PrivateCACertificateAuthority

caPoolRef

Required

object

Immutable.

caPoolRef.external

Optional

string

The caPool for the resource Allowed value: The Google Cloud resource name of a `PrivateCACAPool` resource (format: `projects/{{project}}/locations/{{location}}/caPools/{{name}}`).

caPoolRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

caPoolRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

config

Required

object

Immutable. Required. Immutable. The config used to create a self-signed X.509 certificate or CSR.

config.subjectConfig

Required

object

Immutable. Required. Specifies some of the values in a certificate that are related to the subject.

config.subjectConfig.subject

Required

object

Immutable. Required. Contains distinguished name fields such as the common name, location and organization.

config.subjectConfig.subject.commonName

Optional

string

Immutable. The "common name" of the subject.

config.subjectConfig.subject.countryCode

Optional

string

Immutable. The country code of the subject.

config.subjectConfig.subject.locality

Optional

string

Immutable. The locality or city of the subject.

config.subjectConfig.subject.organization

Optional

string

Immutable. The organization of the subject.

config.subjectConfig.subject.organizationalUnit

Optional

string

Immutable. The organizational_unit of the subject.

config.subjectConfig.subject.postalCode

Optional

string

Immutable. The postal code of the subject.

config.subjectConfig.subject.province

Optional

string

Immutable. The province, territory, or regional state of the subject.

config.subjectConfig.subject.streetAddress

Optional

string

Immutable. The street address of the subject.

config.subjectConfig.subjectAltName

Optional

object

Immutable. Optional. The subject alternative name fields.

config.subjectConfig.subjectAltName.customSans

Optional

list (object)

Immutable. Contains additional subject alternative name values.

config.subjectConfig.subjectAltName.customSans[]

Optional

object

config.subjectConfig.subjectAltName.customSans[].critical

Optional

boolean

Immutable. Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

config.subjectConfig.subjectAltName.customSans[].objectId

Required*

object

Immutable. Required. The OID for this X.509 extension.

config.subjectConfig.subjectAltName.customSans[].objectId.objectIdPath

Required*

list (integer)

Immutable. Required. The parts of an OID path. The most significant parts of the path come first.

config.subjectConfig.subjectAltName.customSans[].objectId.objectIdPath[]

Required*

integer

config.subjectConfig.subjectAltName.customSans[].value

Required*

string

Immutable. Required. The value of this X.509 extension.

config.subjectConfig.subjectAltName.dnsNames

Optional

list (string)

Immutable. Contains only valid, fully-qualified host names.

config.subjectConfig.subjectAltName.dnsNames[]

Optional

string

config.subjectConfig.subjectAltName.emailAddresses

Optional

list (string)

Immutable. Contains only valid RFC 2822 E-mail addresses.

config.subjectConfig.subjectAltName.emailAddresses[]

Optional

string

config.subjectConfig.subjectAltName.ipAddresses

Optional

list (string)

Immutable. Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.

config.subjectConfig.subjectAltName.ipAddresses[]

Optional

string

config.subjectConfig.subjectAltName.uris

Optional

list (string)

Immutable. Contains only valid RFC 3986 URIs.

config.subjectConfig.subjectAltName.uris[]

Optional

string

config.x509Config

Required

object

Immutable. Required. Describes how some of the technical X.509 fields in a certificate should be populated.

config.x509Config.additionalExtensions

Optional

list (object)

Immutable. Optional. Describes custom X.509 extensions.

config.x509Config.additionalExtensions[]

Optional

object

config.x509Config.additionalExtensions[].critical

Optional

boolean

Immutable. Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

config.x509Config.additionalExtensions[].objectId

Required*

object

Immutable. Required. The OID for this X.509 extension.

config.x509Config.additionalExtensions[].objectId.objectIdPath

Required*

list (integer)

Immutable. Required. The parts of an OID path. The most significant parts of the path come first.

config.x509Config.additionalExtensions[].objectId.objectIdPath[]

Required*

integer

config.x509Config.additionalExtensions[].value

Required*

string

Immutable. Required. The value of this X.509 extension.

config.x509Config.caOptions

Optional

object

Immutable. Optional. Describes options in this X509Parameters that are relevant in a CA certificate.

config.x509Config.caOptions.isCa

Optional

boolean

Immutable. Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.

config.x509Config.caOptions.maxIssuerPathLength

Optional

integer

Immutable. Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.

config.x509Config.caOptions.zeroMaxIssuerPathLength

Optional

boolean

Immutable. Optional. When true, the "path length constraint" in Basic Constraints extension will be set to 0. if both max_issuer_path_length and zero_max_issuer_path_length are unset, the max path length will be omitted from the CA certificate.

