GitHub

External Secrets Operator integrates with GitHub to sync Kubernetes secrets with GitHub Actions secrets or Dependabot secrets.

Limitations

The GitHub provider is write-only, designed specifically to create and update GitHub Actions or Dependabot secrets using the GitHub REST API or the Dependabot secrets API, and does not support fetching the secret values.

Configuring GitHub provider

The GitHub API requires to install the ESO app to your GitHub organisation in order to use the GitHub provider features. The same App ID, installation ID, and private key authentication are used for both secret types. Grant the app read and write access to Secrets for Actions secrets, or Dependabot secrets for Dependabot secrets, at the target organization or repository scope.

Configuring the secret store

Verify that github provider is listed in the Kind=SecretStore. The properties appID, installationID, organization are required to register the provider. In addition, authentication has to be provided.

Set secretType to Actions or Dependabot. Actions is the default when the field is omitted, preserving compatibility with existing stores.

Optionally, to target Actions repository and environment secrets, the fields repository and environment need also to be added. For Dependabot repository secrets, add the repository field.

Secret type	Organization	Repository	Environment
Actions	Yes	Yes	Yes
Dependabot	Yes	Yes	No

Organization scope is used when repository is omitted. Combining secretType: Dependabot with environment is invalid.

For organization secrets, the optional orgSecretVisibility field controls the visibility of secrets created via PushSecret. Valid values are all or private. When unset, new secrets are created with visibility all and existing secrets keep whatever visibility they already have in GitHub. Updates also preserve existing selected-repository associations. Repository-scoped secrets do not use organization visibility or selected-repository associations.

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: github
spec:
  provider:
    # provider type: github
    github:
      secretType: Actions # Optional. Actions (default) or Dependabot
      appID: "**app ID goes here**"
      # url: Default "https://github.com/", for enterprise Github instances uncomment and add your domain like "https://github.domain.com/"
      # uploadURL: Default "https://github.com"
      auth:
        privateKey:
          name: github-app-private-key
          key: privateKey.pem
      installationID: "**installation ID goes here**"
      organization: "Github **organization name goes here**"
      #repository: "Optional. set this for repository/environment secrets"
      #environment: "Optional. set this for environment secrets"

NOTE: In case of a ClusterSecretStore, Be sure to provide namespace in auth.privateKey with the namespace where the secret resides.

Pushing to an external secret

To sync a Kubernetes secret with an external GitHub secret we need to create a PushSecret, this means a Kind=PushSecret is needed.

apiVersion: external-secrets.io/v1alpha1
kind: PushSecret
metadata:
  name: github-push-secret-example
spec:
  deletionPolicy: Delete
  refreshInterval: 10m0s # Refresh interval for which push secret will reconcile
  secretStoreRefs: # A list of secret stores to push secrets to
    - name: github # Must match SecretStore on the cluster
      kind: SecretStore
  selector:
    secret:
      name: EXTSERCRET # Remote Github actions secret that we want to sync with the kubernetes secret
  data:
    - match:
        secretKey: extsecret # Source Kubernetes secret key containing the secret
        remoteRef:
          remoteKey: EXTSECRET # Key of the kubernetes secret to push