integration-manifest.json

{
  "$schema": "https://keyfactor.github.io/integration-manifest-schema.json",
  "integration_type": "orchestrator",
  "name": "Kubernetes Orchestrator Extension",
  "status": "production",
  "description": "The Kubernetes Orchestrator allows for the remote management of certificate stores defined in a Kubernetes cluster. The following types of Kubernetes resources are supported: kubernetes secrets of `kubernetes.io/tls` or `Opaque` and kubernetes certificates `certificates.k8s.io/v1`",
  "short_description": "The Kubernetes Orchestrator allows for remote management of Kubernetes secret types 'Opaque' and 'kubernetes.io/tls' as well as 'certificates.k8s.io/v1' resources. ",
  "link_github": true,
  "topics": [
    "kubernetes",
    "certificates",
    "secrets",
    "k8s",
    "aks",
    "eks",
    "gke",
    "keyfactor",
    "orchestrator",
    "keyfactor-universal-orchestrator"
  ],
  "update_catalog": true,
  "support_level": "kf-supported",
  "release_dir": "kubernetes-orchestrator-extension\\bin\\Release",
  "release_project": "kubernetes-orchestrator-extension\\Keyfactor.Orchestrators.K8S.csproj",
  "about": {
    "orchestrator": {
      "keyfactor_platform_version": "24.4",
      "UOFramework": "12.4",
      "pam_support": true,
      "win": {
        "supportsCreateStore": true,
        "supportsDiscovery": true,
        "supportsManagementAdd": true,
        "supportsManagementRemove": true,
        "supportsReenrollment": false,
        "supportsInventory": true,
        "platformSupport": "Unused"
      },
      "linux": {
        "supportsCreateStore": true,
        "supportsDiscovery": true,
        "supportsManagementAdd": true,
        "supportsManagementRemove": true,
        "supportsReenrollment": false,
        "supportsInventory": true,
        "platformSupport": "Unused"
      },
      "store_types": [
        {
          "Name": "K8SCert",
          "ShortName": "K8SCert",
          "Capability": "K8SCert",
          "ClientMachineDescription": "The Kubernetes cluster name or identifier.",
          "LocalStore": false,
          "SupportedOperations": {
            "Add": false,
            "Create": false,
            "Discovery": true,
            "Enrollment": false,
            "Remove": false
          },
          "Properties": [
            {
              "Name": "ServerUsername",
              "DisplayName": "Server Username",
              "Description": "This should be no value or `kubeconfig`",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerPassword",
              "DisplayName": "Server Password",
              "Description": "The credentials to use to connect to the K8S cluster API. This needs to be in `kubeconfig` format. Example: https://github.com/Keyfactor/k8s-orchestrator/tree/main/scripts/kubernetes#example-service-account-json",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": true
            },
            {
              "Name": "KubeSecretName",
              "DisplayName": "KubeSecretName",
              "Description": "The name of a specific CSR to inventory. Leave empty or set to '*' to inventory ALL issued CSRs in the cluster.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "",
              "Required": false
            }
          ],
          "EntryParameters": [],
          "PasswordOptions": {
            "EntrySupported": false,
            "StoreRequired": false,
            "Style": "Default"
          },
          "StorePathType": "",
          "StorePathValue": "",
          "PrivateKeyAllowed": "Forbidden",
          "JobProperties": [],
          "ServerRequired": true,
          "PowerShell": false,
          "BlueprintAllowed": false,
          "CustomAliasAllowed": "Forbidden"
        },
        {
          "Name": "K8SCluster",
          "ShortName": "K8SCluster",
          "Capability": "K8SCluster",
          "ClientMachineDescription": "This can be anything useful, recommend using the k8s cluster name or identifier.",
          "LocalStore": false,
          "SupportedOperations": {
            "Add": true,
            "Create": true,
            "Discovery": false,
            "Enrollment": false,
            "Remove": true
          },
          "Properties": [
            {
              "Name": "IncludeCertChain",
              "DisplayName": "Include Certificate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "true",
              "Required": false,
              "Description": "Will default to `true` if not set. If set to `false` only the leaf cert will be deployed. Note: If the certificate in Keyfactor Command does not have a private key, it will be sent in DER format (leaf certificate only), and the chain cannot be included regardless of this setting."
            },
            {
              "Name": "SeparateChain",
              "DisplayName": "Separate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "false",
              "Required": false,
              "Description": "Will default to `false` if not set. Set this to `true` if you want to deploy certificate chain to the `ca.crt` field for Opaque and tls secrets."
