SecretBackendConnectionSecretBackendConnection is the Schema for the SecretBackendConnections API. Configures a database secret backend connection for Vault.
TypeMR
Providerprovider-vault
Groupdatabase.vault.m.upbound.io
Scopenamespaced
Versionv1alpha1

1apiVersion: database.vault.m.upbound.io/v1alpha1

2kind: SecretBackendConnection

kind
string
metadata
object
spec
object

SecretBackendConnectionSpec defines the desired state of SecretBackendConnection

forProvider
required
object

(No description available)

allowedRoles
array

A list of roles that are allowed to use this connection. A list of roles that are allowed to use this connection.

backend
string
backendRef
object

Reference to a Mount in vault to populate backend.

name
required
string
namespace
string
policy
object

Policies for referencing.

resolve
string
backendSelector
object

Selector for a Mount in vault to populate backend.

namespace
string
policy
object

Policies for selection.

resolve
string
cassandra
array

A nested block containing configuration options for Cassandra connections. Connection parameters for the cassandra-database-plugin plugin.

hosts
array

The hosts to connect to. Cassandra hosts to connect to.

passwordSecretRef
object

The password to authenticate with. The password to use when authenticating with Cassandra.

key
required
string
name
required
string
pemBundleSecretRef
object

Concatenated PEM blocks configuring the certificate chain. Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
pemJsonSecretRef
object

A JSON structure configuring the certificate chain. Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
port
number
tls
boolean
username
string
couchbase
array

A nested block containing configuration options for Couchbase connections. Connection parameters for the couchbase-database-plugin plugin.

base64PemSecretRef
object

Required if tls is true. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded. Required if tls is true. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.

key
required
string
name
required
string
hosts
array

The hosts to connect to. A set of Couchbase URIs to connect to. Must use couchbases:// scheme if tls is true.

passwordSecretRef
object

The password to authenticate with. Specifies the password corresponding to the given username.

key
required
string
name
required
string
tls
boolean
username
string
data
object
elasticsearch
array

A nested block containing configuration options for Elasticsearch connections. Connection parameters for the elasticsearch-database-plugin.

caCert
string
caPath
string
clientKey
string
insecure
boolean
passwordSecretRef
object

The password to authenticate with. The password to be used in the connection URL

key
required
string
name
required
string
url
string
username
string
hana
array

A nested block containing configuration options for SAP HanaDB connections. Connection parameters for the hana-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
influxdb
array

A nested block containing configuration options for InfluxDB connections. Connection parameters for the influxdb-database-plugin plugin.

host
string
passwordSecretRef
object

The password to authenticate with. Specifies the password corresponding to the given username.

key
required
string
name
required
string
pemBundleSecretRef
object

Concatenated PEM blocks configuring the certificate chain. Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
pemJsonSecretRef
object

A JSON structure configuring the certificate chain. Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
port
number
tls
boolean
username
string
mongodb
array

A nested block containing configuration options for MongoDB connections. Connection parameters for the mongodb-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
mongodbatlas
array

A nested block containing configuration options for MongoDB Atlas connections. Connection parameters for the mongodbatlas-database-plugin plugin.

privateKeySecretRef
object

The Private Programmatic API Key used to connect with MongoDB Atlas API. The Private Programmatic API Key used to connect with MongoDB Atlas API.

key
required
string
name
required
string
projectId
string
publicKey
string
mssql
array

A nested block containing configuration options for MSSQL connections. Connection parameters for the mssql-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
mysql
array

A nested block containing configuration options for MySQL connections. Connection parameters for the mysql-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
mysqlAurora
array

A nested block containing configuration options for Aurora MySQL connections. Connection parameters for the mysql-aurora-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
mysqlLegacy
array

A nested block containing configuration options for legacy MySQL connections. Connection parameters for the mysql-legacy-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
mysqlRds
array

A nested block containing configuration options for RDS MySQL connections. Connection parameters for the mysql-rds-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
name
string
namespace
string
oracle
array

A nested block containing configuration options for Oracle connections. Connection parameters for the oracle-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
postgresql
array

A nested block containing configuration options for PostgreSQL connections. Connection parameters for the postgresql-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
privateKeySecretRef
object

The Private Programmatic API Key used to connect with MongoDB Atlas API. The secret key used for the x509 client certificate. Must be PEM encoded.

