STS

1 resource kind. Generated from the operator's CRD schemas.

API Group: aws.konfig.io/v1alpha1

AWSProvider # GA

AWSProvider is a cluster-scoped credential and region target that resources select with spec.providerRef.

kubectl get awsproviders · example on GitHub

Example

# AWSProvider — sts
# Full-options example generated from the CRD schema. Optional fields are
# included with sample values; delete what you don't need. Field reference:
# https://konfig-konector.io/docs/sts.html#awsprovider
apiVersion: aws.konfig.io/v1alpha1
kind: AWSProvider
metadata:
  name: example-awsprovider
  namespace: default
spec:
  allowedNamespaces:
  - example
  default: false
  durationSeconds: 900
  region: us-east-1
  roleArn: arn:aws:iam::123456789012:role/example-role
  sessionName: example-awsprovider
  sourceProviderRef:
    name: example-awsprovider
    region: us-east-1

Spec

Field	Type	Required	Description
`allowedNamespaces`	array<string>	—	AllowedNamespaces restricts which namespaces may reference this provider.
`default`	boolean	—	Default marks this provider as the primary account: every resource that sets no providerRef and whose namespace carries no provider annotation is reconciled here.
`durationSeconds`	integer	—	DurationSeconds is the assumed-role session lifetime (900-43200).
`externalId`	string	—	ExternalID is passed to sts:AssumeRole when set.
`region`	string	—	Region is the default region for resources using this provider.
`roleArn`	string	—	RoleARN is the IAM role to assume in the target account.
`sessionName`	string	—	SessionName is the role session name; defaults to konfig-konector.
`sourceProviderRef`	object	—	SourceProviderRef chains assumption: the role is assumed using credentials from the named provider instead of the operator's own.
`sourceProviderRef.name`	string	yes	Name of a cluster-scoped AWSProvider.
`sourceProviderRef.region`	string	—	Region overrides the provider's region for this resource only.

Status

Field	Type	Required	Description
`accountId`	string	—	AccountID is the account the resolved credentials belong to.
`assumedRoleArn`	string	—	AssumedRoleARN is the ARN returned by sts:GetCallerIdentity.
`conditions`	array<object>	—	Conditions describe the current state of the provider.
`conditions[].lastTransitionTime`	string	yes	lastTransitionTime is the last time the condition transitioned from one status to another.
`conditions[].message`	string	yes	message is a human readable message indicating details about the transition.
`conditions[].observedGeneration`	integer	—	observedGeneration represents the .metadata.generation that the condition was set based upon.
`conditions[].reason`	string	yes	reason contains a programmatic identifier indicating the reason for the condition's last transition.
`conditions[].status`	enum	yes	status of the condition, one of True, False, Unknown. Allowed: `True, False, Unknown`
`conditions[].type`	string	yes	type of condition in CamelCase or in foo.example.com/CamelCase.
`lastSyncTime`	string	—	LastSyncTime is the last successful credential verification.
`observedGeneration`	integer	—	ObservedGeneration is the generation last verified.