GarageAdminToken

garage.rajsingh.info / v1beta1

apiVersion: garage.rajsingh.info/v1beta1 kind: GarageAdminToken metadata: name: example

apiVersion string

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

kind string

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

metadata object

spec object required

GarageAdminTokenSpec defines the desired state of GarageAdminToken. GarageAdminToken provisions secrets for accessing the Garage Admin HTTP API. Admin tokens authenticate differently from S3 keys (GarageKey) — they use Bearer token auth against the admin port (default 3903) instead of HMAC-SHA256. The operator writes the token as an admin_token_file in Garage's TOML config. File-based tokens always have full admin access; there is no scope restriction. To create scoped tokens, use Garage's Admin API (CreateAdminToken) directly — this resource is for provisioning the full-access operator/tooling token.

clusterRef object required

ClusterRef references the GarageCluster this token belongs to

kubeConfigSecretRef object

KubeConfigSecretRef references a secret containing a kubeconfig for a remote Kubernetes cluster. Only needed for multi-cluster federation where the GarageCluster lives in a different Kubernetes cluster entirely (not just a different namespace).

key string required

The key of the secret to select from. Must be a valid secret key.

name string

Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

optional boolean

Specify whether the Secret or its key must be defined

name string required

Name of the GarageCluster resource.

namespace string

Namespace of the GarageCluster. Defaults to the referencing resource's namespace. Cross-namespace references require a GarageReferenceGrant in the target namespace. Not supported on GarageNode.

expiresAt string

ExpiresAt sets when this token should be rotated. The operator tracks this and sets the TokenExpired condition when the date passes, but does NOT automatically rotate or revoke the token — rotation requires manual action (update or delete the GarageAdminToken resource). Use NeverExpires to suppress expiry tracking. Mutually exclusive with NeverExpires.

format: date-time

name string

Name is a friendly name for this admin token If not set, metadata.name is used

neverExpires boolean

NeverExpires sets the token to never expire. Mutually exclusive with ExpiresAt.

secretTemplate object

SecretTemplate configures how the secret containing the token is generated

annotations object

Annotations to add to the secret

endpointKey string

EndpointKey is the key name for the admin endpoint

includeEndpoint boolean

IncludeEndpoint includes the admin API endpoint in the secret Defaults to true if not specified

labels object

Labels to add to the secret

name string

Name is the name of the secret to create Defaults to the GarageAdminToken name

tokenKey string

TokenKey is the key name for the admin token in the secret

status object

GarageAdminTokenStatus defines the observed state of GarageAdminToken

conditions []object

Conditions represent the current state

lastTransitionTime string required

lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.

format: date-time

message string required

message is a human readable message indicating details about the transition. This may be an empty string.

maxLength: 32768

observedGeneration integer

observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.

format: int64

minimum: 0

reason string required

reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.

pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$

minLength: 1

maxLength: 1024

status string required

status of the condition, one of True, False, Unknown.

enum: True, False, Unknown

type string required

type of condition in CamelCase or in foo.example.com/CamelCase.

pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$

maxLength: 316

expiresAt string

ExpiresAt is when this token expires (if set)

format: date-time

observedGeneration integer

ObservedGeneration is the last observed generation

format: int64

phase string

Phase represents the current phase

enum: Pending, Creating, Ready, Deleting, Failed, Expired, Unknown

secretRef object

SecretRef references the created secret

name string

name is unique within a namespace to reference a secret resource.

namespace string

namespace defines the space within which the secret name must be unique.

tokenId string

TokenID is the Garage-assigned token ID (first 8 chars)

No matches. Try .spec.clusterRef for an exact path