TeleportDatabaseV3
resources.teleport.dev / v1
apiVersion: resources.teleport.dev/v1
kind: TeleportDatabaseV3
metadata:
name: example
apiVersion
string
APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
kind
string
Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
metadata
object
spec object
Database resource definition v3 from Teleport
ad object
AD is the Active Directory configuration for the database.
domain
string
Domain is the Active Directory domain the database resides in.
kdc_host_name
string
KDCHostName is the host name for a KDC for x509 Authentication.
keytab_file
string
KeytabFile is the path to the Kerberos keytab file.
krb5_file
string
Krb5File is the path to the Kerberos configuration file. Defaults to /etc/krb5.conf.
ldap_cert
string
LDAPCert is a certificate from Windows LDAP/AD, optional; only for x509 Authentication.
ldap_service_account_name
string
LDAPServiceAccountName is the name of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
ldap_service_account_sid
string
LDAPServiceAccountSID is the SID of service account for performing LDAP queries. Required for x509 Auth / PKINIT.
spn
string
SPN is the service principal name for the database.
admin_user object
AdminUser is the database admin user for automatic user provisioning.
default_database
string
DefaultDatabase is the database that the privileged database user logs into by default. Depending on the database type, this database may be used to store procedures or data for managing database users.
name
string
Name is the username of the privileged database user.
aws object
AWS contains AWS specific settings for RDS/Aurora/Redshift databases.
account_id
string
AccountID is the AWS account ID this database belongs to.
assume_role_arn
string
AssumeRoleARN is an optional AWS role ARN to assume when accessing a database. Set this field and ExternalID to enable access across AWS accounts.
docdb object
DocumentDB contains Amazon DocumentDB-specific metadata.
cluster_id
string
ClusterID is the cluster identifier.
endpoint_type
string
EndpointType is the type of the endpoint.
instance_id
string
InstanceID is the instance identifier.
elasticache object
ElastiCache contains Amazon ElastiCache Redis-specific metadata.
endpoint_type
string
EndpointType is the type of the endpoint.
replication_group_id
string
ReplicationGroupID is the Redis replication group ID.
transit_encryption_enabled
boolean
TransitEncryptionEnabled indicates whether in-transit encryption (TLS) is enabled.
user_group_ids
[]string
UserGroupIDs is a list of user group IDs.
elasticache_serverless object
ElastiCacheServerless contains Amazon ElastiCache Serverless metadata.
cache_name
string
CacheName is an ElastiCache Serverless cache name.
external_id
string
ExternalID is an optional AWS external ID used to enable assuming an AWS role across accounts.
iam_policy_status
string | integer
IAMPolicyStatus indicates whether the IAM Policy is configured properly for database access. If not, the user must update the AWS profile identity to allow access to the Database. Eg for an RDS Database: the underlying AWS profile allows for `rds-db:connect` for the Database.
memorydb object
MemoryDB contains AWS MemoryDB specific metadata.
acl_name
string
ACLName is the name of the ACL associated with the cluster.
cluster_name
string
ClusterName is the name of the MemoryDB cluster.
endpoint_type
string
EndpointType is the type of the endpoint.
tls_enabled
boolean
TLSEnabled indicates whether in-transit encryption (TLS) is enabled.
opensearch object
OpenSearch contains AWS OpenSearch specific metadata.
domain_id
string
DomainID is the ID of the domain.
domain_name
string
DomainName is the name of the domain.
endpoint_type
string
EndpointType is the type of the endpoint.
rds object
RDS contains RDS specific metadata.
cluster_id
string
ClusterID is the RDS cluster (Aurora) identifier.
iam_auth
boolean
IAMAuth indicates whether database IAM authentication is enabled.
instance_id
string
InstanceID is the RDS instance identifier.
resource_id
string
ResourceID is the RDS instance resource identifier (db-xxx).
security_groups
[]string
SecurityGroups is a list of attached security groups for the RDS instance.
subnets
[]string
Subnets is a list of subnets for the RDS instance.
vpc_id
string
VPCID is the VPC where the RDS is running.
rdsproxy object
RDSProxy contains AWS Proxy specific metadata.
custom_endpoint_name
string
CustomEndpointName is the identifier of an RDS Proxy custom endpoint.
name
string
Name is the identifier of an RDS Proxy.
resource_id
string
ResourceID is the RDS instance resource identifier (prx-xxx).
redshift object
Redshift contains Redshift specific metadata.
cluster_id
string
ClusterID is the Redshift cluster identifier.