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
username
string
redis
array

A nested block containing configuration options for Redis connections. Connection parameters for the redis-database-plugin plugin.

caCert
string
host
string
passwordSecretRef
object

The password to authenticate with. Specifies the password corresponding to the given username.

key
required
string
name
required
string
port
number
tls
boolean
username
string
redisElasticache
array

A nested block containing configuration options for Redis ElastiCache connections. Connection parameters for the redis-elasticache-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.

key
required
string
name
required
string
region
string
url
string
usernameSecretRef
object

The username to authenticate with. The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.

key
required
string
name
required
string
redshift
array

Connection parameters for the redshift-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
rootRotationStatements
array

A list of database statements to be executed to rotate the root user's credentials. A list of database statements to be executed to rotate the root user's credentials.

snowflake
array

A nested block containing configuration options for Snowflake connections. Connection parameters for the snowflake-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
privateKeyWoSecretRef
object

The private key associated with the Snowflake user. Note: This property is write-only and will not be read from the API. The private key configured for the admin user in Snowflake.

key
required
string
name
required
string
username
string
initProvider
object

THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.

allowedRoles
array

A list of roles that are allowed to use this connection. A list of roles that are allowed to use this connection.

backend
string
backendRef
object

Reference to a Mount in vault to populate backend.

name
required
string
namespace
string
policy
object

Policies for referencing.

resolve
string
backendSelector
object

Selector for a Mount in vault to populate backend.

namespace
string
policy
object

Policies for selection.

resolve
string
cassandra
array

A nested block containing configuration options for Cassandra connections. Connection parameters for the cassandra-database-plugin plugin.

hosts
array

The hosts to connect to. Cassandra hosts to connect to.

passwordSecretRef
object

The password to authenticate with. The password to use when authenticating with Cassandra.

key
required
string
name
required
string
pemBundleSecretRef
object

Concatenated PEM blocks configuring the certificate chain. Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
pemJsonSecretRef
object

A JSON structure configuring the certificate chain. Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
port
number
tls
boolean
username
string
couchbase
array

A nested block containing configuration options for Couchbase connections. Connection parameters for the couchbase-database-plugin plugin.

base64PemSecretRef
object

Required if tls is true. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded. Required if tls is true. Specifies the certificate authority of the Couchbase server, as a PEM certificate that has been base64 encoded.

key
required
string
name
required
string
hosts
array

The hosts to connect to. A set of Couchbase URIs to connect to. Must use couchbases:// scheme if tls is true.

passwordSecretRef
required
object

The password to authenticate with. Specifies the password corresponding to the given username.

key
required
string
name
required
string
tls
boolean
username
string
data
object
elasticsearch
array

A nested block containing configuration options for Elasticsearch connections. Connection parameters for the elasticsearch-database-plugin.

caCert
string
caPath
string
clientKey
string
insecure
boolean
passwordSecretRef
required
object

The password to authenticate with. The password to be used in the connection URL

key
required
string
name
required
string
url
string
username
string
hana
array

A nested block containing configuration options for SAP HanaDB connections. Connection parameters for the hana-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
influxdb
array

A nested block containing configuration options for InfluxDB connections. Connection parameters for the influxdb-database-plugin plugin.

host
string
passwordSecretRef
required
object

The password to authenticate with. Specifies the password corresponding to the given username.

key
required
string
name
required
string
pemBundleSecretRef
object

Concatenated PEM blocks configuring the certificate chain. Concatenated PEM blocks containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
pemJsonSecretRef
object

A JSON structure configuring the certificate chain. Specifies JSON containing a certificate and private key; a certificate, private key, and issuing CA certificate; or just a CA certificate.

key
required
string
name
required
string
port
number
tls
boolean
username
string
mongodb
array

A nested block containing configuration options for MongoDB connections. Connection parameters for the mongodb-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
mongodbatlas
array

A nested block containing configuration options for MongoDB Atlas connections. Connection parameters for the mongodbatlas-database-plugin plugin.

privateKeySecretRef
required
object

The Private Programmatic API Key used to connect with MongoDB Atlas API. The Private Programmatic API Key used to connect with MongoDB Atlas API.

key
required
string
name
required
string
projectId
string
publicKey
string
mssql
array

A nested block containing configuration options for MSSQL connections. Connection parameters for the mssql-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
mysql
array

A nested block containing configuration options for MySQL connections. Connection parameters for the mysql-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
mysqlAurora
array

A nested block containing configuration options for Aurora MySQL connections. Connection parameters for the mysql-aurora-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
mysqlLegacy
array

A nested block containing configuration options for legacy MySQL connections. Connection parameters for the mysql-legacy-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
mysqlRds
array

A nested block containing configuration options for RDS MySQL connections. Connection parameters for the mysql-rds-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
tlsCertificateKeySecretRef
object

x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined.

key
required
string
name
required
string
username
string
name
string
namespace
string
oracle
array

A nested block containing configuration options for Oracle connections. Connection parameters for the oracle-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
postgresql
array

A nested block containing configuration options for PostgreSQL connections. Connection parameters for the postgresql-database-plugin plugin.

authType
string
passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
privateKeySecretRef
object

The Private Programmatic API Key used to connect with MongoDB Atlas API. The secret key used for the x509 client certificate. Must be PEM encoded.

key
required
string
name
required
string
serviceAccountJsonSecretRef
object

JSON encoding of an IAM access key. Requires auth_type to be gcp_iam. A JSON encoded credential for use with IAM authorization

key
required
string
name
required
string
tlsCa
string
username
string
redis
array

A nested block containing configuration options for Redis connections. Connection parameters for the redis-database-plugin plugin.

caCert
string
host
string
passwordSecretRef
required
object

The password to authenticate with. Specifies the password corresponding to the given username.

