keyvault.azure.com/v1api20230701

Package v1api20230701 contains API Schema definitions for the keyvault v1api20230701 API group

Resource Types:

APIVersion (`string` alias)

Value	Description
"2023-07-01"

AccessPolicyEntry

(Appears on:VaultProperties)

An identity that have access to the key vault. All identities in the array must use the same tenant ID as the key vault’s tenant ID.

Field	Description
`applicationId` string	ApplicationId: Application ID of the client making request on behalf of a principal
`applicationIdFromConfig` genruntime.ConfigMapReference	ApplicationIdFromConfig: Application ID of the client making request on behalf of a principal
`objectId` string	ObjectId: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
`objectIdFromConfig` genruntime.ConfigMapReference	ObjectIdFromConfig: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
`permissions` Permissions	Permissions: Permissions the identity has for keys, secrets and certificates.
`tenantId` string	TenantId: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
`tenantIdFromConfig` genruntime.ConfigMapReference	TenantIdFromConfig: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.

AccessPolicyEntry_STATUS

(Appears on:VaultProperties_STATUS)

An identity that have access to the key vault. All identities in the array must use the same tenant ID as the key vault’s tenant ID.

Field	Description
`applicationId` string	ApplicationId: Application ID of the client making request on behalf of a principal
`objectId` string	ObjectId: The object ID of a user, service principal or security group in the Azure Active Directory tenant for the vault. The object ID must be unique for the list of access policies.
`permissions` Permissions_STATUS	Permissions: Permissions the identity has for keys, secrets and certificates.
`tenantId` string	TenantId: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.

IPRule

(Appears on:NetworkRuleSet)

A rule governing the accessibility of a vault from a specific ip address or ip range.

Field	Description
`value` string	Value: An IPv4 address range in CIDR notation, such as ‘124.56.78.91’ (simple IP address) or ‘124.56.78.0/24’ (all addresses that start with 124.56.78).

IPRule_STATUS

(Appears on:NetworkRuleSet_STATUS)

A rule governing the accessibility of a vault from a specific ip address or ip range.

Field	Description
`value` string	Value: An IPv4 address range in CIDR notation, such as ‘124.56.78.91’ (simple IP address) or ‘124.56.78.0/24’ (all addresses that start with 124.56.78).

IdentityType_STATUS (`string` alias)

(Appears on:SystemData_STATUS)

The type of identity.

Value	Description
"Application"
"Key"
"ManagedIdentity"
"User"

NetworkRuleSet

(Appears on:VaultProperties)

A set of rules governing the network accessibility of a vault.

Field	Description
`bypass` NetworkRuleSet_Bypass	Bypass: Tells what traffic can bypass network rules. This can be ‘AzureServices’ or ‘None’. If not specified the default is ‘AzureServices’.
`defaultAction` NetworkRuleSet_DefaultAction	DefaultAction: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
`ipRules` []IPRule	IpRules: The list of IP address rules.
`virtualNetworkRules` []VirtualNetworkRule	VirtualNetworkRules: The list of virtual network rules.

NetworkRuleSet_Bypass (`string` alias)

(Appears on:NetworkRuleSet)

Value	Description
"AzureServices"
"None"

NetworkRuleSet_Bypass_STATUS (`string` alias)

(Appears on:NetworkRuleSet_STATUS)

Value	Description
"AzureServices"
"None"

NetworkRuleSet_DefaultAction (`string` alias)

(Appears on:NetworkRuleSet)

Value	Description
"Allow"
"Deny"

NetworkRuleSet_DefaultAction_STATUS (`string` alias)

(Appears on:NetworkRuleSet_STATUS)

Value	Description
"Allow"
"Deny"

NetworkRuleSet_STATUS

(Appears on:VaultProperties_STATUS)

A set of rules governing the network accessibility of a vault.

Field	Description
`bypass` NetworkRuleSet_Bypass_STATUS	Bypass: Tells what traffic can bypass network rules. This can be ‘AzureServices’ or ‘None’. If not specified the default is ‘AzureServices’.
`defaultAction` NetworkRuleSet_DefaultAction_STATUS	DefaultAction: The default action when no rule from ipRules and from virtualNetworkRules match. This is only used after the bypass property has been evaluated.
`ipRules` []IPRule_STATUS	IpRules: The list of IP address rules.
`virtualNetworkRules` []VirtualNetworkRule_STATUS	VirtualNetworkRules: The list of virtual network rules.

