From bf789304c3951ede2e88223bf5de7d513884f86e Mon Sep 17 00:00:00 2001 From: Krzysztof Ostrowski Date: Thu, 27 Aug 2026 10:10:14 +0200 Subject: [PATCH 1/2] config/v1: remove kmsPluginImage from vault KMS config Plugin images are sourced by the platform: the OLM-managed KMS plugin provider ConfigMap or the release payload delivers the plugin image (ref openshift/enhancements#2082). Users must not choose plugin images themselves, so the field is removed while the API is still TechPreview behind the KMSEncryption feature gate. The field name is tombstoned in VaultKMSPluginConfig to reserve it and prevent reuse. Generated artifacts are updated in the follow-up commit. --- .../KMSEncryption.yaml | 1 - .../VaultKMS.yaml | 222 ------------------ config/v1/types_kmsencryption.go | 41 ++-- 3 files changed, 17 insertions(+), 247 deletions(-) diff --git a/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml index b0e0e05cf5c..16c4fd36f2f 100644 --- a/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/tests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -69,7 +69,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole diff --git a/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml b/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml index b37f2841a19..272f773e6fa 100644 --- a/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml +++ b/config/v1/tests/apiservers.config.openshift.io/VaultKMS.yaml @@ -16,7 +16,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -35,45 +34,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - - - name: Should accept kmsPluginImage with simple two-level path like quay.io/vault/kms-plugin - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: quay.io/vault/kms-plugin@sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789 - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - expected: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - audit: - profile: Default - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: quay.io/vault/kms-plugin@sha256:abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789 vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -92,7 +52,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/hashicorp/vault-plugin@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890 vaultAddress: https://vault.prod.example.com:8200 vaultNamespace: my-team vaultAuthNamespace: central-auth @@ -117,7 +76,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/hashicorp/vault-plugin@sha256:abcdef1234567890abcdef1234567890abcdef1234567890abcdef1234567890 vaultAddress: https://vault.prod.example.com:8200 vaultNamespace: my-team vaultAuthNamespace: central-auth @@ -132,83 +90,6 @@ tests: name: vault-approle-credentials vaultKeyPath: custom/transit/path/keys/production-encryption-key - # Multi-level namespace path tests - - name: Should accept kmsPluginImage with multi-level namespace path - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.example.com/org/team/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - expected: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - audit: - profile: Default - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.example.com/org/team/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - - - name: Should accept kmsPluginImage with deep multi-level namespace path - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.io/org_name/team.name/project/subproject/vault_plugin@sha256:abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234 - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - expected: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - audit: - profile: Default - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.io/org_name/team.name/project/subproject/vault_plugin@sha256:abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234abcd1234 - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-encryption-key - # vaultKeyPath valid tests - name: Should accept vaultKeyPath with multi-segment mount initial: | @@ -220,7 +101,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -239,7 +119,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -258,7 +137,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -277,7 +155,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -296,7 +173,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -315,7 +191,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -334,7 +209,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -353,7 +227,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -373,7 +246,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -393,7 +265,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -413,7 +284,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -433,7 +303,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -453,7 +322,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -473,7 +341,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -493,7 +360,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -513,7 +379,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -533,7 +398,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -553,7 +417,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -574,7 +437,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -606,74 +468,12 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole vaultKeyPath: transit/keys/my-key expectedError: "appRole config is required when authentication type is AppRole" - # kmsPluginImage validation tests - - name: Should reject kmsPluginImage with tag instead of digest - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.example.com/vault-plugin:latest - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-key - expectedError: "the OCI Image reference must end with a valid '@sha256:' suffix" - - - name: Should reject kmsPluginImage without registry hostname - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-key - expectedError: "the OCI Image name should follow the host[:port][/namespace]/name format" - - - name: Should reject kmsPluginImage with invalid digest length - initial: | - apiVersion: config.openshift.io/v1 - kind: APIServer - spec: - encryption: - type: KMS - kms: - type: Vault - vault: - kmsPluginImage: registry.example.com/vault@sha256:abc123 - vaultAddress: https://vault.example.com:8200 - authentication: - type: AppRole - appRole: - secret: - name: vault-approle - vaultKeyPath: transit/keys/my-key - expectedError: "the OCI Image reference must end with a valid '@sha256:' suffix, where '' is 64 characters long" - # vaultAddress validation tests - name: Should reject vaultAddress with http scheme initial: | @@ -685,7 +485,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: http://vault.example.com:8200 authentication: type: AppRole @@ -705,7 +504,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200/v1 authentication: type: AppRole @@ -725,7 +523,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200?key=value authentication: type: AppRole @@ -745,7 +542,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200#fragment authentication: type: AppRole @@ -765,7 +561,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://user:password@vault.example.com:8200 authentication: type: AppRole @@ -786,7 +581,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: my-namespace/ authentication: @@ -807,7 +601,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: my namespace authentication: @@ -828,7 +621,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: root authentication: @@ -849,7 +641,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: sys authentication: @@ -870,7 +661,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: audit authentication: @@ -891,7 +681,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: auth authentication: @@ -912,7 +701,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: cubbyhole authentication: @@ -933,7 +721,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: identity authentication: @@ -955,7 +742,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: transit-ns vaultAuthNamespace: auth-ns @@ -976,7 +762,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultNamespace: transit-ns vaultAuthNamespace: auth-ns @@ -997,7 +782,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: my-auth-ns/ authentication: @@ -1018,7 +802,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: my auth ns authentication: @@ -1039,7 +822,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: root authentication: @@ -1060,7 +842,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 vaultAuthNamespace: identity authentication: @@ -1082,7 +863,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 tls: serverName: invalid_hostname! @@ -1105,7 +885,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 authentication: type: AppRole @@ -1125,7 +904,6 @@ tests: kms: type: Vault vault: - kmsPluginImage: registry.example.com/vault-plugin@sha256:0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef vaultAddress: https://vault.example.com:8200 tls: caBundle: diff --git a/config/v1/types_kmsencryption.go b/config/v1/types_kmsencryption.go index e2f94ae1f37..ec7f05e15f0 100644 --- a/config/v1/types_kmsencryption.go +++ b/config/v1/types_kmsencryption.go @@ -122,30 +122,6 @@ type VaultAppRoleAuthentication struct { // VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS type VaultKMSPluginConfig struct { - // kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - // - // The image must be a fully qualified OCI image pull spec with a SHA256 digest. - // The format is: host[:port][/namespace]/name@sha256: - // where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - // The total length must be between 75 and 447 characters. - // - // Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - // The registry hostname must be included and must contain at least one dot. - // Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - // - // Consult the OpenShift documentation for compatible plugin versions with your cluster version, - // then obtain the image digest for that version from HashiCorp's container registry. - // - // For disconnected environments, mirror the plugin image to an accessible registry - // and reference the mirrored location with its digest. - // - // +kubebuilder:validation:MinLength=75 - // +kubebuilder:validation:MaxLength=447 - // +kubebuilder:validation:XValidation:rule=`(self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))`,message="the OCI Image reference must end with a valid '@sha256:' suffix, where '' is 64 characters long" - // +kubebuilder:validation:XValidation:rule=`(self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))`,message="the OCI Image name should follow the host[:port][/namespace]/name format, resembling a valid URL without the scheme. Short names are not allowed, the registry hostname must be included." - // +required - KMSPluginImage string `json:"kmsPluginImage,omitempty"` - // vaultAddress specifies the address of the HashiCorp Vault instance. // The value must be a valid HTTPS URL containing only scheme, host, and optional port. // Paths, user info, query parameters, and fragments are not allowed. @@ -264,6 +240,23 @@ type VaultKMSPluginConfig struct { // +kubebuilder:validation:XValidation:rule="self.matches('^[a-zA-Z0-9._-]+$')",message="transitKey must only contain alphanumeric characters, hyphens, periods, and underscores" // +required // TransitKey string `json:"transitKey,omitempty"` + + // --- TOMBSTONE --- + // kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. + // Image sourcing has moved to the platform, which resolves the plugin image from the + // KMS plugin provider ConfigMap rather than from this resource (openshift/enhancements#2082). + // The field name is reserved to prevent reuse. + // + // The image had to be a fully qualified OCI image pull spec with a SHA256 digest, + // in the format host[:port][/namespace]/name@sha256:, between 75 and 447 + // characters. Short names and image tags were not allowed. + // + // +kubebuilder:validation:MinLength=75 + // +kubebuilder:validation:MaxLength=447 + // +kubebuilder:validation:XValidation:rule=`(self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$'))`,message="the OCI Image reference must end with a valid '@sha256:' suffix, where '' is 64 characters long" + // +kubebuilder:validation:XValidation:rule=`(self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$'))`,message="the OCI Image name should follow the host[:port][/namespace]/name format, resembling a valid URL without the scheme. Short names are not allowed, the registry hostname must be included." + // +required + // KMSPluginImage string `json:"kmsPluginImage,omitempty"` } // VaultTLSConfig contains TLS configuration for connecting to Vault. From ad7c6278ca7ee5a2407c90d993b4dab3bc274577 Mon Sep 17 00:00:00 2001 From: Krzysztof Ostrowski Date: Thu, 27 Aug 2026 10:10:15 +0200 Subject: [PATCH 2/2] config/v1: regenerate after kmsPluginImage removal Result of `make update`. No hand-written changes. --- ...tor_01_apiservers-CustomNoUpgrade.crd.yaml | 32 ------------------- ...01_apiservers-DevPreviewNoUpgrade.crd.yaml | 32 ------------------- ...1_apiservers-TechPreviewNoUpgrade.crd.yaml | 32 ------------------- .../KMSEncryption.yaml | 32 ------------------- .../v1/zz_generated.swagger_doc_generated.go | 1 - .../generated_openapi/zz_generated.openapi.go | 9 +----- openapi/openapi.json | 5 --- ...tor_01_apiservers-CustomNoUpgrade.crd.yaml | 32 ------------------- ...01_apiservers-DevPreviewNoUpgrade.crd.yaml | 32 ------------------- ...1_apiservers-TechPreviewNoUpgrade.crd.yaml | 32 ------------------- 10 files changed, 1 insertion(+), 238 deletions(-) diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..e213c75c532 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -235,37 +235,6 @@ spec: type is AppRole, and forbidden otherwise rule: 'self.type == ''AppRole'' ? has(self.appRole) : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,7 +406,6 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..e09b41b7659 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -235,37 +235,6 @@ spec: type is AppRole, and forbidden otherwise rule: 'self.type == ''AppRole'' ? has(self.appRole) : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,7 +406,6 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..f4b9f905677 100644 --- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -235,37 +235,6 @@ spec: type is AppRole, and forbidden otherwise rule: 'self.type == ''AppRole'' ? has(self.appRole) : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,7 +406,6 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml index 22c41067598..c9d08b54fe8 100644 --- a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml +++ b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryption.yaml @@ -235,37 +235,6 @@ spec: type is AppRole, and forbidden otherwise rule: 'self.type == ''AppRole'' ? has(self.appRole) : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,7 +406,6 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object diff --git a/config/v1/zz_generated.swagger_doc_generated.go b/config/v1/zz_generated.swagger_doc_generated.go index 0f4605ef380..f0e1a00815a 100644 --- a/config/v1/zz_generated.swagger_doc_generated.go +++ b/config/v1/zz_generated.swagger_doc_generated.go @@ -2504,7 +2504,6 @@ func (VaultConfigMapReference) SwaggerDoc() map[string]string { var map_VaultKMSPluginConfig = map[string]string{ "": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", - "kmsPluginImage": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", "vaultAddress": "vaultAddress specifies the address of the HashiCorp Vault instance. The value must be a valid HTTPS URL containing only scheme, host, and optional port. Paths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port] Example: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", "vaultNamespace": "vaultNamespace specifies the Vault namespace where the Transit secrets engine is mounted. This is only applicable for Vault Enterprise installations. When this field is not set, no namespace is used.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", "vaultAuthNamespace": "vaultAuthNamespace specifies the Vault namespace to use for authentication. This is only applicable for Vault Enterprise installations where authentication and Transit operations may be in different namespaces. When this field is not set, the value of vaultNamespace is used for both authentication and Transit key operations.