import * as pulumi from "@pulumi/pulumi"; export declare class IdentityKubernetesAuthTemplate extends pulumi.CustomResource { /** * Get an existing IdentityKubernetesAuthTemplate resource's state with the given name, ID, and optional extra * properties used to qualify the lookup. * * @param name The _unique_ name of the resulting resource. * @param id The _unique_ provider ID of the resource to lookup. * @param state Any extra arguments used during the lookup. * @param opts Optional settings to control the behavior of the CustomResource. */ static get(name: string, id: pulumi.Input, state?: IdentityKubernetesAuthTemplateState, opts?: pulumi.CustomResourceOptions): IdentityKubernetesAuthTemplate; /** * Returns true if the given object is an instance of IdentityKubernetesAuthTemplate. This is designed to work even * when multiple copies of the Pulumi SDK have been loaded into the same process. */ static isInstance(obj: any): obj is IdentityKubernetesAuthTemplate; /** * The audience claim that service account JWTs must carry to authenticate. Leave empty to skip the audience check. */ readonly allowedAudience: pulumi.Output; /** * The ID of the gateway to route Kubernetes API requests through. Mutually exclusive with `gatewayPoolId`. */ readonly gatewayId: pulumi.Output; /** * The ID of the gateway pool to route Kubernetes API requests through. Mutually exclusive with `gatewayId`. */ readonly gatewayPoolId: pulumi.Output; /** * Whether Infisical holds a token reviewer JWT for this template. The JWT itself is never returned, so this is the only way to tell a stored one apart from none. */ readonly hasTokenReviewerJwt: pulumi.Output; /** * The PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Must be omitted when `tokenReviewerMode` is `gateway`. */ readonly kubernetesCaCertificate: pulumi.Output; /** * The host string, host:port pair, or URL to the base of the Kubernetes API server. Required when `tokenReviewerMode` is `api`, and must be omitted when it is `gateway`. */ readonly kubernetesHost: pulumi.Output; /** * The name of the auth template, at most 64 characters. */ readonly name: pulumi.Output; /** * A long-lived service account JWT that Infisical uses to call the TokenReview API. If omitted, each identity's own service account token reviews itself. Must be omitted when `tokenReviewerMode` is `gateway`. Write-only: Infisical never returns it, so Terraform cannot detect a change made outside this configuration, and an imported template leaves it empty. */ readonly tokenReviewerJwt: pulumi.Output; /** * Who performs the TokenReview. `api` means Infisical calls `kubernetesHost` directly. `gateway` means the TokenReview runs through `gatewayId` or `gatewayPoolId`. Defaults to `api`. */ readonly tokenReviewerMode: pulumi.Output; /** * Whether to verify the Kubernetes API server's TLS certificate against `kubernetesCaCertificate`. Defaults to true when a CA certificate is set, and false otherwise. In `api` mode, true requires a CA certificate and false forbids one. In `gateway` mode it cannot be true. */ readonly verifyTlsCertificate: pulumi.Output; /** * Create a IdentityKubernetesAuthTemplate resource with the given unique name, arguments, and options. * * @param name The _unique_ name of the resource. * @param args The arguments to use to populate this resource's properties. * @param opts A bag of options that control this resource's behavior. */ constructor(name: string, args?: IdentityKubernetesAuthTemplateArgs, opts?: pulumi.CustomResourceOptions); } /** * Input properties used for looking up and filtering IdentityKubernetesAuthTemplate resources. */ export interface IdentityKubernetesAuthTemplateState { /** * The audience claim that service account JWTs must carry to authenticate. Leave empty to skip the audience check. */ allowedAudience?: pulumi.Input; /** * The ID of the gateway to route Kubernetes API requests through. Mutually exclusive with `gatewayPoolId`. */ gatewayId?: pulumi.Input; /** * The ID of the gateway pool to route Kubernetes API requests through. Mutually exclusive with `gatewayId`. */ gatewayPoolId?: pulumi.Input; /** * Whether Infisical holds a token reviewer JWT for this template. The JWT itself is never returned, so this is the only way to tell a stored one apart from none. */ hasTokenReviewerJwt?: pulumi.Input; /** * The PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Must be omitted when `tokenReviewerMode` is `gateway`. */ kubernetesCaCertificate?: pulumi.Input; /** * The host string, host:port pair, or URL to the base of the Kubernetes API server. Required when `tokenReviewerMode` is `api`, and must be omitted when it is `gateway`. */ kubernetesHost?: pulumi.Input; /** * The name of the auth template, at most 64 characters. */ name?: pulumi.Input; /** * A long-lived service account JWT that Infisical uses to call the TokenReview API. If omitted, each identity's own service account token reviews itself. Must be omitted when `tokenReviewerMode` is `gateway`. Write-only: Infisical never returns it, so Terraform cannot detect a change made outside this configuration, and an imported template leaves it empty. */ tokenReviewerJwt?: pulumi.Input; /** * Who performs the TokenReview. `api` means Infisical calls `kubernetesHost` directly. `gateway` means the TokenReview runs through `gatewayId` or `gatewayPoolId`. Defaults to `api`. */ tokenReviewerMode?: pulumi.Input; /** * Whether to verify the Kubernetes API server's TLS certificate against `kubernetesCaCertificate`. Defaults to true when a CA certificate is set, and false otherwise. In `api` mode, true requires a CA certificate and false forbids one. In `gateway` mode it cannot be true. */ verifyTlsCertificate?: pulumi.Input; } /** * The set of arguments for constructing a IdentityKubernetesAuthTemplate resource. */ export interface IdentityKubernetesAuthTemplateArgs { /** * The audience claim that service account JWTs must carry to authenticate. Leave empty to skip the audience check. */ allowedAudience?: pulumi.Input; /** * The ID of the gateway to route Kubernetes API requests through. Mutually exclusive with `gatewayPoolId`. */ gatewayId?: pulumi.Input; /** * The ID of the gateway pool to route Kubernetes API requests through. Mutually exclusive with `gatewayId`. */ gatewayPoolId?: pulumi.Input; /** * The PEM-encoded CA certificate used to validate the Kubernetes API server's TLS certificate. Must be omitted when `tokenReviewerMode` is `gateway`. */ kubernetesCaCertificate?: pulumi.Input; /** * The host string, host:port pair, or URL to the base of the Kubernetes API server. Required when `tokenReviewerMode` is `api`, and must be omitted when it is `gateway`. */ kubernetesHost?: pulumi.Input; /** * The name of the auth template, at most 64 characters. */ name?: pulumi.Input; /** * A long-lived service account JWT that Infisical uses to call the TokenReview API. If omitted, each identity's own service account token reviews itself. Must be omitted when `tokenReviewerMode` is `gateway`. Write-only: Infisical never returns it, so Terraform cannot detect a change made outside this configuration, and an imported template leaves it empty. */ tokenReviewerJwt?: pulumi.Input; /** * Who performs the TokenReview. `api` means Infisical calls `kubernetesHost` directly. `gateway` means the TokenReview runs through `gatewayId` or `gatewayPoolId`. Defaults to `api`. */ tokenReviewerMode?: pulumi.Input; /** * Whether to verify the Kubernetes API server's TLS certificate against `kubernetesCaCertificate`. Defaults to true when a CA certificate is set, and false otherwise. In `api` mode, true requires a CA certificate and false forbids one. In `gateway` mode it cannot be true. */ verifyTlsCertificate?: pulumi.Input; } //# sourceMappingURL=identityKubernetesAuthTemplate.d.ts.map