Permissions

(Appears on:AccessPolicyEntry)

Permissions the identity has for keys, secrets, certificates and storage.

Field	Description
`certificates` []Permissions_Certificates	Certificates: Permissions to certificates
`keys` []Permissions_Keys	Keys: Permissions to keys
`secrets` []Permissions_Secrets	Secrets: Permissions to secrets
`storage` []Permissions_Storage	Storage: Permissions to storage accounts

Permissions_Certificates (`string` alias)

(Appears on:Permissions)

Value	Description
"all"
"backup"
"create"
"delete"
"deleteissuers"
"get"
"getissuers"
"import"
"list"
"listissuers"
"managecontacts"
"manageissuers"
"purge"
"recover"
"restore"
"setissuers"
"update"

Permissions_Certificates_STATUS (`string` alias)

(Appears on:Permissions_STATUS)

Value	Description
"all"
"backup"
"create"
"delete"
"deleteissuers"
"get"
"getissuers"
"import"
"list"
"listissuers"
"managecontacts"
"manageissuers"
"purge"
"recover"
"restore"
"setissuers"
"update"

Permissions_Keys (`string` alias)

(Appears on:Permissions)

Value	Description
"all"
"backup"
"create"
"decrypt"
"delete"
"encrypt"
"get"
"getrotationpolicy"
"import"
"list"
"purge"
"recover"
"release"
"restore"
"rotate"
"setrotationpolicy"
"sign"
"unwrapKey"
"update"
"verify"
"wrapKey"

Permissions_Keys_STATUS (`string` alias)

(Appears on:Permissions_STATUS)

Value	Description
"all"
"backup"
"create"
"decrypt"
"delete"
"encrypt"
"get"
"getrotationpolicy"
"import"
"list"
"purge"
"recover"
"release"
"restore"
"rotate"
"setrotationpolicy"
"sign"
"unwrapKey"
"update"
"verify"
"wrapKey"

Permissions_STATUS

(Appears on:AccessPolicyEntry_STATUS)

Permissions the identity has for keys, secrets, certificates and storage.

Field	Description
`certificates` []Permissions_Certificates_STATUS	Certificates: Permissions to certificates
`keys` []Permissions_Keys_STATUS	Keys: Permissions to keys
`secrets` []Permissions_Secrets_STATUS	Secrets: Permissions to secrets
`storage` []Permissions_Storage_STATUS	Storage: Permissions to storage accounts

Permissions_Secrets (`string` alias)

(Appears on:Permissions)

Value	Description
"all"
"backup"
"delete"
"get"
"list"
"purge"
"recover"
"restore"
"set"

Permissions_Secrets_STATUS (`string` alias)

(Appears on:Permissions_STATUS)

Value	Description
"all"
"backup"
"delete"
"get"
"list"
"purge"
"recover"
"restore"
"set"

Permissions_Storage (`string` alias)

(Appears on:Permissions)

Value	Description
"all"
"backup"
"delete"
"deletesas"
"get"
"getsas"
"list"
"listsas"
"purge"
"recover"
"regeneratekey"
"restore"
"set"
"setsas"
"update"

Permissions_Storage_STATUS (`string` alias)

(Appears on:Permissions_STATUS)

Value	Description
"all"
"backup"
"delete"
"deletesas"
"get"
"getsas"
"list"
"listsas"
"purge"
"recover"
"regeneratekey"
"restore"
"set"
"setsas"
"update"

PrivateEndpointConnectionItem_STATUS

(Appears on:VaultProperties_STATUS)

Private endpoint connection item.

Field	Description
`etag` string	Etag: Modified whenever there is a change in the state of private endpoint connection.
`id` string	Id: Id of private endpoint connection.
`privateEndpoint` PrivateEndpoint_STATUS	PrivateEndpoint: Properties of the private endpoint object.
`privateLinkServiceConnectionState` PrivateLinkServiceConnectionState_STATUS	PrivateLinkServiceConnectionState: Approval state of the private link connection.
`provisioningState` PrivateEndpointConnectionProvisioningState_STATUS	ProvisioningState: Provisioning state of the private endpoint connection.

