Skip to content

Commit f56c46b

Browse files
fhennigfhennig
authored
feat: Better CRD docs (#333)
* docs * Updated changelog * ~ * Added info about default * regenerate charts * added more links * fixed typo * Updated operator-rs
1 parent 92630fc commit f56c46b

File tree

6 files changed

+156
-50
lines changed

6 files changed

+156
-50
lines changed

‎CHANGELOG.md

+6
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,12 @@ All notable changes to this project will be documented in this file.
44

55
## [Unreleased]
66

7+
### Added
8+
9+
- Improved CRD documentation ([#333]).
10+
11+
[#333]: https://github.com/stackabletech/secret-operator/pull/333
12+
713
## [23.11.0] - 2023-11-24
814

915
### Added

‎Cargo.lock

+56-39
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎Cargo.toml

+1-1
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ serde_json = "1.0"
3333
serde_yaml = "0.9"
3434
snafu = "0.7"
3535
socket2 = { version = "0.5", features = ["all"] }
36-
stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.56.1", features = ["time"]}
36+
stackable-operator = { git = "https://github.com/stackabletech/operator-rs.git", tag = "0.58.1", features = ["time"]}
3737
strum = { version = "0.25", features = ["derive"] }
3838
sys-mount = { version = "2.1", default-features = false }
3939
tempfile = "3.3"