key
required
string
name
required
string
port
number
tls
boolean
username
string
redisElasticache
array

A nested block containing configuration options for Redis ElastiCache connections. Connection parameters for the redis-elasticache-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The AWS secret key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.

key
required
string
name
required
string
region
string
url
string
usernameSecretRef
object

The username to authenticate with. The AWS access key id to use to talk to ElastiCache. If omitted the credentials chain provider is used instead.

key
required
string
name
required
string
redshift
array

Connection parameters for the redshift-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
username
string
rootRotationStatements
array

A list of database statements to be executed to rotate the root user's credentials. A list of database statements to be executed to rotate the root user's credentials.

snowflake
array

A nested block containing configuration options for Snowflake connections. Connection parameters for the snowflake-database-plugin plugin.

passwordSecretRef
object

The password to authenticate with. The root credential password used in the connection URL

key
required
string
name
required
string
privateKeyWoSecretRef
object

The private key associated with the Snowflake user. Note: This property is write-only and will not be read from the API. The private key configured for the admin user in Snowflake.

key
required
string
name
required
string
username
string
managementPolicies
array

THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md

providerConfigRef
object

ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.

kind
required
string
name
required
string
writeConnectionSecretToRef
object

WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.

name
required
string
status
object

SecretBackendConnectionStatus defines the observed state of SecretBackendConnection.

atProvider
object

(No description available)

allowedRoles
array

A list of roles that are allowed to use this connection. A list of roles that are allowed to use this connection.

backend
string
cassandra
array

A nested block containing configuration options for Cassandra connections. Connection parameters for the cassandra-database-plugin plugin.

hosts
array

The hosts to connect to. Cassandra hosts to connect to.

port
number
tls
boolean
username
string
couchbase
array

A nested block containing configuration options for Couchbase connections. Connection parameters for the couchbase-database-plugin plugin.

hosts
array

The hosts to connect to. A set of Couchbase URIs to connect to. Must use couchbases:// scheme if tls is true.

tls
boolean
username
string
data
object
elasticsearch
array

A nested block containing configuration options for Elasticsearch connections. Connection parameters for the elasticsearch-database-plugin.

caCert
string
caPath
string
clientKey
string
insecure
boolean
url
string
username
string
hana
array

A nested block containing configuration options for SAP HanaDB connections. Connection parameters for the hana-database-plugin plugin.

username
string
id
string
influxdb
array

A nested block containing configuration options for InfluxDB connections. Connection parameters for the influxdb-database-plugin plugin.

host
string
port
number
tls
boolean
username
string
mongodb
array

A nested block containing configuration options for MongoDB connections. Connection parameters for the mongodb-database-plugin plugin.

username
string
mongodbatlas
array

A nested block containing configuration options for MongoDB Atlas connections. Connection parameters for the mongodbatlas-database-plugin plugin.

projectId
string
publicKey
string
mssql
array

A nested block containing configuration options for MSSQL connections. Connection parameters for the mssql-database-plugin plugin.

username
string
mysql
array

A nested block containing configuration options for MySQL connections. Connection parameters for the mysql-database-plugin plugin.

authType
string
tlsCa
string
username
string
mysqlAurora
array

A nested block containing configuration options for Aurora MySQL connections. Connection parameters for the mysql-aurora-database-plugin plugin.

authType
string
tlsCa
string
username
string
mysqlLegacy
array

A nested block containing configuration options for legacy MySQL connections. Connection parameters for the mysql-legacy-database-plugin plugin.

authType
string
tlsCa
string
username
string
mysqlRds
array

A nested block containing configuration options for RDS MySQL connections. Connection parameters for the mysql-rds-database-plugin plugin.

authType
string
tlsCa
string
username
string
name
string
namespace
string
oracle
array

A nested block containing configuration options for Oracle connections. Connection parameters for the oracle-database-plugin plugin.

username
string
postgresql
array

A nested block containing configuration options for PostgreSQL connections. Connection parameters for the postgresql-database-plugin plugin.

authType
string
tlsCa
string
username
string
redis
array

A nested block containing configuration options for Redis connections. Connection parameters for the redis-database-plugin plugin.

caCert
string
host
string
port
number
tls
boolean
username
string
redisElasticache
array

A nested block containing configuration options for Redis ElastiCache connections. Connection parameters for the redis-elasticache-database-plugin plugin.

region
string
url
string
redshift
array

Connection parameters for the redshift-database-plugin plugin.

username
string
rootRotationStatements
array

A list of database statements to be executed to rotate the root user's credentials. A list of database statements to be executed to rotate the root user's credentials.

snowflake
array

A nested block containing configuration options for Snowflake connections. Connection parameters for the snowflake-database-plugin plugin.

username
string
conditions
array

Conditions of the resource.

lastTransitionTime
required
string
message
string
reason
required
string
status
required
string
type
required
string
Discover the building blocks for your internal cloud platform.
© 2026 Upbound, Inc.
Solutions
Learn
Company
Community
More