            },
            {
              "Name": "ServerUsername",
              "DisplayName": "Server Username",
              "Description": "This should be no value or `kubeconfig`",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerPassword",
              "DisplayName": "Server Password",
              "Description": "The credentials to use to connect to the K8S cluster API. This needs to be in `kubeconfig` format. Example: https://github.com/Keyfactor/k8s-orchestrator/tree/main/scripts/kubernetes#example-service-account-json",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            }
          ],
          "EntryParameters": [],
          "PasswordOptions": {
            "EntrySupported": false,
            "StoreRequired": false,
            "Style": "Default"
          },
          "StorePathType": "",
          "StorePathValue": "",
          "PrivateKeyAllowed": "Optional",
          "JobProperties": [],
          "ServerRequired": true,
          "PowerShell": false,
          "BlueprintAllowed": false,
          "CustomAliasAllowed": "Required"
        },
        {
          "Name": "K8SJKS",
          "ShortName": "K8SJKS",
          "Capability": "K8SJKS",
          "ClientMachineDescription": "This can be anything useful, recommend using the k8s cluster name or identifier.",
          "LocalStore": false,
          "SupportedOperations": {
            "Add": true,
            "Create": true,
            "Discovery": true,
            "Enrollment": false,
            "Remove": true
          },
          "Properties": [
            {
              "Name": "KubeNamespace",
              "DisplayName": "KubeNamespace",
              "Description": "The K8S namespace to use to manage the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "default",
              "Required": false
            },
            {
              "Name": "KubeSecretName",
              "DisplayName": "KubeSecretName",
              "Description": "The name of the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "KubeSecretType",
              "DisplayName": "KubeSecretType",
              "Description": "DEPRECATED: This property is deprecated and will be removed in a future release. The secret type is now automatically derived from the store type. This defaults to and must be `jks`.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "jks",
              "Required": false
            },
            {
              "Name": "CertificateDataFieldName",
              "DisplayName": "CertificateDataFieldName",
              "Description": "The field name to use when looking for certificate data in the K8S secret.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "PasswordFieldName",
              "DisplayName": "PasswordFieldName",
              "Description": "The field name to use when looking for the JKS keystore password in the K8S secret. This is either the field name to look at on the same secret, or if `PasswordIsK8SSecret` is set to `true`, the field name to look at on the secret specified in `StorePasswordPath`.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "password",
              "Required": false
            },
            {
              "Name": "PasswordIsK8SSecret",
              "DisplayName": "PasswordIsK8SSecret",
              "Description": "Indicates whether the password to the JKS keystore is stored in a separate K8S secret.",
              "Type": "Bool",
              "DependsOn": "",
              "DefaultValue": "false",
              "Required": false
            },
            {
              "Name": "IncludeCertChain",
              "DisplayName": "Include Certificate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "true",
              "Required": false,
              "Description": "Will default to `true` if not set. If set to `false` only the leaf cert will be deployed. Note: If the certificate in Keyfactor Command does not have a private key, it will be sent in DER format (leaf certificate only), and the chain cannot be included regardless of this setting."
            },
            {
              "Name": "StorePasswordPath",
              "DisplayName": "StorePasswordPath",
              "Description": "The path to the K8S secret object to use as the password to the JKS keystore. Example: `<namespace>/<secret_name>`",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerUsername",
              "DisplayName": "Server Username",
              "Description": "This should be no value or `kubeconfig`",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerPassword",
              "DisplayName": "Server Password",
              "Description": "The credentials to use to connect to the K8S cluster API. This needs to be in `kubeconfig` format. Example: https://github.com/Keyfactor/k8s-orchestrator/tree/main/scripts/kubernetes#example-service-account-json",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            }
          ],
          "EntryParameters": [],
          "PasswordOptions": {
            "EntrySupported": false,
            "StoreRequired": true,
            "Style": "Default"
          },
          "StorePathType": "",
          "StorePathValue": "",
          "PrivateKeyAllowed": "Optional",
          "JobProperties": [],
          "ServerRequired": true,
          "PowerShell": false,
          "BlueprintAllowed": false,
          "CustomAliasAllowed": "Required"
        },
        {
          "Name": "K8SNS",
          "ShortName": "K8SNS",
          "Capability": "K8SNS",
          "ClientMachineDescription": "This can be anything useful, recommend using the k8s cluster name or identifier.",
          "LocalStore": false,
          "SupportedOperations": {
            "Add": true,
            "Create": true,
            "Discovery": true,
            "Enrollment": false,
            "Remove": true
          },
          "Properties": [
            {
              "Name": "KubeNamespace",
              "DisplayName": "Kube Namespace",
              "Description": "The K8S namespace to use to manage the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "default",
              "Required": false
            },
            {
              "Name": "IncludeCertChain",
              "DisplayName": "Include Certificate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "true",
              "Required": false,
              "Description": "Will default to `true` if not set. If set to `false` only the leaf cert will be deployed. Note: If the certificate in Keyfactor Command does not have a private key, it will be sent in DER format (leaf certificate only), and the chain cannot be included regardless of this setting."
