getAuthBackendRole

Reads the Role of an Kubernetes from a Vault server. See the Vault documentation for more information.

Example Usage

using Pulumi;
using Vault = Pulumi.Vault;

class MyStack : Stack
{
    public MyStack()
    {
        var role = Output.Create(Vault.Kubernetes.GetAuthBackendRole.InvokeAsync(new Vault.Kubernetes.GetAuthBackendRoleArgs
        {
            Backend = "my-kubernetes-backend",
            RoleName = "my-role",
        }));
        this.Policies = role.Apply(role => role.Policies);
    }

    [Output("policies")]
    public Output<string> Policies { get; set; }
}
package main

import (
	"github.com/pulumi/pulumi-vault/sdk/v4/go/vault/kubernetes"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		opt0 := "my-kubernetes-backend"
		role, err := kubernetes.LookupAuthBackendRole(ctx, &kubernetes.LookupAuthBackendRoleArgs{
			Backend:  &opt0,
			RoleName: "my-role",
		}, nil)
		if err != nil {
			return err
		}
		ctx.Export("policies", role.Policies)
		return nil
	})
}
import pulumi
import pulumi_vault as vault

role = vault.kubernetes.get_auth_backend_role(backend="my-kubernetes-backend",
    role_name="my-role")
pulumi.export("policies", role.policies)
import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";

const role = vault.kubernetes.getAuthBackendRole({
    backend: "my-kubernetes-backend",
    roleName: "my-role",
});
export const policies = role.then(role => role.policies);

Using getAuthBackendRole

function getAuthBackendRole(args: GetAuthBackendRoleArgs, opts?: InvokeOptions): Promise<GetAuthBackendRoleResult>
def get_auth_backend_role(audience: Optional[str] = None,
                          backend: Optional[str] = None,
                          bound_cidrs: Optional[Sequence[str]] = None,
                          max_ttl: Optional[int] = None,
                          num_uses: Optional[int] = None,
                          period: Optional[int] = None,
                          policies: Optional[Sequence[str]] = None,
                          role_name: Optional[str] = None,
                          token_bound_cidrs: Optional[Sequence[str]] = None,
                          token_explicit_max_ttl: Optional[int] = None,
                          token_max_ttl: Optional[int] = None,
                          token_no_default_policy: Optional[bool] = None,
                          token_num_uses: Optional[int] = None,
                          token_period: Optional[int] = None,
                          token_policies: Optional[Sequence[str]] = None,
                          token_ttl: Optional[int] = None,
                          token_type: Optional[str] = None,
                          ttl: Optional[int] = None,
                          opts: Optional[InvokeOptions] = None) -> GetAuthBackendRoleResult
func LookupAuthBackendRole(ctx *Context, args *LookupAuthBackendRoleArgs, opts ...InvokeOption) (*LookupAuthBackendRoleResult, error)

Note: This function is named LookupAuthBackendRole in the Go SDK.

public static class GetAuthBackendRole {
    public static Task<GetAuthBackendRoleResult> InvokeAsync(GetAuthBackendRoleArgs args, InvokeOptions? opts = null)
}

The following arguments are supported:

RoleName string
The name of the role to retrieve the Role attributes for.
Audience string
(Optional) Audience claim to verify in the JWT.
Backend string
The unique name for the Kubernetes backend the role to retrieve Role attributes for resides in. Defaults to “kubernetes”.
BoundCidrs List<string>

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

MaxTtl int

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

NumUses int

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

Period int

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies List<string>

Deprecated: use token_policies instead if you are running Vault >= 1.2

TokenBoundCidrs List<string>
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
TokenExplicitMaxTtl int
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
TokenMaxTtl int
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenNoDefaultPolicy bool
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
TokenNumUses int
The period, if any, in number of seconds to set on the token.
TokenPeriod int
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
TokenPolicies List<string>
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
TokenTtl int
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenType string
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
Ttl int

Deprecated: use token_ttl instead if you are running Vault >= 1.2

RoleName string
The name of the role to retrieve the Role attributes for.
Audience string
(Optional) Audience claim to verify in the JWT.
Backend string
The unique name for the Kubernetes backend the role to retrieve Role attributes for resides in. Defaults to “kubernetes”.
BoundCidrs []string