PrivateEndpointConnectionProvisioningState_STATUS (`string` alias)

(Appears on:PrivateEndpointConnectionItem_STATUS)

The current provisioning state.

Value	Description
"Creating"
"Deleting"
"Disconnected"
"Failed"
"Succeeded"
"Updating"

PrivateEndpointServiceConnectionStatus_STATUS (`string` alias)

(Appears on:PrivateLinkServiceConnectionState_STATUS)

The private endpoint connection status.

Value	Description
"Approved"
"Disconnected"
"Pending"
"Rejected"

PrivateEndpoint_STATUS

(Appears on:PrivateEndpointConnectionItem_STATUS)

Private endpoint object properties.

Field	Description
`id` string	Id: Full identifier of the private endpoint resource.

PrivateLinkServiceConnectionState_ActionsRequired_STATUS (`string` alias)

(Appears on:PrivateLinkServiceConnectionState_STATUS)

Value	Description
"None"

PrivateLinkServiceConnectionState_STATUS

(Appears on:PrivateEndpointConnectionItem_STATUS)

An object that represents the approval state of the private link connection.

Field	Description
`actionsRequired` PrivateLinkServiceConnectionState_ActionsRequired_STATUS	ActionsRequired: A message indicating if changes on the service provider require any updates on the consumer.
`description` string	Description: The reason for approval or rejection.
`status` PrivateEndpointServiceConnectionStatus_STATUS	Status: Indicates whether the connection has been approved, rejected or removed by the key vault owner.

Sku

(Appears on:VaultProperties)

SKU details

Field	Description
`family` Sku_Family	Family: SKU family name
`name` Sku_Name	Name: SKU name to specify whether the key vault is a standard vault or a premium vault.

Sku_Family (`string` alias)

(Appears on:Sku)

Value	Description
"A"

Sku_Family_STATUS (`string` alias)

(Appears on:Sku_STATUS)

Value	Description
"A"

Sku_Name (`string` alias)

(Appears on:Sku)

Value	Description
"premium"
"standard"

Sku_Name_STATUS (`string` alias)

(Appears on:Sku_STATUS)

Value	Description
"premium"
"standard"

Sku_STATUS

(Appears on:VaultProperties_STATUS)

SKU details

Field	Description
`family` Sku_Family_STATUS	Family: SKU family name
`name` Sku_Name_STATUS	Name: SKU name to specify whether the key vault is a standard vault or a premium vault.

SystemData_STATUS

(Appears on:Vault_STATUS)

Metadata pertaining to creation and last modification of the key vault resource.

Field	Description
`createdAt` string	CreatedAt: The timestamp of the key vault resource creation (UTC).
`createdBy` string	CreatedBy: The identity that created the key vault resource.
`createdByType` IdentityType_STATUS	CreatedByType: The type of identity that created the key vault resource.
`lastModifiedAt` string	LastModifiedAt: The timestamp of the key vault resource last modification (UTC).
`lastModifiedBy` string	LastModifiedBy: The identity that last modified the key vault resource.
`lastModifiedByType` IdentityType_STATUS	LastModifiedByType: The type of identity that last modified the key vault resource.

Vault

Generator information: - Generated from: /keyvault/resource-manager/Microsoft.KeyVault/stable/2023-07-01/keyvault.json - ARM URI: /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.KeyVault/vaults/{vaultName}

Field Description

metadata
Kubernetes meta/v1.ObjectMeta Refer to the Kubernetes API documentation for the fields of the metadata field.

spec
Vault_Spec

`azureName` string	AzureName: The name of the resource in Azure. This is often the same as the name of the resource in Kubernetes but it doesn’t have to be.
`location` string	Location: The supported Azure location where the key vault should be created.
`operatorSpec` VaultOperatorSpec	OperatorSpec: The specification for configuring operator behavior. This field is interpreted by the operator and not passed directly to Azure
`owner` genruntime.KnownResourceReference	Owner: The owner of the resource. The owner controls where the resource goes when it is deployed. The owner also controls the resources lifecycle. When the owner is deleted the resource will also be deleted. Owner is expected to be a reference to a resources.azure.com/ResourceGroup resource
`properties` VaultProperties	Properties: Properties of the vault
`tags` map[string]string	Tags: The tags that will be assigned to the key vault.

status
Vault_STATUS

VaultOperatorSpec

(Appears on:Vault_Spec)

Details for configuring operator behavior. Fields in this struct are interpreted by the operator directly rather than being passed to Azure

Field	Description
`configMapExpressions` []genruntime/core.DestinationExpression	ConfigMapExpressions: configures where to place operator written dynamic ConfigMaps (created with CEL expressions).
`secretExpressions` []genruntime/core.DestinationExpression	SecretExpressions: configures where to place operator written dynamic secrets (created with CEL expressions).

