Skip to content

Key Management: Vault

Manage OCI Vault resources and their scheduled deletion lifecycle. This page is generated from checked-in package metadata, CRD schemas, and sample manifests.

Resource Snapshot

Field Value
Service keymanagement
Resource Vault
API Version keymanagement.oracle.com/v1beta1
Package Key Management
Support Status Preview
Latest Released Version v2.1.0-alpha
Install Namespace oci-service-operator-keymanagement-system

Spec Fields

This summary shows the top-level spec fields. Use the full API reference for nested fields, defaults, and enum values.

Field Description Type Required
compartmentId The OCID of the compartment where you want to create this vault. string Yes
definedTags Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see Resource Tags (https://docs.oracle.com/iaas/Content/General/Concepts/resourcetags.htm). Example: {"Operations": {"CostCenter": "42"}} map[string, map[string, string]] No
deletionScheduleDays The number of days to retain the Vault after OCI deletion has been scheduled. Set a value from 7 to 30 to control the retention window used when Vault deletion is scheduled. integer (int32) No
displayName A user-friendly name for the vault. It does not have to be unique, and it is changeable. Avoid entering confidential information. string Yes
externalKeyManagerMetadata VaultExternalKeyManagerMetadata defines nested fields for Vault.ExternalKeyManagerMetadata. object No
freeformTags Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see Resource Tags (https://docs.oracle.com/iaas/Content/General/Concepts/resourcetags.htm). Example: {"Department": "Finance"} map[string, string] No
vaultType The type of vault to create. Each type of vault stores the key with different degrees of isolation and has different options and pricing. string Yes

Status Fields

This summary shows the top-level status fields. Use the full API reference for nested fields, defaults, and enum values.

Field Description Type Required
compartmentId The OCID of the compartment that contains this vault. string No
cryptoEndpoint The service endpoint to perform cryptographic operations against. Cryptographic operations include Encrypt (https://docs.oracle.com/iaas/api/#/en/key/latest/EncryptedData/Encrypt), Decrypt (https://docs.oracle.com/iaas/api/#/en/key/latest/DecryptedData/Decrypt), and GenerateDataEncryptionKey (https://docs.oracle.com/iaas/api/#/en/key/latest/GeneratedKey/GenerateDataEncryptionKey) operations. string No
definedTags Defined tags for this resource. Each key is predefined and scoped to a namespace. For more information, see Resource Tags (https://docs.oracle.com/iaas/Content/General/Concepts/resourcetags.htm). Example: {"Operations": {"CostCenter": "42"}} map[string, map[string, string]] No
displayName A user-friendly name for the vault. It does not have to be unique, and it is changeable. Avoid entering confidential information. string No
externalKeyManagerMetadataSummary VaultExternalKeyManagerMetadataSummary defines nested fields for Vault.ExternalKeyManagerMetadataSummary. object No
freeformTags Free-form tags for this resource. Each tag is a simple key-value pair with no predefined name, type, or namespace. For more information, see Resource Tags (https://docs.oracle.com/iaas/Content/General/Concepts/resourcetags.htm). Example: {"Department": "Finance"} map[string, string] No
id The OCID of the vault. string No
isPrimary A Boolean value that indicates whether the Vault is primary Vault or replica Vault. boolean No
isVaultReplicable A Boolean value that indicates whether the Vault has cross region replication capability. Always true for Virtual Private Vaults. boolean No
lifecycleState The vault's current lifecycle state. Example: DELETED string No
managementEndpoint The service endpoint to perform management operations against. Management operations include "Create," "Update," "List," "Get," and "Delete" operations. string No
replicaDetails VaultReplicaDetails defines nested fields for Vault.ReplicaDetails. object No
requestedDeletionScheduleDays The retention period in days last applied when Vault deletion was scheduled. integer (int32) No
restoredFromVaultId The OCID of the vault from which this vault was restored, if it was restored from a backup file. If you restore a vault to the same region, the vault retains the same OCID that it had when you backed up the vault. string No
status - object Yes
timeCreated The date and time this vault was created, expressed in RFC 3339 (https://tools.ietf.org/html/rfc3339) timestamp format. Example: 2018-04-03T21:10:29.600Z string No
timeOfDeletion An optional property to indicate when to delete the vault, expressed in RFC 3339 (https://tools.ietf.org/html/rfc3339) timestamp format. Example: 2018-04-03T21:10:29.600Z string No
vaultType The type of vault. Each type of vault stores the key with different degrees of isolation and has different options and pricing. string No
wrappingkeyId The OCID of the vault's wrapping key. string No

Sample Manifest

This example is generated from the checked-in sample manifest at config/samples/keymanagement_v1beta1_vault.yaml. Replace placeholder values before applying it.

Open the rendered sample page

#
# Copyright (c) 2021, Oracle and/or its affiliates. All rights reserved.
# Licensed under the Universal Permissive License v 1.0 as shown at http://oss.oracle.com/licenses/upl.
#

#
# Replace the OCI identifiers below before running e2e.
# Set `deletionScheduleDays` to a value from 7 to 30 to control OCI deletion retention.
#
apiVersion: keymanagement.oracle.com/v1beta1
kind: Vault
metadata:
  name: vault-sample
spec:
  compartmentId: ocid1.compartment.oc1..exampleuniqueID
  displayName: vault-sample
  vaultType: DEFAULT