config.x509Config.keyUsage

Optional

object

Immutable. Optional. Indicates the intended use for keys that correspond to a certificate.

config.x509Config.keyUsage.baseKeyUsage

Optional

object

Immutable. Describes high-level ways in which a key may be used.

config.x509Config.keyUsage.baseKeyUsage.certSign

Optional

boolean

Immutable. The key may be used to sign certificates.

config.x509Config.keyUsage.baseKeyUsage.contentCommitment

Optional

boolean

Immutable. The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

config.x509Config.keyUsage.baseKeyUsage.crlSign

Optional

boolean

Immutable. The key may be used sign certificate revocation lists.

config.x509Config.keyUsage.baseKeyUsage.dataEncipherment

Optional

boolean

Immutable. The key may be used to encipher data.

config.x509Config.keyUsage.baseKeyUsage.decipherOnly

Optional

boolean

Immutable. The key may be used to decipher only.

config.x509Config.keyUsage.baseKeyUsage.digitalSignature

Optional

boolean

Immutable. The key may be used for digital signatures.

config.x509Config.keyUsage.baseKeyUsage.encipherOnly

Optional

boolean

Immutable. The key may be used to encipher only.

config.x509Config.keyUsage.baseKeyUsage.keyAgreement

Optional

boolean

Immutable. The key may be used in a key agreement protocol.

config.x509Config.keyUsage.baseKeyUsage.keyEncipherment

Optional

boolean

Immutable. The key may be used to encipher other keys.

config.x509Config.keyUsage.extendedKeyUsage

Optional

object

Immutable. Detailed scenarios in which a key may be used.

config.x509Config.keyUsage.extendedKeyUsage.clientAuth

Optional

boolean

Immutable. Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

config.x509Config.keyUsage.extendedKeyUsage.codeSigning

Optional

boolean

Immutable. Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

config.x509Config.keyUsage.extendedKeyUsage.emailProtection

Optional

boolean

Immutable. Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

config.x509Config.keyUsage.extendedKeyUsage.ocspSigning

Optional

boolean

Immutable. Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

config.x509Config.keyUsage.extendedKeyUsage.serverAuth

Optional

boolean

Immutable. Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

config.x509Config.keyUsage.extendedKeyUsage.timeStamping

Optional

boolean

Immutable. Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

config.x509Config.keyUsage.unknownExtendedKeyUsages

Optional

list (object)

Immutable. Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.

config.x509Config.keyUsage.unknownExtendedKeyUsages[]

Optional

object

config.x509Config.keyUsage.unknownExtendedKeyUsages[].objectIdPath

Required*

list (integer)

Immutable. Required. The parts of an OID path. The most significant parts of the path come first.

config.x509Config.keyUsage.unknownExtendedKeyUsages[].objectIdPath[]

Required*

integer

config.x509Config.policyIds

Optional

list (object)

Immutable. Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.

config.x509Config.policyIds[]

Optional

object

config.x509Config.policyIds[].objectIdPath

Required*

list (integer)

Immutable. Required. The parts of an OID path. The most significant parts of the path come first.

config.x509Config.policyIds[].objectIdPath[]

Required*

integer

gcsBucketRef

Optional

object

Immutable.

gcsBucketRef.external

Optional

string

Immutable. The name of a Cloud Storage bucket where this CertificateAuthority will publish content, such as the CA certificate and CRLs. This must be a bucket name, without any prefixes (such as `gs://`) or suffixes (such as `.googleapis.com`). For example, to use a bucket named `my-bucket`, you would simply specify `my-bucket`. If not specified, a managed bucket will be created. Allowed value: The Google Cloud resource name of a `StorageBucket` resource (format: `{{name}}`).

gcsBucketRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

gcsBucketRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

keySpec

Required

object

Immutable. Required. Immutable. Used when issuing certificates for this CertificateAuthority. If this CertificateAuthority is a self-signed CertificateAuthority, this key is also used to sign the self-signed CA certificate. Otherwise, it is used to sign a CSR.

keySpec.algorithm

Optional

string

Immutable. The algorithm to use for creating a managed Cloud KMS key for a for a simplified experience. All managed keys will be have their ProtectionLevel as `HSM`. Possible values: RSA_PSS_2048_SHA256, RSA_PSS_3072_SHA256, RSA_PSS_4096_SHA256, RSA_PKCS1_2048_SHA256, RSA_PKCS1_3072_SHA256, RSA_PKCS1_4096_SHA256, EC_P256_SHA256, EC_P384_SHA384

keySpec.cloudKmsKeyVersionRef

Optional

object

Immutable.