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

MaxTtl int

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

NumUses int

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

Period int

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies []string

Deprecated: use token_policies instead if you are running Vault >= 1.2

TokenBoundCidrs []string
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
TokenExplicitMaxTtl int
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
TokenMaxTtl int
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenNoDefaultPolicy bool
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
TokenNumUses int
The period, if any, in number of seconds to set on the token.
TokenPeriod int
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
TokenPolicies []string
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
TokenTtl int
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenType string
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
Ttl int

Deprecated: use token_ttl instead if you are running Vault >= 1.2

roleName string
The name of the role to retrieve the Role attributes for.
audience string
(Optional) Audience claim to verify in the JWT.
backend string
The unique name for the Kubernetes backend the role to retrieve Role attributes for resides in. Defaults to “kubernetes”.
boundCidrs string[]

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

maxTtl number

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

numUses number

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

period number

Deprecated: use token_period instead if you are running Vault >= 1.2

policies string[]

Deprecated: use token_policies instead if you are running Vault >= 1.2

tokenBoundCidrs string[]
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
tokenExplicitMaxTtl number
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
tokenMaxTtl number
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
tokenNoDefaultPolicy boolean
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
tokenNumUses number
The period, if any, in number of seconds to set on the token.
tokenPeriod number
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
tokenPolicies string[]
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
tokenTtl number
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
tokenType string
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
ttl number

Deprecated: use token_ttl instead if you are running Vault >= 1.2

role_name str
The name of the role to retrieve the Role attributes for.
audience str
(Optional) Audience claim to verify in the JWT.
backend str
The unique name for the Kubernetes backend the role to retrieve Role attributes for resides in. Defaults to “kubernetes”.
bound_cidrs Sequence[str]

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

max_ttl int

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

num_uses int

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

period int

Deprecated: use token_period instead if you are running Vault >= 1.2

policies Sequence[str]

Deprecated: use token_policies instead if you are running Vault >= 1.2

token_bound_cidrs Sequence[str]
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
token_explicit_max_ttl int
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
token_max_ttl int
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
token_no_default_policy bool
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
token_num_uses int
The period, if any, in number of seconds to set on the token.
token_period int
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
token_policies Sequence[str]
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
token_ttl int
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
token_type str
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
ttl int

Deprecated: use token_ttl instead if you are running Vault >= 1.2

getAuthBackendRole Result

The following output properties are available:

BoundServiceAccountNames List<string>
List of service account names able to access this role. If set to “” all names are allowed, both this and bound_service_account_namespaces can not be “”.
BoundServiceAccountNamespaces List<string>
List of namespaces allowed to access this role. If set to “” all namespaces are allowed, both this and bound_service_account_names can not be set to “”.
Id string
The provider-assigned unique ID for this managed resource.
RoleName string
Audience string
(Optional) Audience claim to verify in the JWT.
Backend string
BoundCidrs List<string>

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

MaxTtl int

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

NumUses int

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

Period int

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies List<string>

Deprecated: use token_policies instead if you are running Vault >= 1.2

TokenBoundCidrs List<string>
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
TokenExplicitMaxTtl int
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
TokenMaxTtl int
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenNoDefaultPolicy bool
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
TokenNumUses int
The period, if any, in number of seconds to set on the token.
TokenPeriod int
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
TokenPolicies List<string>
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
TokenTtl int
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenType string
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
Ttl int

Deprecated: use token_ttl instead if you are running Vault >= 1.2

BoundServiceAccountNames []string
List of service account names able to access this role. If set to “” all names are allowed, both this and bound_service_account_namespaces can not be “”.
BoundServiceAccountNamespaces []string
List of namespaces allowed to access this role. If set to “” all namespaces are allowed, both this and bound_service_account_names can not be set to “”.
Id string
The provider-assigned unique ID for this managed resource.
RoleName string
Audience string
(Optional) Audience claim to verify in the JWT.
Backend string
BoundCidrs []string

