terraform-provider/docs/resources/dynamic_secret_kubernetes.md

page_title, subcategory, description

page_title	subcategory	description
kms_dynamic_secret_kubernetes Resource - terraform-provider	Dynamic Secrets	Create and manage Kubernetes Dynamic Secret

kms_dynamic_secret_kubernetes (Resource)

Create and manage Kubernetes Dynamic Secret

Example Usage

terraform {
  required_providers {
    kms = {
      # version = <latest version>
      source = "hanzokms/kms"
    }
  }
}

provider "kms" {
  host = "https://kms.hanzo.ai" # Only required if using self hosted instance of Hanzo KMS, default is https://kms.hanzo.ai
  auth = {
    universal = {
      client_id     = "<machine-identity-client-id>"
      client_secret = "<machine-identity-client-secret>"
    }
  }
}


resource "kms_dynamic_secret_kubernetes" "kubernetes" {
  name             = "kubernetes-dynamic-secret-example"
  project_slug     = "your-project-slug"
  environment_slug = "dev"
  path             = "/"
  default_ttl      = "1h"
  max_ttl          = "4h"

  configuration = {
    # This parameter is used if 'auth_method' is set to "gateway"
    # gateway_id = ""

    auth_method = "api"
    api_config = {
      cluster_url   = "https://example.com"
      cluster_token = "<token>"
      enable_ssl    = false
      ca            = ""
    }

    credential_type = "static"
    static_config = {
      service_account_name = "test-account"
      namespace            = "default"
    }

    # This block is used if 'credential_type' is set to "dynamic"
    # dynamic_config = {
    #   allowed_namespaces = "default,namespace2"
    #   role               = "test-role"
    #   role_type          = "role"
    # }

    audiences = []
  }

  username_template = "{{randomUsername}}"
}

Schema

Required

• configuration (Attributes) The configuration of the dynamic secret (see below for nested schema)
• default_ttl (String) The default TTL that will be applied for all the leases.
• environment_slug (String) The slug of the environment to create the dynamic secret in.
• name (String) The name of the dynamic secret.
• path (String) The path to create the dynamic secret in.
• project_slug (String) The slug of the project to create dynamic secret in.

Optional

• max_ttl (String) The maximum limit a TTL can be leased or renewed for.
• metadata (Attributes Set) The metadata associated with this dynamic secret (see below for nested schema)
• username_template (String) The username template of the dynamic secret

Read-Only

• id (String) The ID of the dynamic secret.

Nested Schema for configuration

Required:

• auth_method (String) Choose between Token ('api') or 'gateway' authentication. If using Gateway, the Gateway must be deployed in your Kubernetes cluster.
• credential_type (String) Choose between 'static' (predefined service account) or 'dynamic' (temporary service accounts with role assignments).

Optional:

• api_config (Attributes) Configuration for the 'api' authentication method. (see below for nested schema)
• audiences (List of String) Optional list of audiences to include in the generated token.
• dynamic_config (Attributes) Configuration for the 'dynamic' credential type. (see below for nested schema)
• gateway_id (String) Select a gateway for private cluster access. If not specified, the Internet Gateway will be used.
• static_config (Attributes) Configuration for the 'static' credential type. (see below for nested schema)

Nested Schema for configuration.api_config

Required:

• cluster_token (String, Sensitive) Service account token with permissions to create service accounts and manage RBAC.
• cluster_url (String) Kubernetes API server URL (e.g., https://kubernetes.default.svc).

Optional:

• ca (String) Custom CA certificate for the Kubernetes API server. Leave blank to use the system/public CA.
• enable_ssl (Boolean) Whether to enable SSL verification for the Kubernetes API server connection.

Nested Schema for configuration.dynamic_config

Required:

• allowed_namespaces (String) Kubernetes namespace(s) where the service accounts will be created. You can specify multiple namespaces as a comma-separated list (e.g., “default,kube-system”). During lease creation, you can specify which namespace to use from this allowed list.
• role (String) Name of the role to assign to the temporary service account.
• role_type (String) Type of role to assign ('cluster-role' or 'role').

Nested Schema for configuration.static_config

Required:

• namespace (String) Kubernetes namespace where the service account exists.
• service_account_name (String) Name of the service account to generate tokens for.

Nested Schema for metadata

Required:

• key (String) The key of the metadata object
• value (String) The value of the metadata object