keySpec.cloudKmsKeyVersionRef.external

Optional

string

The resource name for an existing Cloud KMS CryptoKeyVersion in the format `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`. This option enables full flexibility in the key's capabilities and properties.

keySpec.cloudKmsKeyVersionRef.name

Optional

string

[WARNING] KMSCryptoKeyVersion not yet supported in Config Connector, use 'external' field to reference existing resources. Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

keySpec.cloudKmsKeyVersionRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

lifetime

Required

string

Immutable. Required. The desired lifetime of the CA certificate. Used to create the "not_before_time" and "not_after_time" fields inside an X.509 certificate.

location

Required

string

Immutable. The location for the resource

projectRef

Required

object

Immutable. The Project that this resource belongs to.

projectRef.external

Optional

string

The project for the resource Allowed value: The Google Cloud resource name of a `Project` resource (format: `projects/{{name}}`).

projectRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

projectRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

resourceID

Optional

string

Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.

type

Required

string

Immutable. Required. Immutable. The Type of this CertificateAuthority. Possible values: SELF_SIGNED, SUBORDINATE

object

Output only. URLs for accessing content published by this CA, such as the CA certificate and CRLs.

string

The URL where this CertificateAuthority's CA certificate is published. This will only be set for CAs that have been activated.

list (string)

The URLs where this CertificateAuthority's CRLs are published. This will only be set for CAs that have been activated.

string

list (object)

Output only. A structured description of this CertificateAuthority's CA certificate and its issuers. Ordered as self-to-root.

object

list (string)

Describes lists of issuer CA certificate URLs that appear in the "Authority Information Access" extension in the certificate.

string

object

Identifies the subject_key_id of the parent certificate, per https://tools.ietf.org/html/rfc5280#section-4.2.1.1

string

Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.

object

The hash of the x.509 certificate.

string

The SHA 256 hash, encoded in hexadecimal, of the DER x509 certificate.

list (string)

Describes a list of locations to obtain CRL information, i.e. the DistributionPoint.fullName described by https://tools.ietf.org/html/rfc5280#section-4.2.1.13

string

object

The public key that corresponds to an issued certificate.

string

Required. The format of the public key. Possible values: PEM

string

Required. A public key. The padding and encoding must match with the `KeyFormat` value specified for the `format` field.

object

Describes some of the values in a certificate that are related to the subject and lifetime.

string

The serial number encoded in lowercase hexadecimal.

string

For convenience, the actual lifetime of an issued certificate.

string

The time after which the certificate is expired. Per RFC 5280, the validity period for a certificate is the period of time from not_before_time through not_after_time, inclusive. Corresponds to 'not_before_time' + 'lifetime' - 1 second.

string

The time at which the certificate becomes valid.

object

Contains distinguished name fields such as the common name, location and organization.

string

The "common name" of the subject.

string

The country code of the subject.

string

The locality or city of the subject.

string

The organization of the subject.

string

The organizational_unit of the subject.

string

The postal code of the subject.

string

The province, territory, or regional state of the subject.

string

The street address of the subject.

object

The subject alternative name fields.

list (object)

Contains additional subject alternative name values.

object

boolean

Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

object

Required. The OID for this X.509 extension.

list (integer)

Required. The parts of an OID path. The most significant parts of the path come first.

integer

string

Required. The value of this X.509 extension.

list (string)

Contains only valid, fully-qualified host names.

string

list (string)

Contains only valid RFC 2822 E-mail addresses.

string

list (string)

Contains only valid 32-bit IPv4 addresses or RFC 4291 IPv6 addresses.

string

list (string)

Contains only valid RFC 3986 URIs.

string

object

Provides a means of identifiying certificates that contain a particular public key, per https://tools.ietf.org/html/rfc5280#section-4.2.1.2.

string

Optional. The value of this KeyId encoded in lowercase hexadecimal. This is most likely the 160 bit SHA-1 hash of the public key.

object

Describes some of the technical X.509 fields in a certificate.

list (object)

Optional. Describes custom X.509 extensions.

object

boolean

Optional. Indicates whether or not this extension is critical (i.e., if the client does not know how to handle this extension, the client should consider this to be an error).

object

Required. The OID for this X.509 extension.

list (integer)

Required. The parts of an OID path. The most significant parts of the path come first.

integer

string

Required. The value of this X.509 extension.

list (string)

Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

string

object

Optional. Describes options in this X509Parameters that are relevant in a CA certificate.

boolean

Optional. Refers to the "CA" X.509 extension, which is a boolean value. When this value is missing, the extension will be omitted from the CA certificate.

integer

Optional. Refers to the path length restriction X.509 extension. For a CA certificate, this value describes the depth of subordinate CA certificates that are allowed. If this value is less than 0, the request will fail. If this value is missing, the max path length will be omitted from the CA certificate.

object

Optional. Indicates the intended use for keys that correspond to a certificate.

object

Describes high-level ways in which a key may be used.

boolean

The key may be used to sign certificates.

boolean

The key may be used for cryptographic commitments. Note that this may also be referred to as "non-repudiation".

boolean

The key may be used sign certificate revocation lists.

boolean

The key may be used to encipher data.

boolean

The key may be used to decipher only.

boolean

The key may be used for digital signatures.

boolean

The key may be used to encipher only.

boolean

The key may be used in a key agreement protocol.

boolean

The key may be used to encipher other keys.

object

Detailed scenarios in which a key may be used.

boolean

Corresponds to OID 1.3.6.1.5.5.7.3.2. Officially described as "TLS WWW client authentication", though regularly used for non-WWW TLS.

boolean

Corresponds to OID 1.3.6.1.5.5.7.3.3. Officially described as "Signing of downloadable executable code client authentication".

boolean

Corresponds to OID 1.3.6.1.5.5.7.3.4. Officially described as "Email protection".

boolean

Corresponds to OID 1.3.6.1.5.5.7.3.9. Officially described as "Signing OCSP responses".

boolean

Corresponds to OID 1.3.6.1.5.5.7.3.1. Officially described as "TLS WWW server authentication", though regularly used for non-WWW TLS.

boolean

Corresponds to OID 1.3.6.1.5.5.7.3.8. Officially described as "Binding the hash of an object to a time".

list (object)

Used to describe extended key usages that are not listed in the KeyUsage.ExtendedKeyUsageOptions message.

object

list (integer)

Required. The parts of an OID path. The most significant parts of the path come first.

integer

list (object)

Optional. Describes the X.509 certificate policy object identifiers, per https://tools.ietf.org/html/rfc5280#section-4.2.1.4.

object

list (integer)

Required. The parts of an OID path. The most significant parts of the path come first.

integer

list (object)

Conditions represent the latest available observation of the resource's current state.

object

string

Last time the condition transitioned from one status to another.

string

Human-readable message indicating details about last transition.

string

Unique, one-word, CamelCase reason for the condition's last transition.

string

Status is the status of the condition. Can be True, False, Unknown.

string

Type is the type of the condition.

object

object

Optional. The public key that corresponds to this config. This is, for example, used when issuing Certificates, but not when creating a self-signed CertificateAuthority or CertificateAuthority CSR.

string

Required. The format of the public key. Possible values: PEM

string

Required. A public key. The padding and encoding must match with the `KeyFormat` value specified for the `format` field.

object

list (string)

Optional. Describes Online Certificate Status Protocol (OCSP) endpoint addresses that appear in the "Authority Information Access" extension in the certificate.

string

string

Output only. The time at which this CertificateAuthority was created.

string

Output only. The time at which this CertificateAuthority was soft deleted, if it is in the DELETED state.

string

Output only. The time at which this CertificateAuthority will be permanently purged, if it is in the DELETED state.

integer

ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.

list (string)

Output only. This CertificateAuthority's certificate chain, including the current CertificateAuthority's certificate. Ordered such that the root issuer is the final element (consistent with RFC 5246). For a self-signed CA, this will only list the current CertificateAuthority's certificate.

string

string

Output only. The State for this CertificateAuthority. Possible values: ENABLED, DISABLED, STAGED, AWAITING_USER_ACTIVATION, DELETED

object

Optional. If this is a subordinate CertificateAuthority, this field will be set with the subordinate configuration, which describes its issuers. This may be updated, but this CertificateAuthority must continue to validate.

string

Required. This can refer to a CertificateAuthority in the same project that was used to create a subordinate CertificateAuthority. This field is used for information and usability purposes only. The resource name is in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.

object

Required. Contains the PEM certificate chain for the issuers of this CertificateAuthority, but not pem certificate for this CA itself.

list (string)

Required. Expected to be in leaf-to-root order according to RFC 5246.

string

string

Output only. The CaPool.Tier of the CaPool that includes this CertificateAuthority. Possible values: ENTERPRISE, DEVOPS

string

Output only. The time at which this CertificateAuthority was last updated.