Skip to content

Commit ccceb84

Browse files
author
Keyfactor
committed
Update store_types.json for all:latest
1 parent bd857a0 commit ccceb84

2 files changed

Lines changed: 246 additions & 64 deletions

File tree

‎cmd/store_types.json‎

Lines changed: 123 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -447,6 +447,34 @@
447447
"ClientMachineDescription": "This is a full AWS ARN specifying a Role. This is the Role that will be assumed in any Auth scenario performing Assume Role. This will dictate what certificates are usable by the orchestrator. A preceding [profile] name should be included if a Credential Profile is to be used in Default Sdk Auth.",
448448
"StorePathDescription": "A single specified AWS Region the store will operate in. Additional regions should get their own store defined."
449449
},
450+
{
451+
"Name": "Airlock Application Firewall Certificate",
452+
"ShortName": "AirlockWAF",
453+
"Capability": "AirlockWAF",
454+
"LocalStore": false,
455+
"SupportedOperations": {
456+
"Add": false,
457+
"Create": false,
458+
"Discovery": true,
459+
"Enrollment": false,
460+
"Remove": false
461+
},
462+
"Properties": [],
463+
"EntryParameters": [],
464+
"PasswordOptions": {
465+
"EntrySupported": false,
466+
"StoreRequired": true,
467+
"Style": "Default"
468+
},
469+
"StorePathType": "",
470+
"StorePathValue": "",
471+
"PrivateKeyAllowed": "Required",
472+
"JobProperties": [],
473+
"ServerRequired": true,
474+
"PowerShell": false,
475+
"BlueprintAllowed": false,
476+
"CustomAliasAllowed": "Allowed"
477+
},
450478
{
451479
"Name": "Akamai Certificate Provisioning Service",
452480
"ShortName": "Akamai",
@@ -999,7 +1027,22 @@
9991027
"PrivateKeyAllowed": "Optional",
10001028
"JobProperties": [],
10011029
"Properties": [],
1002-
"EntryParameters": []
1030+
"EntryParameters": [
1031+
{
1032+
"Name": "VirtualServiceBindings",
1033+
"DisplayName": "Virtual Service Bindings",
1034+
"Type": "String",
1035+
"DefaultValue": "",
1036+
"DependsOn": "",
1037+
"RequiredWhen": {
1038+
"HasPrivateKey": false,
1039+
"OnAdd": false,
1040+
"OnRemove": false,
1041+
"OnReenrollment": false
1042+
},
1043+
"Description": "Comma-separated list of virtual service bindings in 'virtId:servicePort' format. Each binding identifies the virtual server ID and the service port to which the certificate should be bound. Example: '1:443' for a single binding, or '1:443,2:443,my-virt:8443' for multiple bindings. Returned during inventory to show which virtual services each certificate is currently bound to."
1044+
}
1045+
]
10031046
},
10041047
{
10051048
"Name": "Azure Application Gateway Certificate Binding",
@@ -1271,14 +1314,6 @@
12711314
"DefaultValue": "public,china,germany,government",
12721315
"Description": "Specifies the Azure Cloud instance used by the organization.",
12731316
"Required": false
1274-
},
1275-
{
1276-
"Name": "ServerUseSsl",
1277-
"DisplayName": "Use SSL",
1278-
"Type": "Bool",
1279-
"DefaultValue": "true",
1280-
"Description": "Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it.",
1281-
"Required": true
12821317
}
12831318
],
12841319
"PasswordOptions": {
@@ -1465,14 +1500,6 @@
14651500
"DefaultValue": "public,china,germany,government",
14661501
"Description": "Specifies the Azure Cloud instance used by the organization.",
14671502
"Required": false
1468-
},
1469-
{
1470-
"Name": "ServerUseSsl",
1471-
"DisplayName": "Use SSL",
1472-
"Type": "Bool",
1473-
"DefaultValue": "true",
1474-
"Description": "Specifies whether SSL should be used for communication with the server. Set to 'true' to enable SSL, and 'false' to disable it.",
1475-
"Required": true
14761503
}
14771504
],
14781505
"PasswordOptions": {
@@ -2054,7 +2081,7 @@
20542081
"SupportedOperations": {
20552082
"Add": true,
20562083
"Create": false,
2057-
"Discovery": false,
2084+
"Discovery": true,
20582085
"Enrollment": false,
20592086
"Remove": false
20602087
},
