@@ -92,27 +92,30 @@ Use these links to navigate to a particular top-level stanza.
9292 - antarctica-east1
9393 - antarctica-west1
9494
95- - `topologySpreadConstraints` ((#v-controller-topologyspreadconstraints)) (`array: []`) - TopologySpreadConstraints settings for vault-secrets-operator pod.
96- The value is an array of PodSpec TopologySpreadConstraint maps.
97- A labelSelector for the pods will be added automatically to the template in case it is not set .
95+ - `topologySpreadConstraints` ((#v-controller-topologyspreadconstraints)) (`array: []`) - Topology spread constraint settings for the ` vault-secrets-operator` pod
96+ as an array of PodSpec `topologySpreadConstraints` maps.
97+ VSO automatically adds a `labelSelector` entry to the templates if you do not provide a value .
9898 ref: https://kubernetes.io/docs/concepts/scheduling-eviction/topology-spread-constraints/
9999 Example:
100+
101+ ```yaml
100102 topologySpreadConstraints:
101103 - maxSkew: 1
102104 topologyKey: zone
103105 whenUnsatisfiable: DoNotSchedule
106+ ```
104107
105- - `podDisruptionBudget` ((#v-controller-poddisruptionbudget)) - Configure the PodDisruptionBudget for the controller deployment.
108+ - `podDisruptionBudget` ((#v-controller-poddisruptionbudget)) - Configures the PodDisruptionBudget for the controller deployment.
106109
107- - `enabled` ((#v-controller-poddisruptionbudget-enabled)) (`boolean: false`) - toggles the deployment of the PodDisruptionBudget for the controller.
110+ - `enabled` ((#v-controller-poddisruptionbudget-enabled)) (`boolean: false`) - Toggles the deployment of the PodDisruptionBudget for the controller.
108111
109- - `maxUnavailable` ((#v-controller-poddisruptionbudget-maxunavailable)) (`string: 0`) - Sets the maximum number of pods that can be unavailable during the eviction.
110- This field cannot be set if minAvailable is set .
111- Can be set as an integer (e.g. " 2" ) or a percentage (e.g. " 50%" ).
112+ - `maxUnavailable` ((#v-controller-poddisruptionbudget-maxunavailable)) (`string: 0`) - Sets the maximum number of unavailable pods during eviction.
113+ You cannot set both `maxUnavailable` and `minAvailable` .
114+ You can specify `maxUnavailable` as an integer ("2") or a percentage ("50%").
112115
113- - `minAvailable` ((#v-controller-poddisruptionbudget-minavailable)) (`string: 0`) - Sets the number of pods that must be available during the eviction.
114- This field cannot be set if maxUnavailable is set .
115- Can be set as an integer (e.g. " 2" ) or a percentage (e.g. " 50%" ).
116+ - `minAvailable` ((#v-controller-poddisruptionbudget-minavailable)) (`string: 0`) - Sets the minimum number of available pods allowed during eviction.
117+ You cannot set both `minAvailable` and `maxUnavailable` .
118+ You can specify `minAvailable` as an integer ("2") or a percentage ("50%").
116119
117120 - `rbac` ((#v-controller-rbac))
118121
@@ -204,7 +207,7 @@ Use these links to navigate to a particular top-level stanza.
204207
205208 - `repository` ((#v-controller-manager-image-repository)) (`string: hashicorp/vault-secrets-operator`)
206209
207- - `tag` ((#v-controller-manager-image-tag)) (`string: 0.10.0 `)
210+ - `tag` ((#v-controller-manager-image-tag)) (`string: 1.0.1 `)
208211
209212 - `logging` ((#v-controller-manager-logging)) - logging
210213
@@ -213,7 +216,13 @@ Use these links to navigate to a particular top-level stanza.
213216 Default: info
214217
215218 - `timeEncoding` ((#v-controller-manager-logging-timeencoding)) (`string: rfc3339`) - Sets the time encoding for the operator.
