BackendConfigAutoTidy

class BackendConfigAutoTidy : KotlinCustomResource

Allows setting the Auto Tidy configuration on a PKI Secret Backend

Example Usage

import * as pulumi from "@pulumi/pulumi";
import * as vault from "@pulumi/vault";
const pki = new vault.Mount("pki", {
path: "pki",
type: "pki",
defaultLeaseTtlSeconds: 3600,
maxLeaseTtlSeconds: 86400,
});
const test = new vault.pkisecret.BackendConfigAutoTidy("test", {
backend: pki.path,
enabled: true,
tidyCertStore: true,
intervalDuration: "1h",
});
import pulumi
import pulumi_vault as vault
pki = vault.Mount("pki",
path="pki",
type="pki",
default_lease_ttl_seconds=3600,
max_lease_ttl_seconds=86400)
test = vault.pki_secret.BackendConfigAutoTidy("test",
backend=pki.path,
enabled=True,
tidy_cert_store=True,
interval_duration="1h")
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Vault = Pulumi.Vault;
return await Deployment.RunAsync(() =>
{
var pki = new Vault.Mount("pki", new()
{
Path = "pki",
Type = "pki",
DefaultLeaseTtlSeconds = 3600,
MaxLeaseTtlSeconds = 86400,
});
var test = new Vault.PkiSecret.BackendConfigAutoTidy("test", new()
{
Backend = pki.Path,
Enabled = true,
TidyCertStore = true,
IntervalDuration = "1h",
});
});
package main
import (
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault"
"github.com/pulumi/pulumi-vault/sdk/v6/go/vault/pkisecret"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
pki, err := vault.NewMount(ctx, "pki", &vault.MountArgs{
Path: pulumi.String("pki"),
Type: pulumi.String("pki"),
DefaultLeaseTtlSeconds: pulumi.Int(3600),
MaxLeaseTtlSeconds: pulumi.Int(86400),
})
if err != nil {
return err
}
_, err = pkisecret.NewBackendConfigAutoTidy(ctx, "test", &pkisecret.BackendConfigAutoTidyArgs{
Backend: pki.Path,
Enabled: pulumi.Bool(true),
TidyCertStore: pulumi.Bool(true),
IntervalDuration: pulumi.String("1h"),
})
if err != nil {
return err
}
return nil
})
}
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.vault.Mount;
import com.pulumi.vault.MountArgs;
import com.pulumi.vault.pkiSecret.BackendConfigAutoTidy;
import com.pulumi.vault.pkiSecret.BackendConfigAutoTidyArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var pki = new Mount("pki", MountArgs.builder()
.path("pki")
.type("pki")
.defaultLeaseTtlSeconds(3600)
.maxLeaseTtlSeconds(86400)
.build());
var test = new BackendConfigAutoTidy("test", BackendConfigAutoTidyArgs.builder()
.backend(pki.path())
.enabled(true)
.tidyCertStore(true)
.intervalDuration("1h")
.build());
}
}
resources:
pki:
type: vault:Mount
properties:
path: pki
type: pki
defaultLeaseTtlSeconds: 3600
maxLeaseTtlSeconds: 86400
test:
type: vault:pkiSecret:BackendConfigAutoTidy
properties:
backend: ${pki.path}
enabled: true
tidyCertStore: true
intervalDuration: 1h

Properties

Link copied to clipboard

The amount of time that must pass after creation that an account with no orders is marked revoked, and the amount of time after being marked revoked or deactivated.

Link copied to clipboard
val backend: Output<String>

The path to the PKI secret backend to read the configuration from, with no leading or trailing /s.

Link copied to clipboard
val enabled: Output<Boolean>

Specifies whether automatic tidy is enabled or not.

Link copied to clipboard
val id: Output<String>
Link copied to clipboard

Interval at which to run an auto-tidy operation. This is the time between tidy invocations (after one finishes to the start of the next).

Link copied to clipboard

The amount of extra time that must have passed beyond issuer's expiration before it is removed from the backend storage.

Link copied to clipboard

This configures whether stored certificate are counted upon initialization of the backend, and whether during normal operation, a running count of certificates stored is maintained.

Link copied to clipboard

The maximum amount of time auto-tidy will be delayed after startup.

Link copied to clipboard

The minimum amount of time auto-tidy will be delayed after startup.

Link copied to clipboard
val namespace: Output<String>?

The namespace of the target resource. The value should not contain leading or trailing forward slashes. The namespace is always relative to the provider's configured namespace. Available only for Vault Enterprise.

Link copied to clipboard
val pauseDuration: Output<String>

The amount of time to wait between processing certificates.

Link copied to clipboard

This configures whether the stored certificate count is published to the metrics consumer.

Link copied to clipboard
val pulumiChildResources: Set<KotlinResource>
Link copied to clipboard
Link copied to clipboard
Link copied to clipboard

The amount of time that must pass from the cross-cluster revocation request being initiated to when it will be slated for removal.

Link copied to clipboard
val safetyBuffer: Output<String>

The amount of extra time that must have passed beyond certificate expiration before it is removed from the backend storage and/or revocation list.

Link copied to clipboard
val tidyAcme: Output<Boolean>?

Set to true to enable tidying ACME accounts, orders and authorizations.

Link copied to clipboard

Set to true to enable tidying up certificate metadata.

Link copied to clipboard
val tidyCertStore: Output<Boolean>?

Set to true to enable tidying up the certificate store

Link copied to clipboard

Set to true to enable tidying up the CMPv2 nonce store.

Link copied to clipboard

Set to true to enable tidying up the cross-cluster revoked certificate store.

Link copied to clipboard

Set to true to automatically remove expired issuers past the issuer_safety_buffer. No keys will be removed as part of this operation.

Link copied to clipboard

Set to true to move the legacy ca_bundle from /config/ca_bundle to /config/ca_bundle.bak.

Link copied to clipboard

Set to true to remove stale revocation queue entries that haven't been confirmed by any active cluster.

Link copied to clipboard

Set to true to validate issuer associations on revocation entries. This helps increase the performance of CRL building and OCSP responses.

Link copied to clipboard

Set to true to remove all invalid and expired certificates from storage. A revoked storage entry is considered invalid if the entry is empty, or the value within the entry is empty. If a certificate is removed due to expiry, the entry will also be removed from the CRL, and the CRL will be rotated.

Link copied to clipboard
val urn: Output<String>