@@ -2131,7 +2158,7 @@
21312158
],
21322159
"EntryParameters": [],
21332160
"ClientMachineDescription": "The Client Machine field should contain the IP or Domain name and Port Needed for REST API Access. For SSH Access, Port 22 will be used.",
2134-
"StorePathDescription": "The Store Path field should always be / unless we later determine there are alternate locations needed.",
2161+
"StorePathDescription": "The store path uses the format domain\\directory (e.g., default\\pubcert, production-api\\cert). The Discovery job can automatically find all valid store paths on an appliance.",
21352162
"PasswordOptions": {
21362163
"EntrySupported": false,
21372164
"StoreRequired": false,
@@ -2772,7 +2799,55 @@
27722799
"Name": "tags",
27732800
"DisplayName": "Tags",
27742801
"Type": "String",
2775-
"Description": "One-to-many Organization level tag Key:Value combinations, comma delimited - i.e. tagKey1:tagVal1,tagKey2:tagVal2,...tagKeyN:tagValN",
2802+
"Description": "An optional list of one-to-many comma delimited Organization level tag Key:Value combinations. Values should be entered as tagKey1:tagVal1,tagKey2:tagVal2,...tagKeyN:tagValN",
2803+
"RequiredWhen": {
2804+
"HasPrivateKey": false,
2805+
"OnAdd": false,
2806+
"OnRemove": false,
2807+
"OnReenrollment": false
2808+
}
2809+
},
2810+
{
2811+
"Name": "labels",
2812+
"DisplayName": "Labels",
2813+
"Type": "String",
2814+
"Description": "An optional list of one-to-many comma delimited label key:value pairs to assign to the secret. Values should be entered as key1:value1,key2:value2,...,keyN:valueN.",
2815+
"RequiredWhen": {
2816+
"HasPrivateKey": false,
2817+
"OnAdd": false,
2818+
"OnRemove": false,
2819+
"OnReenrollment": false
2820+
}
2821+
},
2822+
{
2823+
"Name": "replicationRegions",
2824+
"DisplayName": "Replication Regions",
2825+
"Type": "String",
2826+
"Description": "An optional list of valid comma delimited GCP regions to replicate secrets to (user managed replication). If left blank, GCP default behavior (automatic replication) will be executed. Values can also be entered as region1:path1,region2:path2,...,regionN:pathN if providing a kmsKeyName path for each region is desired.",
2827+
"RequiredWhen": {
2828+
"HasPrivateKey": false,
2829+
"OnAdd": false,
2830+
"OnRemove": false,
2831+
"OnReenrollment": false
2832+
}
2833+
},
2834+
{
2835+
"Name": "ttlDuration",
2836+
"DisplayName": "TTL Duration",
2837+
"Type": "String",
2838+
"Description": "An optional number of days to provide after which a secret will be deleted. If not provided, secret will stay around until explicitly deleted.",
2839+
"RequiredWhen": {
2840+
"HasPrivateKey": false,
2841+
"OnAdd": false,
2842+
"OnRemove": false,
2843+
"OnReenrollment": false
2844+
}
2845+
},
2846+
{
2847+
"Name": "versionDestroyTtlDuration",
2848+
"DisplayName": "Version Destroy TTL Duration",
2849+
"Type": "String",
2850+
"Description": "An optional number of days to provide after a secret is destroyed that its versions will stay around. If not provided, versions will be permanently destroyed when the secret is destroyed.",
27762851
"RequiredWhen": {
27772852
"HasPrivateKey": false,
27782853
"OnAdd": false,
@@ -2841,10 +2916,10 @@
28412916
"PowerShell": false,
28422917
"PrivateKeyAllowed": "Required",
28432918
"StorePathType": "",
2844-
"StorePathValue": "n/a",
2919+
"StorePathValue": "",
28452920
"SupportedOperations": {
28462921
"Add": true,
2847-
"Create": true,
2922+
"Create": false,
28482923
"Discovery": true,
28492924
"Enrollment": false,
28502925
"Remove": true
@@ -2857,28 +2932,44 @@
28572932
"Properties": [
28582933
{
28592934
"Name": "Location",
2860-
"DisplayName": "Location",
2935+
"DisplayName": "Location (deprecated)",
28612936
"Type": "String",
28622937
"DependsOn": "",
2863-
"DefaultValue": "global",
2864-
"Required": true,
2938+
"DefaultValue": "",
2939+
"Required": false,
28652940
"IsPAMEligible": false,
2866-