216- Options are: epoch, millis, nano, iso8601, rfc3339, rfc3339nano
219+ Options are:
220+ - `epoch` - Unix timestamp in seconds (e.g. 1695382800)
221+ - `millis` - Unix timestamp in milliseconds (e.g. 1695382800000)
222+ - `nano` - Unix timestamp in nanoseconds (e.g. 1695382800000000000)
223+ - `iso8601` - ISO 8601 format (e.g. 2023-09-22T10:00:00Z)
224+ - `rfc3339` - RFC 3339 format (e.g. 2023-09-22T10:00:00Z)
225+ - `rfc3339nano` - RFC 3339 format with nanosecond precision (e.g. 2023-09-22T10:00:00.123456789Z)
217226 Default: rfc3339
218227
219228 - `stacktraceLevel` ((#v-controller-manager-logging-stacktracelevel)) (`string: panic`) - Sets the stacktrace level for the operator.
@@ -753,41 +762,53 @@ Use these links to navigate to a particular top-level stanza.
753762
754763### csi ((#h-csi))
755764
765+ <EnterpriseAlert inline = " true" />
766+
756767- ` csi ` ((#v-csi))
757768
758769 - ` enabled ` ((#v-csi-enabled)) (` boolean: false ` ) - Only supports Vault Enterprise servers.
759- Toggles the deployment of the Vault Secrets Operator CSI driver. This will deploy the driver and the necessary
760- resources to the cluster.
770+ Toggles the deployment of the Vault Secrets Operator CSI driver. Setting ` enabled ` to ` true `
771+ deploys the CSI driver and the necessary resources to the cluster.
761772
762- - `hostAliases` ((#v-csi-hostaliases)) (`array<map>`) - Host Aliases settings for the vault-secrets-operator-csi pods.
763- The value is an array of PodSpec HostAlias maps.
773+ - ` hostAliases ` ((#v-csi-hostaliases)) (` array<map> ` ) - Host Aliases settings for the ` vault-secrets-operator-csi ` pods as
774+ an array of PodSpec HostAlias maps.
764775 ref: https://kubernetes.io/docs/tasks/network/customize-hosts-file-for-pods/
765776 Example:
777+
778+ ``` yaml
766779 hostAliases :
767780 - ip : 192.168.1.100
768781 hostnames :
769782 - vault.example.com
770783
771- - `nodeSelector` ((#v-csi-nodeselector)) (`map`) - nodeSelector labels for vault-secrets-operator-csi pod assignment.
784+ - ` nodeSelector` ((#v-csi-nodeselector)) (`map`) - Node selector labels for ` vault-secrets-operator-csi` pod assignment.
772785 ref : https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
773786 Example :
787+
788+ ` ` ` yaml
774789 nodeSelector:
775790 beta.kubernetes.io/arch: amd64
791+ ` ` `
776792
777- - `tolerations` ((#v-csi-tolerations)) (`array<map>`) - Toleration Settings for vault-secrets-operator-csi pods.
778- The value is an array of PodSpec Toleration maps.
793+ - ` tolerations` ((#v-csi-tolerations)) (`array<map>`) - Toleration settings for ` vault-secrets-operator-csi` pods
794+ as an array of PodSpec Toleration maps.
779795 ref : https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration/
780796 Example :
797+
798+ ` ` ` yaml
781799 tolerations:
782800 - key: "key1"
783801 operator: "Equal"
784802 value: "value1"
785803 effect: "NoSchedule"
804+ ` ` `
786805
787- - `affinity` ((#v-csi-affinity)) - Affinity settings for vault-secrets-operator-csi pods.
788- The value is a map of PodSpec Affinity maps.
806+ - ` affinity` ((#v-csi-affinity)) - Affinity settings for ` vault-secrets-operator-csi` pods
807+ as a map of PodSpec Affinity maps.
789808 ref : https://kubernetes.io/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity
790809 Example :
810+
811+ ` ` ` yaml
791812 affinity:
792813 nodeAffinity:
793814 requiredDuringSchedulingIgnoredDuringExecution:
@@ -798,112 +819,125 @@ Use these links to navigate to a particular top-level stanza.
798819 values:
799820 - antarctica-east1
800821 - antarctica-west1
822+ ` ` `
801823
802- - `imagePullSecrets` ((#v-csi-imagepullsecrets)) (`array<map>`) - Image pull secret to use for private container registry authentication which will be applied to the controllers
803- service account. Alternatively, the value may be specified as an array of strings.
