Skip to content

GarageAdminToken v1beta1

API version: garage.rajsingh.info/v1beta1. Scope: Namespaced.

The custom-resource guide explains operational behavior. The JSON schemas are the validation source of truth.

Spec

GarageAdminTokenSpec defines the desired state of GarageAdminToken. GarageAdminToken provisions a static bootstrap Secret for the Garage Admin HTTP API. The referenced GarageCluster must explicitly select this Secret in spec.admin.adminTokenSecretRef. This resource does not create a row in Garage's dynamic Admin-token table, and deletion does not revoke bytes that a running Garage process already loaded at startup. Admin tokens authenticate differently from S3 keys (GarageKey) — they use Bearer token auth against the admin port (default 3903) instead of HMAC-SHA256. Static configured tokens always have full admin access and no server-side name, scope, or expiry metadata. Use Garage's Admin API directly for a user-managed scoped/dynamic token.

Field path Type Constraints Description
clusterRef object required ClusterRef references the GarageCluster this token belongs to
clusterRef.kubeConfigSecretRef object KubeConfigSecretRef is reserved for a future remote Kubernetes client integration. It is currently rejected by admission because the operator does not use it.
clusterRef.kubeConfigSecretRef.key string required The key of the secret to select from. Must be a valid secret key.
clusterRef.kubeConfigSecretRef.name string default: "" Name of the referent. This field is effectively required, but due to backwards compatibility is allowed to be empty. Instances of this type with an empty value here are almost certainly wrong. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
clusterRef.kubeConfigSecretRef.optional boolean Specify whether the Secret or its key must be defined
clusterRef.name string required Name of the GarageCluster resource.
clusterRef.namespace string Namespace of the GarageCluster. Defaults to the referencing resource's namespace. Cross-namespace references require a GarageReferenceGrant where supported by the owning resource. GarageNode and GarageAdminToken reject them.
expiresAt string format: "date-time" ExpiresAt is retained for compatibility but rejected because static configured tokens have no Garage-side expiry or revocation record.
name string Name is retained for compatibility but rejected because static bootstrap material has no Garage-side friendly name.
neverExpires boolean NeverExpires is retained for compatibility. Static configured tokens are always non-expiring, so this field is deprecated and has no effect.
secretTemplate object SecretTemplate configures how the secret containing the token is generated
secretTemplate.annotations map of string Annotations to add to the secret
secretTemplate.endpointKey string default: "admin-endpoint" EndpointKey is the key name for the admin endpoint
secretTemplate.includeEndpoint boolean IncludeEndpoint includes the admin API endpoint in the secret Defaults to true if not specified
secretTemplate.labels map of string Labels to add to the secret
secretTemplate.name string Name is the name of the secret to create Defaults to the GarageAdminToken name
secretTemplate.tokenKey string default: "admin-token" TokenKey is the key name for the admin token in the secret

Status

GarageAdminTokenStatus defines the observed state of GarageAdminToken

Field path Type Constraints Description
conditions array of object Conditions represent the current state
conditions[].lastTransitionTime string required; format: "date-time" lastTransitionTime is the last time the condition transitioned from one status to another. This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
conditions[].message string required; max length: 32768 message is a human readable message indicating details about the transition. This may be an empty string.
conditions[].observedGeneration integer format: "int64"; min: 0 observedGeneration represents the .metadata.generation that the condition was set based upon. For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date with respect to the current state of the instance.
conditions[].reason string required; min length: 1; max length: 1024; pattern: "^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$" reason contains a programmatic identifier indicating the reason for the condition's last transition. Producers of specific condition types may define expected values and meanings for this field, and whether the values are considered a guaranteed API. The value should be a CamelCase string. This field may not be empty.
conditions[].status string required; enum: ["True", "False", "Unknown"] status of the condition, one of True, False, Unknown.
conditions[].type string required; max length: 316; pattern: "^([a-z0-9]([-a-z0-9][a-z0-9])?(\.[a-z0-9]([-a-z0-9][a-z0-9])?)/)?(([A-Za-z0-9][-A-Za-z0-9_.])?[A-Za-z0-9])$" type of condition in CamelCase or in foo.example.com/CamelCase.
expiresAt string format: "date-time" ExpiresAt is deprecated and always cleared because static configured tokens have no Garage-side expiry record.
observedGeneration integer format: "int64" ObservedGeneration is the last observed generation
phase string enum: ["Pending", "Creating", "Ready", "Deleting", "Failed", "Expired", "Unknown"] Phase represents the current phase
secretRef object SecretRef references the created secret
secretRef.name string name is unique within a namespace to reference a secret resource.
secretRef.namespace string namespace defines the space within which the secret name must be unique.
tokenDigest string TokenDigest is the full SHA-256 digest of the static bearer. The controller uses it to detect mutation of an existing generated Secret without exposing any bearer bytes.
tokenId string TokenID is a short display fingerprint of the generated static token. It is not a Garage-assigned dynamic token ID.