"Description": "The GCP region used for this Certificate Manager instance. **global** is the default but could be another region based on the project."
2941+
"Description": "**Deprecated in v1.2.** The GCP location is parsed from Store Path. Leave blank for new stores. v1.1-shape stores (where Store Path is blank or `n/a`) still read this value as a fallback; expect a deprecation warning in the orchestrator log when that path is used."
28672942
},
28682943
{
28692944
"Name": "ServiceAccountKey",
2870-
"DisplayName": "Service Account Key File Path",
2945+
"DisplayName": "Service Account Key File Path (deprecated)",
28712946
"Type": "String",
28722947
"DependsOn": "",
28732948
"DefaultValue": "",
28742949
"Required": false,
28752950
"IsPAMEligible": false,
2876-
"Description": "The file name of the Google Cloud Service Account Key File installed in the same folder as the orchestrator extension. Empty if the orchestrator server resides in GCP and you are not using a service account key."
2951+
"Description": "**Deprecated in v1.2.** Leave blank. Authenticate via Application Default Credentials instead (set `GOOGLE_APPLICATION_CREDENTIALS` as a machine-level environment variable on the orchestrator host pointing at the JSON key, or run on a GCE VM / GKE pod with workload identity). The Discovery job has no way to surface this custom property in Keyfactor Command's discovery-job UI, so ADC is the only mechanism that works uniformly across all four job types. v1.1 stores that have this populated continue to work via a deprecation-logged fallback; the field is scheduled for removal in v2.0."
28772952
}
28782953
],
2879-
"ClientMachineDescription": "GCP Project ID for your account.",
2880-
"StorePathDescription": "This is not used and should be defaulted to n/a per the certificate store type set up.",
2881-
"EntryParameters": []
2954+
"ClientMachineDescription": "Display label for grouping certificate stores in Keyfactor Command. Recommended value is the GCP Organization ID (e.g. `1005564431893`); the orchestrator does not parse a project ID out of this field. The actual GCP project + location are read from Store Path.",
2955+
"StorePathDescription": "Canonical GCP resource path in the form `projects/{projectId}/locations/{location}` (e.g. `projects/edgecerts/locations/global`). This is the single source of truth for which Certificate Manager instance the store targets. For Discovery-approved stores Keyfactor Command auto-fills this from the discovered candidate; for manually-created stores the operator types it directly.",
2956+
"EntryParameters": [
2957+
{
2958+
"Name": "Scope",
2959+
"DisplayName": "Certificate Scope",
2960+
"Type": "MultipleChoice",
2961+
"DependsOn": "",
2962+
"DefaultValue": "DEFAULT",
2963+
"Options": "DEFAULT,ALL_REGIONS,EDGE_CACHE,CLIENT_AUTH",
2964+
"RequiredWhen": {
2965+
"HasPrivateKey": false,
2966+
"OnAdd": false,
2967+
"OnRemove": false,
2968+
"OnReenrollment": false
2969+
},
2970+
"Description": "GCP Certificate Manager `scope` for this certificate entry. Allowed: `DEFAULT` (global external Application Load Balancers), `ALL_REGIONS` (cross-region internal Application Load Balancers), `EDGE_CACHE` (Media CDN), `CLIENT_AUTH` (mTLS trust configs / authorized client server certs). **Immutable in GCP** - once a certificate is created with a given scope, GCP refuses to change it. Inventory persists the existing scope back from GCP so renewals carry it forward automatically. A single store can hold certs at different scopes (the field is per-entry, not store-wide)."
2971+
}
2972+
]
28822973
},
28832974
{
28842975
"Name": "Hashicorp Vault Key-Value",
@@ -3657,7 +3748,7 @@
36573748
"Description": "This should be no value or `kubeconfig`",
36583749
"Type": "Secret",
36593750
"DependsOn": "",
3660-
"DefaultValue": "",
3751+
"DefaultValue": null,
36613752
"Required": false
36623753
},
36633754
{

0 commit comments

Comments
 (0)