VaultProperties

(Appears on:Vault_Spec)

Properties of the vault

Field	Description
`accessPolicies` []AccessPolicyEntry	AccessPolicies: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault’s tenant ID. When `createMode` is set to `recover`, access policies are not required. Otherwise, access policies are required.
`createMode` VaultProperties_CreateMode	CreateMode: The vault’s create mode to indicate whether the vault need to be recovered or not.
`enablePurgeProtection` bool	EnablePurgeProtection: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
`enableRbacAuthorization` bool	EnableRbacAuthorization: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
`enableSoftDelete` bool	EnableSoftDelete: Property to specify whether the ‘soft delete’ functionality is enabled for this key vault. If it’s not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
`enabledForDeployment` bool	EnabledForDeployment: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
`enabledForDiskEncryption` bool	EnabledForDiskEncryption: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
`enabledForTemplateDeployment` bool	EnabledForTemplateDeployment: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
`networkAcls` NetworkRuleSet	NetworkAcls: Rules governing the accessibility of the key vault from specific network locations.
`provisioningState` VaultProperties_ProvisioningState	ProvisioningState: Provisioning state of the vault.
`publicNetworkAccess` string	PublicNetworkAccess: Property to specify whether the vault will accept traffic from public internet. If set to ‘disabled’ all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
`sku` Sku	Sku: SKU details
`softDeleteRetentionInDays` int	SoftDeleteRetentionInDays: softDelete data retention days. It accepts >=7 and <=90.
`tenantId` string	TenantId: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
`tenantIdFromConfig` genruntime.ConfigMapReference	TenantIdFromConfig: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
`vaultUri` string	VaultUri: The URI of the vault for performing operations on keys and secrets.

VaultProperties_CreateMode (`string` alias)

(Appears on:VaultProperties)

Value	Description
"createOrRecover"
"default"
"purgeThenCreate"
"recover"

VaultProperties_CreateMode_STATUS (`string` alias)

(Appears on:VaultProperties_STATUS)

Value	Description
"createOrRecover"
"default"
"purgeThenCreate"
"recover"

VaultProperties_ProvisioningState (`string` alias)

(Appears on:VaultProperties)

Value	Description
"RegisteringDns"
"Succeeded"

VaultProperties_ProvisioningState_STATUS (`string` alias)

(Appears on:VaultProperties_STATUS)

Value	Description
"RegisteringDns"
"Succeeded"

VaultProperties_STATUS

(Appears on:Vault_STATUS)

