diff --git a/website/content/docs/platform/k8s/vso/api-reference.mdx b/website/content/docs/platform/k8s/vso/api-reference.mdx index 96c839c6bb8b..3f2e9f44b478 100644 --- a/website/content/docs/platform/k8s/vso/api-reference.mdx +++ b/website/content/docs/platform/k8s/vso/api-reference.mdx @@ -7,7 +7,7 @@ description: >- # API Reference @@ -894,6 +894,7 @@ _Appears in:_ | `tlsServerName` _string_ | TLSServerName to use as the SNI host for TLS connections. | | | | `caCertSecretRef` _string_ | CACertSecretRef is the name of a Kubernetes secret containing the trusted PEM encoded CA certificate chain as `ca.crt`. | | | | `skipTLSVerify` _boolean_ | SkipTLSVerify for TLS connections. | false | | +| `timeout` _[Duration](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.24/#duration-v1-meta)_ | Timeout applied to all Vault requests for this connection. If not set, the
default timeout from the Vault API client config is used. | | Pattern: `^([0-9]+(\.[0-9]+)?(s|m|h))$`
Type: string
| diff --git a/website/content/docs/platform/k8s/vso/helm.mdx b/website/content/docs/platform/k8s/vso/helm.mdx index 3aa610d23488..f3d97022219d 100644 --- a/website/content/docs/platform/k8s/vso/helm.mdx +++ b/website/content/docs/platform/k8s/vso/helm.mdx @@ -4,14 +4,18 @@ page_title: Vault Secrets Operator Helm Chart Configuration description: >- Configuration for the Vault Secrets Operator Helm chart. --- + # Vault Secrets Operator helm chart The chart is customizable using [Helm configuration values](https://helm.sh/docs/intro/using_helm/#customizing-the-chart-before-installing). - ## Top-Level Stanzas @@ -117,6 +121,15 @@ Use these links to navigate to a particular top-level stanza. - "VaultAuth" - "HCPAuth" + - `userFacingRoles` ((#v-controller-rbac-clusterroleaggregation-userfacingroles)) (`object: ""`) - userFacingRoles is a map of roles that will be aggregated into the viewer and editor ClusterRoles. + See https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles for more information. + + - `view` ((#v-controller-rbac-clusterroleaggregation-userfacingroles-view)) (`boolean: false`) - view controls whether the aggregated viewer ClusterRole will be made available to the user-facing + 'view' ClusterRole. Requires the viewerRoles to be set. + + - `edit` ((#v-controller-rbac-clusterroleaggregation-userfacingroles-edit)) (`boolean: false`) - view controls whether the aggregated editor ClusterRole will be made available to the user-facing + 'edit' ClusterRole. Requires the editorRoles to be set. + - `kubeRbacProxy` ((#v-controller-kuberbacproxy)) - Settings related to the kubeRbacProxy container. This container is an HTTP proxy for the controller manager which performs RBAC authorization against the Kubernetes API using SubjectAccessReviews. @@ -166,7 +179,7 @@ Use these links to navigate to a particular top-level stanza. - `repository` ((#v-controller-manager-image-repository)) (`string: hashicorp/vault-secrets-operator`) - - `tag` ((#v-controller-manager-image-tag)) (`string: 0.8.0`) + - `tag` ((#v-controller-manager-image-tag)) (`string: 0.8.1`) - `logging` ((#v-controller-manager-logging)) - logging @@ -190,8 +203,25 @@ Use these links to navigate to a particular top-level stanza. - `excludeRaw` ((#v-controller-manager-globaltransformationoptions-excluderaw)) (`boolean: false`) - excludeRaw directs the operator to prevent _raw secret data being stored in the destination K8s Secret. - - `backoffOnSecretSourceError` ((#v-controller-manager-backoffonsecretsourceerror)) - Backoff settings for the controller manager. These settings control the backoff behavior + - `globalVaultAuthOptions` ((#v-controller-manager-globalvaultauthoptions)) - Global Vault auth options. In addition to the boolean options + below, these options may be set via the + `VSO_GLOBAL_VAULT_OPTION_OPTIONS` environment variable as a + comma-separated list. Valid values are: `allow-default-globals` + + - `allowDefaultGlobals` ((#v-controller-manager-globalvaultauthoptions-allowdefaultglobals)) (`boolean: true`) - allowDefaultGlobals directs the operator search for a "default" + VaultAuthGlobal if none is specified on the referring VaultAuth CR. + Default: true + + - `backoffOnSecretSourceError` ((#v-controller-manager-backoffonsecretsourceerror)) (`object: ""`) - Backoff settings for the controller manager. These settings control the backoff behavior when the controller encounters an error while fetching secrets from the SecretSource. + For example given the following settings: + initialInterval: 5s + maxInterval: 60s + randomizationFactor: 0.5 + multiplier: 1.5 + + The backoff retry sequence might be something like: + 5.5s, 7.5s, 11.25s, 16.87s, 25.3125s, 37.96s, 56.95, 60.95s... - `initialInterval` ((#v-controller-manager-backoffonsecretsourceerror-initialinterval)) (`duration: 5s`) - Initial interval between retries. diff --git a/website/content/docs/platform/k8s/vso/installation.mdx b/website/content/docs/platform/k8s/vso/installation.mdx index 771d7018b144..969c61db7581 100644 --- a/website/content/docs/platform/k8s/vso/installation.mdx +++ b/website/content/docs/platform/k8s/vso/installation.mdx @@ -32,13 +32,13 @@ $ helm repo add hashicorp https://helm.releases.hashicorp.com ```shell-session $ helm search repo hashicorp/vault-secrets-operator NAME CHART VERSION APP VERSION DESCRIPTION -hashicorp/vault-secrets-operator 0.8.0 0.8.0 Official HashiCorp Vault Secrets Operator Chart +hashicorp/vault-secrets-operator 0.8.1 0.8.1 Official HashiCorp Vault Secrets Operator Chart ``` Then install the Operator: ```shell-session -$ helm install --version 0.8.0 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator +$ helm install --version 0.8.1 --create-namespace --namespace vault-secrets-operator vault-secrets-operator hashicorp/vault-secrets-operator ``` ## Upgrading using Helm @@ -78,9 +78,9 @@ You can install and update your installation using `kustomize` which allows you To install using Kustomize, download and untar/unzip the latest release from the [Releases Page](https://github.com/hashicorp/vault-secrets-operator/releases). ```shell-session -$ wget -q https://github.com/hashicorp/vault-secrets-operator/archive/refs/tags/v0.8.0.tar.gz -$ tar -zxf v0.8.0.tar.gz -$ cd vault-secrets-operator-0.8.0/ +$ wget -q https://github.com/hashicorp/vault-secrets-operator/archive/refs/tags/v0.8.1.tar.gz +$ tar -zxf v0.8.1.tar.gz +$ cd vault-secrets-operator-0.8.1/ ``` Next install using `kustomize build`: diff --git a/website/content/docs/platform/k8s/vso/openshift.mdx b/website/content/docs/platform/k8s/vso/openshift.mdx index 610c3aab256b..cb788609f948 100644 --- a/website/content/docs/platform/k8s/vso/openshift.mdx +++ b/website/content/docs/platform/k8s/vso/openshift.mdx @@ -32,7 +32,7 @@ The Vault Secrets Operator may also be installed in OpenShift using the Helm cha $ helm install vault-secrets-operator hashicorp/vault-secrets-operator \ --create-namespace \ --namespace vault-secrets-operator \ - --version 0.8.0 \ + --version 0.8.1 \ --values values.yaml ``` @@ -65,7 +65,7 @@ controller: manager: image: repository: registry.connect.redhat.com/hashicorp/vault-secrets-operator - tag: 0.8.0-ubi + tag: 0.8.1-ubi resources: limits: memory: 256Mi diff --git a/website/content/docs/platform/k8s/vso/sources/vault/index.mdx b/website/content/docs/platform/k8s/vso/sources/vault/index.mdx index 12d0ddf5e719..954c9fbe2d24 100644 --- a/website/content/docs/platform/k8s/vso/sources/vault/index.mdx +++ b/website/content/docs/platform/k8s/vso/sources/vault/index.mdx @@ -379,6 +379,11 @@ The Vault Secrets Operator can optionally cache Vault client information such as The [Encrypted client cache](/vault/docs/platform/k8s/vso/sources/vault/client-cache) guide will walk you through the steps to enable and configure client cache encryption. ## Instant updates + + + VSO v0.8.0 + + The Vault Secrets Operator can instantly update Kubernetes Secrets when changes are made in Vault, by subscribing to [Vault Events][vault-events] for change