824+ - ` imagePullSecrets` ((#v-csi-imagepullsecrets)) (`array<map>`) - Image pull secrets as an array of maps or strings for private container registry authentication for the controller
825+ service account.
826+ Refer to https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry.
804827 Example :
828+
805829 ` ` ` yaml
806830 imagePullSecrets:
807831 - name: pull-secret-name-1
808832 - name: pull-secret-name-2
809833 ` ` `
810- Refer to https://kubernetes.io/docs/concepts/containers/images/#using-a-private-registry.
811834
812- - `extraLabels` ((#v-csi-extralabels)) - Extra labels to attach to the deployment. This should be formatted as a YAML object (map)
835+ - ` extraLabels` ((#v-csi-extralabels)) - Additional deployment labels as a YAML object (map).
813836
814- - `annotations` ((#v-csi-annotations)) - This value defines additional annotations for the deployment. This should be formatted as a YAML object (map)
837+ - ` annotations` ((#v-csi-annotations)) - Additional deployment annotations as a YAML object (map).
815838
816839 - ` driver` ((#v-csi-driver))
817840
818- - `image` ((#v-csi-driver-image)) - Image sets the repo and tag of the vault-secrets-operator-csi image to use for the driver.
841+ - ` image` ((#v-csi-driver-image)) - Image information for the CSI driver.
842+ ref : https://kubernetes.io/docs/concepts/containers/images/
819843
820- - `pullPolicy` ((#v-csi-driver-image-pullpolicy)) (`string: IfNotPresent`)
844+ - ` pullPolicy` ((#v-csi-driver-image-pullpolicy)) (`string: IfNotPresent`) - Determines when the kubelet attempts to download the specified image.
821845
822- - `repository` ((#v-csi-driver-image-repository)) (`string: hashicorp/vault-secrets-operator-csi`)
846+ - ` repository` ((#v-csi-driver-image-repository)) (`string: hashicorp/vault-secrets-operator-csi`) - The Docker repository of the CSI driver image.
823847
824- - `tag` ((#v-csi-driver-image-tag)) (`string: 0 .0.0-dev`)
848+ - ` tag` ((#v-csi-driver-image-tag)) (`string: 1 .0.0`) - The version of the CSI driver image to download.
825849
826- - `extraEnv` ((#v-csi-driver-extraenv)) (`array<map>`) - Defines additional environment variables to be added to the
850+ - ` extraEnv` ((#v-csi-driver-extraenv)) (`array<map>`) - Additional environment variables for the
827851 CSI driver container.
828852
829- - `extraArgs` ((#v-csi-driver-extraargs)) (`array: []`) - Extra arguments to pass to the driver.
853+ - ` extraArgs` ((#v-csi-driver-extraargs)) (`array: []`) - Additional arguments to pass to the CSI driver.
830854
831- - `logging` ((#v-csi-driver-logging)) - logging
855+ - ` logging` ((#v-csi-driver-logging)) - Configures logging output settings for the CSI driver.
832856
833- - `level` ((#v-csi-driver-logging-level)) (`string: info`) - Sets the log level for the driver.
834- Builtin levels are : info, error, debug, debug-extended, trace
857+ - ` level` ((#v-csi-driver-logging-level)) (`string: info`) - Sets the log level for the CSI driver.
858+ Must be one of : info, error, debug, debug-extended, trace.
835859 Default : info
836860
837- - `timeEncoding` ((#v-csi-driver-logging-timeencoding)) (`string: rfc3339`) - Sets the time encoding for the driver.
838- Options are: epoch, millis, nano, iso8601, rfc3339, rfc3339nano
861+ - ` timeEncoding` ((#v-csi-driver-logging-timeencoding)) (`string: rfc3339`) - Sets the time encoding for the CSI driver.
862+ Must be one of :
863+ - epoch - Unix timestamp in seconds (e.g. 1695382800)
864+ - millis - Unix timestamp in milliseconds (e.g. 1695382800000)
865+ - nano - Unix timestamp in nanoseconds (e.g. 1695382800000000000)
866+ - iso8601 - ISO 8601 format (e.g. 2023-09-22T10:00:00Z)
867+ - rfc3339 - RFC 3339 format (e.g. 2023-09-22T10:00:00Z)
868+ - rfc3339nano - RFC 3339 format with nanosecond precision (e.g. 2023-09-22T10:00:00.123456789Z)
839869 Default : rfc3339
840870
841- - `stacktraceLevel` ((#v-csi-driver-logging-stacktracelevel)) (`string: panic`) - Sets the stacktrace level for the driver.