            },
            {
              "Name": "SeparateChain",
              "DisplayName": "Separate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "false",
              "Required": false,
              "Description": "Will default to `false` if not set. Set this to `true` if you want to deploy certificate chain to the `ca.crt` field for Opaque and tls secrets."
            },
            {
              "Name": "ServerUsername",
              "DisplayName": "Server Username",
              "Description": "This should be no value or `kubeconfig`",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerPassword",
              "DisplayName": "Server Password",
              "Description": "The credentials to use to connect to the K8S cluster API. This needs to be in `kubeconfig` format. Example: https://github.com/Keyfactor/k8s-orchestrator/tree/main/scripts/kubernetes#example-service-account-json",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            }
          ],
          "EntryParameters": [],
          "PasswordOptions": {
            "EntrySupported": false,
            "StoreRequired": false,
            "Style": "Default"
          },
          "StorePathType": "",
          "StorePathValue": "",
          "PrivateKeyAllowed": "Optional",
          "JobProperties": [],
          "ServerRequired": true,
          "PowerShell": false,
          "BlueprintAllowed": false,
          "CustomAliasAllowed": "Required"
        },
        {
          "Name": "K8SPKCS12",
          "ShortName": "K8SPKCS12",
          "Capability": "K8SPKCS12",
          "ClientMachineDescription": "This can be anything useful, recommend using the k8s cluster name or identifier.",
          "LocalStore": false,
          "SupportedOperations": {
            "Add": true,
            "Create": true,
            "Discovery": true,
            "Enrollment": false,
            "Remove": true
          },
          "Properties": [
            {
              "Name": "IncludeCertChain",
              "DisplayName": "Include Certificate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "true",
              "Required": false,
              "Description": "Will default to `true` if not set. If set to `false` only the leaf cert will be deployed. Note: If the certificate in Keyfactor Command does not have a private key, it will be sent in DER format (leaf certificate only), and the chain cannot be included regardless of this setting."
            },
            {
              "Name": "CertificateDataFieldName",
              "DisplayName": "CertificateDataFieldName",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": ".p12",
              "Required": true
            },
            {
              "Name": "PasswordFieldName",
              "DisplayName": "Password Field Name",
              "Description": "The field name to use when looking for the PKCS12 keystore password in the K8S secret. This is either the field name to look at on the same secret, or if `PasswordIsK8SSecret` is set to `true`, the field name to look at on the secret specified in `StorePasswordPath`.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "password",
              "Required": false
            },
            {
              "Name": "PasswordIsK8SSecret",
              "DisplayName": "Password Is K8S Secret",
              "Description": "Indicates whether the password to the PKCS12 keystore is stored in a separate K8S secret object.",
              "Type": "Bool",
              "DependsOn": "",
              "DefaultValue": "false",
              "Required": false
            },
            {
              "Name": "KubeNamespace",
              "DisplayName": "Kube Namespace",
              "Description": "The K8S namespace to use to manage the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "default",
              "Required": false
            },
            {
              "Name": "KubeSecretName",
              "DisplayName": "Kube Secret Name",
              "Description": "The name of the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerUsername",
              "DisplayName": "Server Username",
              "Description": "This should be no value or `kubeconfig`",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerPassword",
              "DisplayName": "Server Password",
              "Description": "The credentials to use to connect to the K8S cluster API. This needs to be in `kubeconfig` format. Example: https://github.com/Keyfactor/k8s-orchestrator/tree/main/scripts/kubernetes#example-service-account-json",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "KubeSecretType",
              "DisplayName": "Kube Secret Type",
              "Description": "DEPRECATED: This property is deprecated and will be removed in a future release. The secret type is now automatically derived from the store type. This defaults to and must be `pkcs12`.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "pkcs12",
              "Required": false
            },
            {
              "Name": "StorePasswordPath",
              "DisplayName": "StorePasswordPath",
              "Description": "The path to the K8S secret object to use as the password to the PFX/PKCS12 data. Example: `<namespace>/<secret_name>`",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            }
          ],
          "EntryParameters": [],
          "PasswordOptions": {
            "EntrySupported": false,
            "StoreRequired": true,
            "Style": "Default"
          },
          "StorePathType": "",
          "StorePathValue": "",
          "PrivateKeyAllowed": "Optional",
          "JobProperties": [],
          "ServerRequired": true,
          "PowerShell": false,
          "BlueprintAllowed": false,
          "CustomAliasAllowed": "Required"
        },
        {
          "Name": "K8SSecret",
          "ShortName": "K8SSecret",
          "Capability": "K8SSecret",
          "ClientMachineDescription": "This can be anything useful, recommend using the k8s cluster name or identifier.",
          "LocalStore": false,
          "SupportedOperations": {
            "Add": true,
            "Create": true,
            "Discovery": true,
            "Enrollment": false,
            "Remove": true
          },
          "Properties": [
            {
              "Name": "KubeNamespace",
              "DisplayName": "KubeNamespace",
              "Description": "The K8S namespace to use to manage the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "KubeSecretName",
              "DisplayName": "KubeSecretName",
              "Description": "The name of the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "KubeSecretType",
              "DisplayName": "KubeSecretType",
              "Description": "DEPRECATED: This property is deprecated and will be removed in a future release. The secret type is now automatically derived from the store type. This defaults to and must be `secret`.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "secret",
              "Required": false
            },
            {
              "Name": "IncludeCertChain",
              "DisplayName": "Include Certificate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "true",
              "Required": false,
              "Description": "Will default to `true` if not set. If set to `false` only the leaf cert will be deployed. Note: If the certificate in Keyfactor Command does not have a private key, it will be sent in DER format (leaf certificate only), and the chain cannot be included regardless of this setting."
