GarageAdminToken

garage.rajsingh.info / v1beta1

apiVersion: garage.rajsingh.info/v1beta1 kind: GarageAdminToken metadata: name: example

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object required

GarageAdminTokenSpec defines the desired state of GarageAdminToken. GarageAdminToken provisions a static bootstrap Secret for the Garage Admin HTTP API. The referenced GarageCluster must explicitly select this Secret in spec.admin.adminTokenSecretRef. This resource does not create a row in Garage's dynamic Admin-token table, and deletion does not revoke bytes that a running Garage process already loaded at startup. Admin tokens authenticate differently from S3 keys (GarageKey) — they use Bearer token auth against the admin port (default 3903) instead of HMAC-SHA256. Static configured tokens always have full admin access and no server-side name, scope, or expiry metadata. Use Garage's Admin API directly for a user-managed scoped/dynamic token.

clusterRef object required

ClusterRef references the GarageCluster this token belongs to

kubeConfigSecretRef object

KubeConfigSecretRef is reserved for a future remote Kubernetes client integration. It is currently rejected by admission because the operator does not use it.

key string required

The key of the secret to select from. Must be a valid secret key.

name string

Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

optional boolean

Specify whether the Secret or its key must be defined

name string required

Name of the GarageCluster resource.

namespace string

Namespace of the GarageCluster. Defaults to the referencing resource's namespace. Cross-namespace references require a GarageReferenceGrant where supported by the owning resource. GarageNode and GarageAdminToken reject them.

expiresAt string

ExpiresAt is retained for compatibility but rejected because static configured tokens have no Garage-side expiry or revocation record.

format: date-time

name string

Name is retained for compatibility but rejected because static bootstrap material has no Garage-side friendly name.

neverExpires boolean

NeverExpires is retained for compatibility. Static configured tokens are always non-expiring, so this field is deprecated and has no effect.

secretTemplate object

SecretTemplate configures how the secret containing the token is generated

annotations object

Annotations to add to the secret

endpointKey string

EndpointKey is the key name for the admin endpoint

includeEndpoint boolean

IncludeEndpoint includes the admin API endpoint in the secret Defaults to true if not specified

labels object

Labels to add to the secret

name string

Name is the name of the secret to create Defaults to the GarageAdminToken name

tokenKey string

TokenKey is the key name for the admin token in the secret

status object

GarageAdminTokenStatus defines the observed state of GarageAdminToken

conditions []object

Conditions represent the current state

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

expiresAt string

ExpiresAt is deprecated and always cleared because static configured tokens have no Garage-side expiry record.

format: date-time

observedGeneration integer

ObservedGeneration is the last observed generation

format: int64

phase string

Phase represents the current phase

enum: Pending, Creating, Ready, Deleting, Failed, Expired, Unknown

secretRef object

SecretRef references the created secret

name string

name is unique within a namespace to reference a secret resource.

namespace string

namespace defines the space within which the secret name must be unique.

tokenDigest string

TokenDigest is the full SHA-256 digest of the static bearer. The controller uses it to detect mutation of an existing generated Secret without exposing any bearer bytes.

tokenId string

TokenID is a short display fingerprint of the generated static token. It is not a Garage-assigned dynamic token ID.

No matches. Try .spec.clusterRef for an exact path