842- Options are : info, error, panic
871+ - ` stacktraceLevel` ((#v-csi-driver-logging-stacktracelevel)) (`string: panic`) - Sets the stacktrace level for the CSI driver.
872+ Must be one of : info, error, panic.
843873 Default : panic
844874
845- - `backoffOnSecretSourceError` ((#v-csi-driver-backoffonsecretsourceerror)) (`object: " " `) - Backoff settings for the CSI driver. These settings control the backoff behavior
846- when the driver encounters an error while fetching secrets from the SecretSource.
847- For example given the following settings:
875+ - ` backoffOnSecretSourceError` ((#v-csi-driver-backoffonsecretsourceerror)) (`object: ""`) - Describes backoff behavior for the CSI driver when the driver encounters
876+ an error fetching secrets from `SecretSource`.
877+ For example, the following configuration creates a backoff retry sequence like
878+ 5.5s, 7.5s, 11.25s, 16.87s, 25.3125s, 37.96s, 56.95, 60.95s, etc. :
879+
880+ ` ` ` yaml
848881 initialInterval: 5s
849882 maxInterval: 60s
850883 randomizationFactor: 0.5
851884 multiplier: 1.5
852-
853- The backoff retry sequence might be something like:
854- 5.5s, 7.5s, 11.25s, 16.87s, 25.3125s, 37.96s, 56.95, 60.95s...
885+ ` ` `
855886
856887 - ` initialInterval` ((#v-csi-driver-backoffonsecretsourceerror-initialinterval)) (`duration: 5s`) - Initial interval between retries.
857888
858889 - ` maxInterval` ((#v-csi-driver-backoffonsecretsourceerror-maxinterval)) (`duration: 60s`) - Maximum interval between retries.
859890
860- - `maxElapsedTime` ((#v-csi-driver-backoffonsecretsourceerror-maxelapsedtime)) (`duration: 0s`) - Maximum elapsed time without a successful sync from the secret's source.
861- It's important to note that setting this option to anything other than
862- its default will result in the secret sync no longer being retried after
863- reaching the max elapsed time.
891+ - ` maxElapsedTime` ((#v-csi-driver-backoffonsecretsourceerror-maxelapsedtime)) (`duration: 0s`) - Maximum elapsed time without a successful sync from the secret source.
892+ Setting an explicit `maxElapsedTime` tells VSO not to
893+ retry the secret sync once it reaches the max elapsed time.
864894
865- - `randomizationFactor` ((#v-csi-driver-backoffonsecretsourceerror-randomizationfactor)) (`float: 0.5`) - Randomization factor randomizes the backoff interval between retries.
866- This helps to spread out the retries to avoid a thundering herd.
867- If the value is 0, then the backoff interval will not be randomized.
868- It is recommended to set this to a value that is greater than 0 .
895+ - ` randomizationFactor` ((#v-csi-driver-backoffonsecretsourceerror-randomizationfactor)) (`float: 0.5`) - Custom factor used to randomize the backoff interval between retries
896+ to spread out the retries and avoid a thundering herd.
897+ We strongly recommend using a randomization factor, but you can set
898+ ` randomizationFactor ` to 0 to disable randomization .
869899
870- - `multiplier` ((#v-csi-driver-backoffonsecretsourceerror-multiplier)) (`float: 1.5`) - Sets the multiplier that is used to increase the backoff interval between retries.
871- This value should always be set to a value greater than 0.
872- The value must be greater than zero.
900+ - ` multiplier` ((#v-csi-driver-backoffonsecretsourceerror-multiplier)) (`float: 1.5`) - Sets a multiplier used to increase the backoff interval between retries.
901+ You cannot set `multiplier` to a value less than or equal to 0.
873902
874- - `livenessProbe` ((#v-csi-livenessprobe))
903+ - ` livenessProbe` ((#v-csi-livenessprobe)) - The liveness probe checks the health of the CSI driver container.
