Secret

1# yaml-language-server: $schema=../../schema/component.schema.json
2# Kubernetes Secret: a small object holding a password, token or key. Per "Secrets" the values are
3# base64 encoded for convenience, not encrypted: they are stored unencrypted in etcd unless
4# encryption at rest is enabled explicitly, and anyone with API access to the namespace -- or read
5# access to etcd -- can retrieve them. The default type is Opaque, the cap is 1 MiB, and a Secret
6# is mutable unless immutable: true is set. Kubernetes does not rotate Secret material.
7schemaVersion: "1"
8type: "component"
9id: "k8s-secret"
10kind: "key-management"
11provider: "k8s"
12docs: "https://kubernetes.io/docs/concepts/configuration/secret/"
13defaults:
14  managed: false
15  hsm: false
16  rotationAutomated: false
17  envelopeEncryption: false
18properties:
19  encryptionAtRest:
20    type: "boolean"
21    default: false
22  base64Encoded:
23    type: "boolean"
24    default: true
25  secretType:
26    type: "enum"
27    values: ["opaque", "service-account-token", "docker-cfg", "docker-config-json", "basic-auth", "ssh-auth", "tls", "bootstrap-token"]
28    default: "opaque"
29  maxSizeBytes:
30    type: "integer"
31    default: 1048576
32  immutable:
33    type: "boolean"
34    default: false