Secret

{Group: corev1.GroupName, Kind: "Secret"}

staging/src/k8s.io/kubectl/pkg/describe/describe.go

staging/src/k8s.io/api/core/v1/types.go

// Secret holds secret data of a certain type. The total bytes of the values in
// the Data field must be less than MaxSecretSize bytes.
type Secret struct {
    metav1.TypeMeta `json:",inline"`
    // Standard object's metadata.
    // More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
    // +optional
    metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`

    // Immutable, if set to true, ensures that data stored in the Secret cannot
    // be updated (only object metadata can be modified).
    // If not set to true, the field can be modified at any time.
    // Defaulted to nil.
    // +optional
    Immutable *bool `json:"immutable,omitempty" protobuf:"varint,5,opt,name=immutable"`

    // Data contains the secret data. Each key must consist of alphanumeric
    // characters, '-', '_' or '.'. The serialized form of the secret data is a
    // base64 encoded string, representing the arbitrary (possibly non-string)
    // data value here. Described in https://tools.ietf.org/html/rfc4648#section-4
    // +optional
    Data map[string][]byte `json:"data,omitempty" protobuf:"bytes,2,rep,name=data"`

    // stringData allows specifying non-binary secret data in string form.
    // It is provided as a write-only input field for convenience.
    // All keys and values are merged into the data field on write, overwriting any existing values.
    // The stringData field is never output when reading from the API.
    // +k8s:conversion-gen=false
    // +optional
    StringData map[string]string `json:"stringData,omitempty" protobuf:"bytes,4,rep,name=stringData"`

    // Used to facilitate programmatic handling of secret data.
    // +optional
    Type SecretType `json:"type,omitempty" protobuf:"bytes,3,opt,name=type,casttype=SecretType"`
}

type SecretType string

const (
    // SecretTypeOpaque is the default. Arbitrary user-defined data
    SecretTypeOpaque SecretType = "Opaque"

    // SecretTypeServiceAccountToken contains a token that identifies a service account to the API
    //
    // Required fields:
    // - Secret.Annotations["kubernetes.io/service-account.name"] - the name of the ServiceAccount the token identifies
    // - Secret.Annotations["kubernetes.io/service-account.uid"] - the UID of the ServiceAccount the token identifies
    // - Secret.Data["token"] - a token that identifies the service account to the API
    SecretTypeServiceAccountToken SecretType = "kubernetes.io/service-account-token"

    // ServiceAccountNameKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
    ServiceAccountNameKey = "kubernetes.io/service-account.name"
    // ServiceAccountUIDKey is the key of the required annotation for SecretTypeServiceAccountToken secrets
    ServiceAccountUIDKey = "kubernetes.io/service-account.uid"
    // ServiceAccountTokenKey is the key of the required data for SecretTypeServiceAccountToken secrets
    ServiceAccountTokenKey = "token"
    // ServiceAccountKubeconfigKey is the key of the optional kubeconfig data for SecretTypeServiceAccountToken secrets
    ServiceAccountKubeconfigKey = "kubernetes.kubeconfig"
    // ServiceAccountRootCAKey is the key of the optional root certificate authority for SecretTypeServiceAccountToken secrets
    ServiceAccountRootCAKey = "ca.crt"
    // ServiceAccountNamespaceKey is the key of the optional namespace to use as the default for namespaced API calls
    ServiceAccountNamespaceKey = "namespace"

    // SecretTypeDockercfg contains a dockercfg file that follows the same format rules as ~/.dockercfg
    //
    // Required fields:
    // - Secret.Data[".dockercfg"] - a serialized ~/.dockercfg file
    SecretTypeDockercfg SecretType = "kubernetes.io/dockercfg"

    // DockerConfigKey is the key of the required data for SecretTypeDockercfg secrets
    DockerConfigKey = ".dockercfg"

    // SecretTypeDockerConfigJson contains a dockercfg file that follows the same format rules as ~/.docker/config.json
    //
    // Required fields:
    // - Secret.Data[".dockerconfigjson"] - a serialized ~/.docker/config.json file
    SecretTypeDockerConfigJson SecretType = "kubernetes.io/dockerconfigjson"

    // DockerConfigJsonKey is the key of the required data for SecretTypeDockerConfigJson secrets
    DockerConfigJsonKey = ".dockerconfigjson"

    // SecretTypeBasicAuth contains data needed for basic authentication.
    //
    // Required at least one of fields:
    // - Secret.Data["username"] - username used for authentication
    // - Secret.Data["password"] - password or token needed for authentication
    SecretTypeBasicAuth SecretType = "kubernetes.io/basic-auth"

    // BasicAuthUsernameKey is the key of the username for SecretTypeBasicAuth secrets
    BasicAuthUsernameKey = "username"
    // BasicAuthPasswordKey is the key of the password or token for SecretTypeBasicAuth secrets
    BasicAuthPasswordKey = "password"

    // SecretTypeSSHAuth contains data needed for SSH authetication.
    //
    // Required field:
    // - Secret.Data["ssh-privatekey"] - private SSH key needed for authentication
    SecretTypeSSHAuth SecretType = "kubernetes.io/ssh-auth"

    // SSHAuthPrivateKey is the key of the required SSH private key for SecretTypeSSHAuth secrets
    SSHAuthPrivateKey = "ssh-privatekey"
    // SecretTypeTLS contains information about a TLS client or server secret. It
    // is primarily used with TLS termination of the Ingress resource, but may be
    // used in other types.
    //
    // Required fields:
    // - Secret.Data["tls.key"] - TLS private key.
    //   Secret.Data["tls.crt"] - TLS certificate.
    // TODO: Consider supporting different formats, specifying CA/destinationCA.
    SecretTypeTLS SecretType = "kubernetes.io/tls"

    // TLSCertKey is the key for tls certificates in a TLS secret.
    TLSCertKey = "tls.crt"
    // TLSPrivateKeyKey is the key for the private key field in a TLS secret.
    TLSPrivateKeyKey = "tls.key"
    // SecretTypeBootstrapToken is used during the automated bootstrap process (first
    // implemented by kubeadm). It stores tokens that are used to sign well known
    // ConfigMaps. They are used for authn.
    SecretTypeBootstrapToken SecretType = "bootstrap.kubernetes.io/token"
)