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

MaxTtl int

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

NumUses int

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

Period int

Deprecated: use token_period instead if you are running Vault >= 1.2

Policies []string

Deprecated: use token_policies instead if you are running Vault >= 1.2

TokenBoundCidrs []string
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
TokenExplicitMaxTtl int
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
TokenMaxTtl int
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenNoDefaultPolicy bool
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
TokenNumUses int
The period, if any, in number of seconds to set on the token.
TokenPeriod int
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
TokenPolicies []string
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
TokenTtl int
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
TokenType string
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
Ttl int

Deprecated: use token_ttl instead if you are running Vault >= 1.2

boundServiceAccountNames string[]
List of service account names able to access this role. If set to “” all names are allowed, both this and bound_service_account_namespaces can not be “”.
boundServiceAccountNamespaces string[]
List of namespaces allowed to access this role. If set to “” all namespaces are allowed, both this and bound_service_account_names can not be set to “”.
id string
The provider-assigned unique ID for this managed resource.
roleName string
audience string
(Optional) Audience claim to verify in the JWT.
backend string
boundCidrs string[]

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

maxTtl number

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

numUses number

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

period number

Deprecated: use token_period instead if you are running Vault >= 1.2

policies string[]

Deprecated: use token_policies instead if you are running Vault >= 1.2

tokenBoundCidrs string[]
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
tokenExplicitMaxTtl number
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
tokenMaxTtl number
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
tokenNoDefaultPolicy boolean
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
tokenNumUses number
The period, if any, in number of seconds to set on the token.
tokenPeriod number
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
tokenPolicies string[]
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
tokenTtl number
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
tokenType string
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
ttl number

Deprecated: use token_ttl instead if you are running Vault >= 1.2

bound_service_account_names Sequence[str]
List of service account names able to access this role. If set to “” all names are allowed, both this and bound_service_account_namespaces can not be “”.
bound_service_account_namespaces Sequence[str]
List of namespaces allowed to access this role. If set to “” all namespaces are allowed, both this and bound_service_account_names can not be set to “”.
id str
The provider-assigned unique ID for this managed resource.
role_name str
audience str
(Optional) Audience claim to verify in the JWT.
backend str
bound_cidrs Sequence[str]

Deprecated: use token_bound_cidrs instead if you are running Vault >= 1.2

max_ttl int

Deprecated: use token_max_ttl instead if you are running Vault >= 1.2

num_uses int

Deprecated: use token_num_uses instead if you are running Vault >= 1.2

period int

Deprecated: use token_period instead if you are running Vault >= 1.2

policies Sequence[str]

Deprecated: use token_policies instead if you are running Vault >= 1.2

token_bound_cidrs Sequence[str]
List of CIDR blocks; if set, specifies blocks of IP addresses which can authenticate successfully, and ties the resulting token to these blocks as well.
token_explicit_max_ttl int
If set, will encode an explicit max TTL onto the token in number of seconds. This is a hard cap even if token_ttl and token_max_ttl would otherwise allow a renewal.
token_max_ttl int
The maximum lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
token_no_default_policy bool
If set, the default policy will not be set on generated tokens; otherwise it will be added to the policies set in token_policies.
token_num_uses int
The period, if any, in number of seconds to set on the token.
token_period int
(Optional) If set, indicates that the token generated using this role should never expire. The token should be renewed within the duration specified by this value. At each renewal, the token’s TTL will be set to the value of this field. Specified in seconds.
token_policies Sequence[str]
List of policies to encode onto generated tokens. Depending on the auth method, this list may be supplemented by user/group/other values.
token_ttl int
The incremental lifetime for generated tokens in number of seconds. Its current value will be referenced at renewal time.
token_type str
The type of token that should be generated. Can be service, batch, or default to use the mount’s tuned default (which unless changed will be service tokens). For token store roles, there are two additional possibilities: default-service and default-batch which specify the type to return unless the client requests a different type at generation time.
ttl int

Deprecated: use token_ttl instead if you are running Vault >= 1.2

Package Details

Repository
https://github.com/pulumi/pulumi-vault
License
Apache-2.0
Notes
This Pulumi package is based on the vault Terraform Provider.