\n\nThe value must be between 1 and 4096 characters. The namespace cannot end with a forward slash, cannot contain spaces, and cannot be one of the reserved strings: root, sys, audit, auth, cubbyhole, or identity.", diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go index fca44ab01e8..604c6bb0468 100644 --- a/openapi/generated_openapi/zz_generated.openapi.go +++ b/openapi/generated_openapi/zz_generated.openapi.go @@ -23198,13 +23198,6 @@ func schema_openshift_api_config_v1_VaultKMSPluginConfig(ref common.ReferenceCal Description: "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", Type: []string{"object"}, Properties: map[string]spec.Schema{ - "kmsPluginImage": { - SchemaProps: spec.SchemaProps{ - Description: "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", - Type: []string{"string"}, - Format: "", - }, - }, "vaultAddress": { SchemaProps: spec.SchemaProps{ Description: "vaultAddress specifies the address of the HashiCorp Vault instance. The value must be a valid HTTPS URL containing only scheme, host, and optional port. Paths, user info, query parameters, and fragments are not allowed.\n\nFormat: https://hostname[:port] Example: https://vault.example.com:8200\n\nThe value must be between 1 and 512 characters.", @@ -23248,7 +23241,7 @@ func schema_openshift_api_config_v1_VaultKMSPluginConfig(ref common.ReferenceCal }, }, }, - Required: []string{"kmsPluginImage", "vaultAddress", "authentication", "vaultKeyPath"}, + Required: []string{"vaultAddress", "authentication", "vaultKeyPath"}, }, }, Dependencies: []string{ diff --git a/openapi/openapi.json b/openapi/openapi.json index 1c675ce4c5b..e06752c82cd 100644 --- a/openapi/openapi.json +++ b/openapi/openapi.json @@ -12594,7 +12594,6 @@ "description": "VaultKMSPluginConfig defines the KMS plugin configuration specific to Vault KMS", "type": "object", "required": [ - "kmsPluginImage", "vaultAddress", "authentication", "vaultKeyPath" @@ -12605,10 +12604,6 @@ "default": {}, "$ref": "#/definitions/com.github.openshift.api.config.v1.VaultAuthentication" }, - "kmsPluginImage": { - "description": "kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin.\n\nThe image must be a fully qualified OCI image pull spec with a SHA256 digest. The format is: host[:port][/namespace]/name@sha256: where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. The total length must be between 75 and 447 characters.\n\nShort names (e.g., \"vault-plugin\" or \"hashicorp/vault-plugin\") are not allowed. The registry hostname must be included and must contain at least one dot. Image tags (e.g., \":latest\", \":v1.0.0\") are not allowed.\n\nConsult the OpenShift documentation for compatible plugin versions with your cluster version, then obtain the image digest for that version from HashiCorp's container registry.\n\nFor disconnected environments, mirror the plugin image to an accessible registry and reference the mirrored location with its digest.", - "type": "string" - }, "tls": { "description": "tls contains the TLS configuration for connecting to the Vault server. When this field is not set, system default TLS settings are used.", "default": {}, diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml index f3793fac61d..e213c75c532 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml @@ -235,37 +235,6 @@ spec: type is AppRole, and forbidden otherwise rule: 'self.type == ''AppRole'' ? has(self.appRole) : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,7 +406,6 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml index d06cd26ca79..e09b41b7659 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml @@ -235,37 +235,6 @@ spec: type is AppRole, and forbidden otherwise rule: 'self.type == ''AppRole'' ? has(self.appRole) : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,7 +406,6 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml index cce33594546..f4b9f905677 100644 --- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml +++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml @@ -235,37 +235,6 @@ spec: type is AppRole, and forbidden otherwise rule: 'self.type == ''AppRole'' ? has(self.appRole) : !has(self.appRole)' - kmsPluginImage: - description: |- - kmsPluginImage specifies the container image for the HashiCorp Vault KMS plugin. - - The image must be a fully qualified OCI image pull spec with a SHA256 digest. - The format is: host[:port][/namespace]/name@sha256: - where the digest must be 64 characters long and consist only of lowercase hexadecimal characters, a-f and 0-9. - The total length must be between 75 and 447 characters. - - Short names (e.g., "vault-plugin" or "hashicorp/vault-plugin") are not allowed. - The registry hostname must be included and must contain at least one dot. - Image tags (e.g., ":latest", ":v1.0.0") are not allowed. - - Consult the OpenShift documentation for compatible plugin versions with your cluster version, - then obtain the image digest for that version from HashiCorp's container registry. - - For disconnected environments, mirror the plugin image to an accessible registry - and reference the mirrored location with its digest. - maxLength: 447 - minLength: 75 - type: string - x-kubernetes-validations: - - message: the OCI Image reference must end with a valid - '@sha256:' suffix, where '' is 64 - characters long - rule: (self.split('@').size() == 2 && self.split('@')[1].matches('^sha256:[a-f0-9]{64}$')) - - message: the OCI Image name should follow the host[:port][/namespace]/name - format, resembling a valid URL without the scheme. - Short names are not allowed, the registry hostname - must be included. - rule: (self.split('@')[0].matches('^([a-zA-Z0-9-]+\\.)+[a-zA-Z0-9-]+(:[0-9]{2,5})?(/[a-zA-Z0-9-_.]+)+$')) tls: description: |- tls contains the TLS configuration for connecting to the Vault server. @@ -437,7 +406,6 @@ spec: ''cubbyhole'', ''identity''])' required: - authentication - - kmsPluginImage - vaultAddress - vaultKeyPath type: object