Properties of the vault

Field	Description
`accessPolicies` []AccessPolicyEntry_STATUS	AccessPolicies: An array of 0 to 1024 identities that have access to the key vault. All identities in the array must use the same tenant ID as the key vault’s tenant ID. When `createMode` is set to `recover`, access policies are not required. Otherwise, access policies are required.
`createMode` VaultProperties_CreateMode_STATUS	CreateMode: The vault’s create mode to indicate whether the vault need to be recovered or not.
`enablePurgeProtection` bool	EnablePurgeProtection: Property specifying whether protection against purge is enabled for this vault. Setting this property to true activates protection against purge for this vault and its content - only the Key Vault service may initiate a hard, irrecoverable deletion. The setting is effective only if soft delete is also enabled. Enabling this functionality is irreversible - that is, the property does not accept false as its value.
`enableRbacAuthorization` bool	EnableRbacAuthorization: Property that controls how data actions are authorized. When true, the key vault will use Role Based Access Control (RBAC) for authorization of data actions, and the access policies specified in vault properties will be ignored. When false, the key vault will use the access policies specified in vault properties, and any policy stored on Azure Resource Manager will be ignored. If null or not specified, the vault is created with the default value of false. Note that management actions are always authorized with RBAC.
`enableSoftDelete` bool	EnableSoftDelete: Property to specify whether the ‘soft delete’ functionality is enabled for this key vault. If it’s not set to any value(true or false) when creating new key vault, it will be set to true by default. Once set to true, it cannot be reverted to false.
`enabledForDeployment` bool	EnabledForDeployment: Property to specify whether Azure Virtual Machines are permitted to retrieve certificates stored as secrets from the key vault.
`enabledForDiskEncryption` bool	EnabledForDiskEncryption: Property to specify whether Azure Disk Encryption is permitted to retrieve secrets from the vault and unwrap keys.
`enabledForTemplateDeployment` bool	EnabledForTemplateDeployment: Property to specify whether Azure Resource Manager is permitted to retrieve secrets from the key vault.
`hsmPoolResourceId` string	HsmPoolResourceId: The resource id of HSM Pool.
`networkAcls` NetworkRuleSet_STATUS	NetworkAcls: Rules governing the accessibility of the key vault from specific network locations.
`privateEndpointConnections` []PrivateEndpointConnectionItem_STATUS	PrivateEndpointConnections: List of private endpoint connections associated with the key vault.
`provisioningState` VaultProperties_ProvisioningState_STATUS	ProvisioningState: Provisioning state of the vault.
`publicNetworkAccess` string	PublicNetworkAccess: Property to specify whether the vault will accept traffic from public internet. If set to ‘disabled’ all traffic except private endpoint traffic and that that originates from trusted services will be blocked. This will override the set firewall rules, meaning that even if the firewall rules are present we will not honor the rules.
`sku` Sku_STATUS	Sku: SKU details
`softDeleteRetentionInDays` int	SoftDeleteRetentionInDays: softDelete data retention days. It accepts >=7 and <=90.
`tenantId` string	TenantId: The Azure Active Directory tenant ID that should be used for authenticating requests to the key vault.
`vaultUri` string	VaultUri: The URI of the vault for performing operations on keys and secrets.

Vault_STATUS

(Appears on:Vault)

Resource information with extended details.

Field	Description
`conditions` []genruntime/conditions.Condition	Conditions: The observed state of the resource
`id` string	Id: Fully qualified identifier of the key vault resource.
`location` string	Location: Azure location of the key vault resource.
`name` string	Name: Name of the key vault resource.
`properties` VaultProperties_STATUS	Properties: Properties of the vault
`systemData` SystemData_STATUS	SystemData: System metadata for the key vault.
`tags` map[string]string	Tags: Tags assigned to the key vault resource.
`type` string	Type: Resource type of the key vault resource.

Vault_Spec

(Appears on:Vault)

Field	Description
`azureName` string	AzureName: The name of the resource in Azure. This is often the same as the name of the resource in Kubernetes but it doesn’t have to be.
`location` string	Location: The supported Azure location where the key vault should be created.
`operatorSpec` VaultOperatorSpec	OperatorSpec: The specification for configuring operator behavior. This field is interpreted by the operator and not passed directly to Azure
`owner` genruntime.KnownResourceReference	Owner: The owner of the resource. The owner controls where the resource goes when it is deployed. The owner also controls the resources lifecycle. When the owner is deleted the resource will also be deleted. Owner is expected to be a reference to a resources.azure.com/ResourceGroup resource
`properties` VaultProperties	Properties: Properties of the vault
`tags` map[string]string	Tags: The tags that will be assigned to the key vault.

VirtualNetworkRule

(Appears on:NetworkRuleSet)

A rule governing the accessibility of a vault from a specific virtual network.

Field	Description
`ignoreMissingVnetServiceEndpoint` bool	IgnoreMissingVnetServiceEndpoint: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.
`reference` genruntime.ResourceReference	Reference: Full resource id of a vnet subnet, such as ‘/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1’.

VirtualNetworkRule_STATUS

(Appears on:NetworkRuleSet_STATUS)

A rule governing the accessibility of a vault from a specific virtual network.

Field	Description
`id` string	Id: Full resource id of a vnet subnet, such as ‘/subscriptions/subid/resourceGroups/rg1/providers/Microsoft.Network/virtualNetworks/test-vnet/subnets/subnet1’.
`ignoreMissingVnetServiceEndpoint` bool	IgnoreMissingVnetServiceEndpoint: Property to specify whether NRP will ignore the check if parent subnet has serviceEndpoints configured.

keyvault.azure.com/v1api20230701