BackendConfigEst

Fields parsed from the CSR that appear in the audit and can be used by sentinel policies.

Lists the mount accessors EST should delegate authentication requests towards (see below for nested schema).

The path to the PKI secret backend to read the EST configuration from, with no leading or trailing /s.

If set, this mount will register the default .well-known/est URL path. Only a single mount can enable this across a Vault cluster.

Required to be set if default_mount is enabled. Specifies the behavior for requests using the default EST label. Can be sign-verbatim or a role given by role:.

Specifies whether EST is enabled.

If set, parse out fields from the provided CSR making them available for Sentinel policies.

Configures a pairing of an EST label with the redirected behavior for requests hitting that role. The path policy can be sign-verbatim or a role given by role:. Labels must be unique across Vault cluster, and will register .well-known/est/ URL paths.

A read-only timestamp representing the last time the configuration was updated.

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.