875904
876- - `image` ((#v-csi-livenessprobe-image)) - Image sets the repo and tag of the image to use for the liveness probe.
905+ - ` image` ((#v-csi-livenessprobe-image)) - Image information for the CSI driver liveness probe.
906+ ref : https://kubernetes.io/docs/concepts/containers/images/
877907
878- - `pullPolicy` ((#v-csi-livenessprobe-image-pullpolicy)) (`string: IfNotPresent`)
908+ - ` pullPolicy` ((#v-csi-livenessprobe-image-pullpolicy)) (`string: IfNotPresent`) - Determines when the kubelet attempts to download the specified image.
879909
880- - `repository` ((#v-csi-livenessprobe-image-repository)) (`string: registry.k8s.io/sig-storage/livenessprobe`)
910+ - ` repository` ((#v-csi-livenessprobe-image-repository)) (`string: registry.k8s.io/sig-storage/livenessprobe`) - The Docker repository of the liveness probe image.
881911
882- - `tag` ((#v-csi-livenessprobe-image-tag)) (`string: v2.10 .0`)
912+ - ` tag` ((#v-csi-livenessprobe-image-tag)) (`string: v2.16 .0`) - The version of the liveness probe image to download.
883913
884- - `extraArgs` ((#v-csi-livenessprobe-extraargs)) (`array: []`) - Extra arguments to pass to the liveness probe container.
914+ - ` extraArgs` ((#v-csi-livenessprobe-extraargs)) (`array: []`) - Additional arguments to pass to the liveness probe container.
885915
886- - `nodeDriverRegistrar` ((#v-csi-nodedriverregistrar))
916+ - ` nodeDriverRegistrar` ((#v-csi-nodedriverregistrar)) - The node driver registrar sidecar container handles registration with the kubelet.
887917
888- - `image` ((#v-csi-nodedriverregistrar-image)) - Image sets the repo and tag of the image to use for the node driver registrar.
918+ - ` image` ((#v-csi-nodedriverregistrar-image)) - Image information for the CSI driver node driver registrar.
919+ ref : https://kubernetes.io/docs/concepts/containers/images/
889920
890- - `pullPolicy` ((#v-csi-nodedriverregistrar-image-pullpolicy)) (`string: IfNotPresent`)
921+ - ` pullPolicy` ((#v-csi-nodedriverregistrar-image-pullpolicy)) (`string: IfNotPresent`) - Determines when the kubelet attempts to download the specified image.
891922
892- - `repository` ((#v-csi-nodedriverregistrar-image-repository)) (`string: registry.k8s.io/sig-storage/csi-node-driver-registrar`)
923+ - ` repository` ((#v-csi-nodedriverregistrar-image-repository)) (`string: registry.k8s.io/sig-storage/csi-node-driver-registrar`) - The Docker repository of the node driver registrar image.
893924
894- - `tag` ((#v-csi-nodedriverregistrar-image-tag)) (`string: v2.8 .0`)
925+ - ` tag` ((#v-csi-nodedriverregistrar-image-tag)) (`string: v2.14 .0`) - The version of the node driver registrar image to download.
895926
896- - `extraArgs` ((#v-csi-nodedriverregistrar-extraargs)) (`array: []`) - Extra arguments to pass to the node driver registrar container.
927+ - ` extraArgs` ((#v-csi-nodedriverregistrar-extraargs)) (`array: []`) - Additional arguments to pass to the node driver registrar container.
897928
898- - `updateStrategy` ((#v-csi-updatestrategy)) (`object: " " `) - Configure update strategy for the DaemonSet
899- Kubernetes supports types Recreate, and RollingUpdate
929+ - ` updateStrategy` ((#v-csi-updatestrategy)) (`object: ""`) - Configures the update strategy for the CSI driver DaemonSet.
930+ Must be one of : Recreate, RollingUpdate.
900931 ref : https://kubernetes.io/docs/concepts/workloads/controllers/deployment/#strategy
901932 Example :
933+
934+ ` ` ` yaml
902935 strategy: {}
903936 rollingUpdate:
904937 maxSurge: 1
905938 maxUnavailable: 0
906939 type: RollingUpdate
940+ ` ` `
907941
908942# ## tests ((#h-tests))
909943
0 commit comments