‎deploy/helm/secret-operator/crds/crds.yaml

+28-6
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,10 @@ spec:
2222
description: Auto-generated derived type for SecretClassSpec via `CustomResource`
2323
properties:
2424
spec:
25+
description: A [SecretClass](https://docs.stackable.tech/home/nightly/secret-operator/secretclass) is a cluster-global Kubernetes resource that defines a category of secrets that the Secret Operator knows how to provision.
2526
properties:
2627
backend:
28+
description: Each SecretClass is associated with a single [backend](https://docs.stackable.tech/home/nightly/secret-operator/secretclass#backend), which dictates the mechanism for issuing that kind of Secret.
2729
oneOf:
2830
- required:
2931
- k8sSearch
@@ -33,15 +35,20 @@ spec:
3335
- kerberosKeytab
3436
properties:
3537
autoTls:
38+
description: |-
39+
The [`autoTls` backend](https://docs.stackable.tech/home/nightly/secret-operator/secretclass#backend-autotls) issues a TLS certificate signed by the Secret Operator. The certificate authority can be provided by the administrator, or managed automatically by the Secret Operator.
40+
41+
A new certificate and keypair will be generated and signed for each Pod, keys or certificates are never reused.
3642
properties:
3743
ca:
44+
description: Configures the certificate authority used to issue Pod certificates.
3845
properties:
3946
autoGenerate:
4047
default: false
41-
description: Whether a new certificate authority should be generated if it does not already exist
48+
description: Whether a new certificate authority should be generated if it does not already exist.
4249
type: boolean
4350
secret:
44-
description: SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace
51+
description: Reference (name and namespace) to a Kubernetes Secret object where the CA certificate and key is stored in the keys `ca.crt` and `ca.key` respectively.
4552
properties:
4653
name:
4754
description: name is unique within a namespace to reference a secret resource.
@@ -55,43 +62,51 @@ spec:
5562
type: object
5663
maxCertificateLifetime:
5764
default: 15d
58-
description: Maximum lifetime the created certificates are allowed to have. In case consumers request a longer lifetime than allowed by this setting, the lifetime will be the minimum of both, so this setting takes precedence.
65+
description: Maximum lifetime the created certificates are allowed to have. In case consumers request a longer lifetime than allowed by this setting, the lifetime will be the minimum of both, so this setting takes precedence. The default value is 15 days.
5966
type: string
6067
required:
6168
- ca
6269
type: object
6370
k8sSearch:
71+
description: The [`k8sSearch` backend](https://docs.stackable.tech/home/nightly/secret-operator/secretclass#backend-k8ssearch) can be used to mount Secrets across namespaces into Pods.
6472
properties:
6573
searchNamespace:
74+
description: Configures the namespace searched for Secret objects.
6675
oneOf:
6776
- required:
6877
- pod
6978
- required:
7079
- name
7180
properties:
7281
name:
82+
description: The Secret objects are located in a single global namespace. Should be used for secrets that are provisioned by the cluster administrator.
7383
type: string
7484
pod:
85+
description: The Secret objects are located in the same namespace as the Pod object. Should be used for Secrets that are provisioned by the application administrator.
7586
type: object
7687
type: object
7788
required:
7889
- searchNamespace
7990
type: object
8091
kerberosKeytab:
92+
description: The [`kerberosKeytab` backend](https://docs.stackable.tech/home/nightly/secret-operator/secretclass#backend-kerberoskeytab) creates a Kerberos keytab file for a selected realm. The Kerberos KDC and administrator credentials must be provided by the administrator.
8193
properties:
8294
admin:
95+
description: Kerberos admin configuration settings.
8396
oneOf:
8497
- required:
8598
- mit
8699
- required:
87100
- activeDirectory
88101
properties:
89102
activeDirectory:
103+
description: Credentials should be provisioned in a Microsoft Active Directory domain.
90104
properties:
91105
ldapServer:
106+
description: An AD LDAP server, such as the AD Domain Controller. This must match the server’s FQDN, or GSSAPI authentication will fail.
92107
type: string
93108
ldapTlsCaSecret:
94-
description: SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace
109+
description: Reference (name and namespace) to a Kubernetes Secret object containing the TLS CA (in `ca.crt`) that the LDAP server’s certificate should be authenticated against.
95110
properties:
96111
name:
97112
description: name is unique within a namespace to reference a secret resource.
@@ -101,7 +116,7 @@ spec:
101116
type: string
102117
type: object
103118
passwordCacheSecret:
104-
description: SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace
119+
description: Reference (name and namespace) to a Kubernetes Secret object where workload passwords will be stored. This must not be accessible to end users.
105120
properties:
106121
name:
107122
description: name is unique within a namespace to reference a secret resource.
@@ -111,8 +126,10 @@ spec:
111126
type: string
112127
type: object
113128
schemaDistinguishedName:
129+
description: The root Distinguished Name (DN) for AD-managed schemas, typically `CN=Schema,CN=Configuration,{domain_dn}`.
114130
type: string
115131
userDistinguishedName:
132+
description: The root Distinguished Name (DN) where service accounts should be provisioned, typically `CN=Users,{domain_dn}`.
116133
type: string
117134
required:
118135
- ldapServer
@@ -122,15 +139,17 @@ spec:
122139
- userDistinguishedName
123140
type: object
124141
mit:
142+
description: Credentials should be provisioned in a MIT Kerberos Admin Server.
125143
properties:
126144
kadminServer:
145+
description: The hostname of the Kerberos Admin Server. This should be provided by the Kerberos administrator.
127146
type: string
128147
required:
129148
- kadminServer
130149
type: object
131150
type: object
132151
adminKeytabSecret:
133-
description: SecretReference represents a Secret Reference. It has enough information to retrieve secret in any namespace
152+
description: Reference (`name` and `namespace`) to a K8s Secret object where a keytab with administrative privileges is stored in the key `keytab`.
134153
properties:
135154
name:
136155
description: name is unique within a namespace to reference a secret resource.
@@ -140,10 +159,13 @@ spec:
140159
type: string
141160
type: object
142161
adminPrincipal:
162+
description: The admin principal.
143163
type: string
144164
kdc:
165+
description: The hostname of the Kerberos Key Distribution Center (KDC). This should be provided by the Kerberos administrator.
145166
type: string
146167
realmName:
168+
description: The name of the Kerberos realm. This should be provided by the Kerberos administrator.
147169
type: string
148170
required:
149171
- admin

0 commit comments

Comments
 (0)