redshift_serverless object
RedshiftServerless contains metatada specific to Amazon Redshift Serverless.
endpoint_name
string
EndpointName is the VPC endpoint name.
workgroup_id
string
WorkgroupID is the workgroup ID.
workgroup_name
string
WorkgroupName is the workgroup name.
region
string
Region is a AWS cloud region.
secret_store object
SecretStore contains secret store configurations.
key_prefix
string
KeyPrefix specifies the secret key prefix.
kms_key_id
string
KMSKeyID specifies the AWS KMS key for encryption.
session_tags
object
SessionTags is a list of AWS STS session tags.
azure object
Azure contains Azure specific database metadata.
is_flexi_server
boolean
IsFlexiServer is true if the database is an Azure Flexible server.
name
string
Name is the Azure database server name.
redis object
Redis contains Azure Cache for Redis specific database metadata.
clustering_policy
string
ClusteringPolicy is the clustering policy for Redis Enterprise.
resource_id
string
ResourceID is the Azure fully qualified ID for the resource.
ca_cert
string
CACert is the PEM-encoded database CA certificate. DEPRECATED: Moved to TLS.CACert. DELETE IN 10.0.
dynamic_labels
object
DynamicLabels is the database dynamic labels.
gcp object
GCP contains parameters specific to GCP Cloud SQL databases.
alloydb object
AlloyDB contains AlloyDB specific configuration elements.
endpoint_override
string
EndpointOverride is an override of endpoint address to use.
endpoint_type
string
EndpointType is the database endpoint type to use. Should be one of: "private", "public", "psc".
instance_id
string
InstanceID is the Cloud SQL instance ID.
project_id
string
ProjectID is the GCP project ID the Cloud SQL instance resides in.
mongo_atlas object
MongoAtlas contains Atlas metadata about the database.
name
string
Name is the Atlas database instance name.
mysql object
MySQL is an additional section with MySQL database options.
server_version
string
ServerVersion is the server version reported by DB proxy if the runtime information is not available.
oracle object
Oracle is an additional Oracle configuration options.
audit_user
string
AuditUser is the name of the Oracle database user that should be used to access the internal audit trail.
retry_count
integer
RetryCount is the maximum number of times to retry connecting to a host upon failure. If not specified it defaults to 2, for a total of 3 connection attempts.
format:
int32
shuffle_hostnames
boolean
ShuffleHostnames, when true, randomizes the order of hosts to connect to from the provided list.
protocol
string
Protocol is the database protocol: postgres, mysql, mongodb, etc.
tls object
TLS is the TLS configuration used when establishing connection to target database. Allows to provide custom CA cert or override server name.
ca_cert
string
CACert is an optional user provided CA certificate used for verifying database TLS connection.
mode
string | integer
Mode is a TLS connection mode. 0 is "verify-full"; 1 is "verify-ca", 2 is "insecure".
server_name
string
ServerName allows to provide custom hostname. This value will override the servername/hostname on a certificate during validation.
trust_system_cert_pool
boolean
TrustSystemCertPool allows Teleport to trust certificate authorities available on the host system. If not set (by default), Teleport only trusts self-signed databases with TLS certificates signed by Teleport's Database Server CA or the ca_cert specified in this TLS setting. For cloud-hosted databases, Teleport downloads the corresponding required CAs for validation.
uri
string
URI is the database connection endpoint.
status object
Status defines the observed state of the Teleport resource
conditions []object
Conditions represent the latest available observations of an object's state
lastTransitionTime
string required
lastTransitionTime is the last time the condition transitioned from one status to another.
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
format:
date-time
message
string required
message is a human readable message indicating details about the transition.
This may be an empty string.
maxLength:
32768
observedGeneration
integer
observedGeneration represents the .metadata.generation that the condition was set based upon.
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
with respect to the current state of the instance.
format:
int64minimum:
0
reason
string required
reason contains a programmatic identifier indicating the reason for the condition's last transition.
Producers of specific condition types may define expected values and meanings for this field,
and whether the values are considered a guaranteed API.
The value should be a CamelCase string.
This field may not be empty.
pattern:
^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$minLength:
1maxLength:
1024
status
string required
status of the condition, one of True, False, Unknown.
enum:
True, False, Unknown
type
string required
type of condition in CamelCase or in foo.example.com/CamelCase.
pattern:
^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$maxLength:
316
teleportResourceID
integer
format:
int64No matches. Try .spec.ad for an exact path