XKeyVaultSecret¶
Experimental
This API is experimental and may change without notice.
Copies one value from a namespaced Kubernetes Secret into an XKeyVault.
API¶
| Property | Value |
|---|---|
| Group | azure.platform.example.org |
| Kind | XKeyVaultSecret |
| Plural | xkeyvaultsecrets |
| Scope | Namespaced |
| Versions | v1alpha1 (referenceable) |
| Source | compositions/apis/azure/keyvault-secret/schema.yaml |
Spec¶
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
keyVaultRef immutable |
object |
yes | — | XKeyVault selected by Kubernetes metadata.name. |
keyVaultRef.name |
string |
yes | — | Kubernetes metadata.name of the namespaced XKeyVault. |
name immutable |
string |
yes | — | Azure Key Vault secret name. |
valueSecretRef immutable |
object |
yes | — | Kubernetes Secret containing the value. |
valueSecretRef.key |
string |
yes | — | Key in the source Kubernetes Secret. |
valueSecretRef.name |
string |
yes | — | Name of the source Kubernetes Secret. |
Fields marked immutable are fixed once the resource is created; changing one is rejected by the API server. An immutable object pins the fields nested under it too. To change one, delete the resource and create it again.
Example¶
Keep the source Kubernetes Secret out of Git. Updating its value creates a new Azure Key Vault secret version. keyVaultRef.name is the referenced XKeyVault's Kubernetes metadata.name, which may differ from spec.name. The vault reference is immutable; use a new XKeyVaultSecret to copy the same source value into a replacement vault without retargeting the original.
name: appadvisor-github-client-id
spec:
name: github-oauth-client-id
keyVaultRef:
name: appadvisor
valueSecretRef:
name: appadvisor-github-oauth
key: client-id
---
apiVersion: azure.platform.example.org/v1alpha1
kind: XKeyVaultSecret
metadata:
name: appadvisor-github-client-secret
spec:
name: github-oauth-client-secret
keyVaultRef:
name: appadvisor
valueSecretRef:
name: appadvisor-github-oauth
key: client-secret
---
apiVersion: azure.platform.example.org/v1alpha1
Taken from teams/app-hosting-advisor/infrastructure.yaml,
which is applied to the cluster by Flux, so it cannot drift from a working
manifest.
Status¶
Populated by Crossplane once the underlying Azure resources exist. Every
composite in this repository exposes the provisioned Azure resource ID as
status.id.
| Field | Type | Required | Default | Description |
|---|---|---|---|---|
id |
string |
no | — | Versioned Azure Key Vault secret ID. |
versionlessId |
string |
no | — | Versionless Azure Key Vault secret ID. |
Common problems¶
The composite is Ready but has no Azure secret ID.
Cause. The referenced XKeyVault was not found or the managed secret has not produced its Azure resource ID.
Fix. Set keyVaultRef.name to the XKeyVault's Kubernetes metadata.name and wait for the managed Key Vault secret to become Ready.
The managed Secret cannot read the Kubernetes Secret.
Cause. The source Secret name, key, or namespace is incorrect.
Fix. Confirm valueSecretRef points to a Secret in the XKeyVaultSecret namespace.
An active Azure secret already exists and needs to be imported.
Cause. The provider's external-name must contain secretName/version, not just the secret name. Overwriting it makes Upjet attempt creation again.
Fix. Preserve the provider-owned external-name. The composition recovers a bare annotation from a matching observed status.atProvider.id without reading the value. If that ID is absent, verify and adopt the existing version before retrying; do not delete or purge the secret.