resource_credentials

Creates, updates, deletes, gets or lists a resource_credentials resource.

Overview

Name	resource_credentials
Type	Resource
Id	ovh.okms.resource_credentials

Fields

The following fields are returned by SELECT queries:

get

successful operation

Name	Datatype	Description
id	string (uuid)	Unique identifier of the credential
name	string	Name of the credential
certificate_pem	string	Certificate PEM of the credential (wire: certificatePEM)
certificate_type	string	Type of the certificate (ECDSA or RSA) (ECDSA, RSA) (wire: certificateType)
created_at	string (date-time)	Creation time of the credential (wire: createdAt)
description	string	Description of the credential
expired_at	string (date-time)	Expiration time of the credential (wire: expiredAt)
from_csr	boolean	Is the credential generated from CSR (wire: fromCSR)
identity_urns	array	List of identity URNs associated with the credential (wire: identityURNs)
status	string	Status of the credential (CREATING, DELETING, ERROR, EXPIRED, READY)

list

An OKMS service access credential

Name	Datatype	Description
id	string (uuid)	Unique identifier of the credential
name	string	Name of the credential
certificate_pem	string	Certificate PEM of the credential (wire: certificatePEM)
certificate_type	string	Type of the certificate (ECDSA or RSA) (ECDSA, RSA) (wire: certificateType)
created_at	string (date-time)	Creation time of the credential (wire: createdAt)
description	string	Description of the credential
expired_at	string (date-time)	Expiration time of the credential (wire: expiredAt)
from_csr	boolean	Is the credential generated from CSR (wire: fromCSR)
identity_urns	array	List of identity URNs associated with the credential (wire: identityURNs)
status	string	Status of the credential (CREATING, DELETING, ERROR, EXPIRED, READY)

Methods

The following methods are available for this resource:

Name	Accessible by	Required Params	Optional Params	Description
get	select	credential_id, okms_id		Returns the metadata and certificate of an access credential. The private key is returned only when the credential is created and can never be retrieved afterward.
list	select	okms_id	x_pagination_cursor, x_pagination_size	Returns the access credentials of the service, with their identity, status and expiry. Private keys are never returned.
create	insert	okms_id, identity_urns, name		Issues a certificate-based access credential bound to the given identity URNs.<br /><br />With a CSR, only the signed certificate is produced. Without one, a key pair is generated and the private key is returned in this response only. It can never be retrieved afterward.
delete	delete	credential_id, okms_id		Revokes the credential and removes it. It can no longer be used to authenticate to the KMS.

Parameters

Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.

Name	Datatype	Description
api_host	string	The OVHcloud API host. Selected by OVH_ENDPOINT (ovh-eu, ovh-ca or ovh-us; default ovh-eu). (default: api.eu.ovhcloud.com, x-stackQL-envVarSelector: {"envVar":"OVH_ENDPOINT","default":"ovh-eu","values":{"ovh-eu":"api.eu.ovhcloud.com","ovh-ca":"api.ca.ovhcloud.com","ovh-us":"api.us.ovhcloud.com"}})
credential_id	string (uuid)	Credential ID (wire: credentialId)
okms_id	string (uuid)	Okms ID (wire: okmsId)
x_pagination_cursor	string	Pagination cursor (wire: X-Pagination-Cursor)
x_pagination_size	integer	Pagination size (wire: X-Pagination-Size)

SELECT examples

get

Returns the metadata and certificate of an access credential. The private key is returned only when the credential is created and can never be retrieved afterward.

SELECT
id,
name,
certificate_pem,
certificate_type,
created_at,
description,
expired_at,
from_csr,
identity_urns,
status
FROM ovh.okms.resource_credentials
WHERE credential_id = '{{ credential_id }}' -- required
AND okms_id = '{{ okms_id }}' -- required
;

list

Returns the access credentials of the service, with their identity, status and expiry. Private keys are never returned.

SELECT
id,
name,
certificate_pem,
certificate_type,
created_at,
description,
expired_at,
from_csr,
identity_urns,
status
FROM ovh.okms.resource_credentials
WHERE okms_id = '{{ okms_id }}' -- required
AND x_pagination_cursor = '{{ x_pagination_cursor }}'
AND x_pagination_size = '{{ x_pagination_size }}'
;

INSERT examples

create

Issues a certificate-based access credential bound to the given identity URNs.<br /><br />With a CSR, only the signed certificate is produced. Without one, a key pair is generated and the private key is returned in this response only. It can never be retrieved afterward.

INSERT INTO ovh.okms.resource_credentials (
certificate_type,
csr,
description,
identity_urns,
name,
validity,
okms_id
)
SELECT 
'{{ certificate_type }}',
'{{ csr }}',
'{{ description }}',
'{{ identity_urns }}' /* required */,
'{{ name }}' /* required */,
{{ validity }},
'{{ okms_id }}'
RETURNING
id,
name,
certificate_type,
created_at,
description,
expired_at,
from_csr,
identity_urns,
private_key_pem,
status
;

Manifest

# Description fields are for documentation purposes
- name: resource_credentials
props:
  - name: okms_id
    value: "{{ okms_id }}"
    description: Required parameter for the resource_credentials resource.
  - name: certificate_type
    value: "{{ certificate_type }}"
    description: |
      Type of the certificate (ECDSA or RSA, incompatible with CSR)
    valid_values: ['ECDSA', 'RSA']
  - name: csr
    value: "{{ csr }}"
    description: |
      Valid Certificate Signing Request
  - name: description
    value: "{{ description }}"
    description: |
      Description of the credential. At most 200.
  - name: identity_urns
    value:
      - "{{ identity_urns }}"
    description: |
      List of identity URNs associated with the credential. At most 25.
  - name: name
    value: "{{ name }}"
    description: |
      Name of the credential. At most 50.
  - name: validity
    value: {{ validity }}
    description: |
      Validity in days (default 365, max 365)

DELETE examples

delete

Revokes the credential and removes it. It can no longer be used to authenticate to the KMS.

DELETE FROM ovh.okms.resource_credentials
WHERE credential_id = '{{ credential_id }}' --required
AND okms_id = '{{ okms_id }}' --required
;