the InstallationID of the GitHub App for this Token
	InstallationID int64 `json:"installationID,omitempty"`

	// +optional
	// +kubebuilder:validation:Format:=duration
	// +kubebuilder:default:="30m"
	// +kubebuilder:example:="45m"
	// Specify how often to refresh the token (maximum: 1h)
	RefreshInterval metav1.Duration `json:"refreshInterval"`

	// +optional
	// +kubebuilder:validation:Format:=duration
	// +kubebuilder:default:="5m"
	// +kubebuilder:example:="1m"
	// Specify how long to wait before retrying on transient token retrieval error
	RetryInterval metav1.Duration `json:"retryInterval"`

	// +optional
	// +kubebuilder:example:={"metadata": "read", "contents": "read"}
	// Specify the permissions for the token as a subset of those of the GitHub App
	Permissions *Permissions `json:"permissions,omitempty"`

	// +optional
	// +kubebuilder:validation:MaxItems:=500
	// Specify the repositories for which the token should have access
	Repositories []string `json:"repositories,omitempty"`

	// +optional
	// +kubebuilder:validation:MaxItems:=500
	// Specify the repository IDs for which the token should have access
	RepositoryIDs []int64 `json:"repositoryIDs,omitempty"`
}

TokenSpec defines the desired state of Token

func (*TokenSpec) DeepCopy 

func (in *TokenSpec) DeepCopy() *TokenSpec

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TokenSpec.

func (*TokenSpec) DeepCopyInto 

func (in *TokenSpec) DeepCopyInto(out *TokenSpec)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

type TokenStatus 

type TokenStatus struct {
	ManagedSecret ManagedSecret `json:"managedSecret,omitempty"`

	IAT InstallationAccessToken `json:"installationAccessToken,omitempty"`

	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

TokenStatus defines the observed state of Token

func (*TokenStatus) DeepCopy 

func (in *TokenStatus) DeepCopy() *TokenStatus

DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TokenStatus.

func (*TokenStatus) DeepCopyInto 

func (in *TokenStatus) DeepCopyInto(out *TokenStatus)

DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.