Provider contains the BeyondtrustWorkloadCredentials provider configuration including authentication,
server connection details, and the folder path to the dynamic secret definition.
The folderPath should point to a dynamic secret definition that has been created in
BeyondTrust Workload Credentials (e.g., "production/aws-temp").
For setup details, see: https://docs.beyondtrust.com/bt-docs/docs/secrets-api
auth
object required
Auth configures how the Operator authenticates with the BeyondTrust Workload Credentials API.
Currently supports API key authentication via Kubernetes secret reference.
For authentication setup, see: https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication
apikey
object required
APIKey configures API token authentication for BeyondTrust Workload Credentials.
The token is retrieved from a Kubernetes secret and used as a Bearer token for API requests.
token
object required
Token references the Kubernetes secret containing the BeyondTrust Workload Credentials API token.
The secret should contain the API key used to authenticate with BeyondTrust Workload Credentials.
Create an API token in your BeyondTrust Workload Credentials console and store it in a Kubernetes secret.
For details on creating API tokens, see: https://docs.beyondtrust.com/bt-docs/docs/secrets-api#authentication
key
string
A key in the referenced Secret.
Some instances of this field may be defaulted, in others it may be required.
pattern: ^[-._a-zA-Z0-9]+$
name
string
The name of the Secret resource being referred to.
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
namespace
string
The namespace of the Secret resource being referred to.
Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
caBundle
string
CABundle is a base64-encoded CA certificate used to validate the BeyondTrust Workload Credentials API TLS certificate.
Use this when your BeyondTrust instance uses a self-signed certificate or internal CA.
If not set, the system's trusted root certificates are used.
caProvider
object
CAProvider points to a Secret or ConfigMap containing a PEM-encoded CA certificate.
This is used to validate the BeyondTrust Workload Credentials API TLS certificate.
Use this as an alternative to CABundle when you want to reference an existing Kubernetes resource.
key
string
The key where the CA certificate can be found in the Secret or ConfigMap.
pattern: ^[-._a-zA-Z0-9]+$
name
string required
The name of the object located at the provider type.
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$
namespace
string
The namespace the Provider type is in.
Can only be defined when used in a ClusterSecretStore.
pattern: ^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
type
string required
The type of provider to use such as "Secret", or "ConfigMap".
folderPath
string
FolderPath specifies the default folder path for secret retrieval.
Secrets will be fetched from this folder unless overridden in the ExternalSecret spec.
Example: "production/database" or "dev/api-keys"
Leave empty to retrieve secrets from the root folder.
For folder organization, see: https://docs.beyondtrust.com/bt-docs/docs/secrets-api#folders
server
object required
Server configures the BeyondTrust Workload Credentials server connection details.
Includes the API URL and Site ID for your BeyondTrust instance.
For API reference, see: https://docs.beyondtrust.com/bt-docs/docs/secrets-api
apiUrl
string required
APIURL is the base URL of your BeyondTrust Workload Credentials API server.
This should be the full URL to your BeyondTrust instance.
Example: https://api.beyondtrust.io/siie
For more information, see: https://docs.beyondtrust.com/bt-docs/docs/secrets-api#base-url
siteId
string required
SiteID is your BeyondTrust Workload Credentials site identifier (UUID format).
This identifier is unique to your BeyondTrust Workload Credentials instance.
You can find your Site ID in the BeyondTrust Workload Credentials admin console.
Example: a1b2c3d4-e5f6-4890-abcd-ef1234567890
For more information, see: https://docs.beyondtrust.com/bt-docs/docs/secrets-api