            },
            {
              "Name": "SeparateChain",
              "DisplayName": "Separate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "false",
              "Required": false,
              "Description": "Will default to `false` if not set. Set this to `true` if you want to deploy certificate chain to the `ca.crt` field for Opaque and tls secrets."
            },
            {
              "Name": "ServerUsername",
              "DisplayName": "Server Username",
              "Description": "This should be no value or `kubeconfig`",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerPassword",
              "DisplayName": "Server Password",
              "Description": "The credentials to use to connect to the K8S cluster API. This needs to be in `kubeconfig` format. Example: https://github.com/Keyfactor/k8s-orchestrator/tree/main/scripts/kubernetes#example-service-account-json",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            }
          ],
          "EntryParameters": [],
          "PasswordOptions": {
            "EntrySupported": false,
            "StoreRequired": false,
            "Style": "Default"
          },
          "StorePathType": "",
          "StorePathValue": "",
          "PrivateKeyAllowed": "Optional",
          "JobProperties": [],
          "ServerRequired": true,
          "PowerShell": false,
          "BlueprintAllowed": false,
          "CustomAliasAllowed": "Forbidden"
        },
        {
          "Name": "K8STLSSecr",
          "ShortName": "K8STLSSecr",
          "Capability": "K8STLSSecr",
          "ClientMachineDescription": "This can be anything useful, recommend using the k8s cluster name or identifier.",
          "LocalStore": false,
          "SupportedOperations": {
            "Add": true,
            "Create": true,
            "Discovery": true,
            "Enrollment": false,
            "Remove": true
          },
          "Properties": [
            {
              "Name": "KubeNamespace",
              "DisplayName": "KubeNamespace",
              "Description": "The K8S namespace to use to manage the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "KubeSecretName",
              "DisplayName": "KubeSecretName",
              "Description": "The name of the K8S secret object.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "KubeSecretType",
              "DisplayName": "KubeSecretType",
              "Description": "DEPRECATED: This property is deprecated and will be removed in a future release. The secret type is now automatically derived from the store type. This defaults to and must be `tls_secret`.",
              "Type": "String",
              "DependsOn": "",
              "DefaultValue": "tls_secret",
              "Required": false
            },
            {
              "Name": "IncludeCertChain",
              "DisplayName": "Include Certificate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "true",
              "Required": false,
              "Description": "Will default to `true` if not set. If set to `false` only the leaf cert will be deployed. Note: If the certificate in Keyfactor Command does not have a private key, it will be sent in DER format (leaf certificate only), and the chain cannot be included regardless of this setting."
            },
            {
              "Name": "SeparateChain",
              "DisplayName": "Separate Chain",
              "Type": "Bool",
              "DependsOn": null,
              "DefaultValue": "false",
              "Required": false,
              "Description": "Will default to `false` if not set. Set this to `true` if you want to deploy certificate chain to the `ca.crt` field for Opaque and tls secrets."
            },
            {
              "Name": "ServerUsername",
              "DisplayName": "Server Username",
              "Description": "This should be no value or `kubeconfig`",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            },
            {
              "Name": "ServerPassword",
              "DisplayName": "Server Password",
              "Description": "The credentials to use to connect to the K8S cluster API. This needs to be in `kubeconfig` format. Example: https://github.com/Keyfactor/k8s-orchestrator/tree/main/scripts/kubernetes#example-service-account-json",
              "Type": "Secret",
              "DependsOn": "",
              "DefaultValue": null,
              "Required": false
            }
          ],
          "EntryParameters": [],
          "PasswordOptions": {
            "EntrySupported": false,
            "StoreRequired": false,
            "Style": "Default"
          },
          "StorePathType": "",
          "StorePathValue": "",
          "PrivateKeyAllowed": "Optional",
          "JobProperties": [],
          "ServerRequired": true,
          "PowerShell": false,
          "BlueprintAllowed": false,
          "CustomAliasAllowed": "Forbidden"
        }
      ]
    }
  }
}