Passbolt

External Secrets Operator integrates with Passbolt API to sync Passbolt to secrets held on the Kubernetes cluster.

Creating a Passbolt secret store

Be sure the passbolt provider is listed in the Kind=SecretStore and auth and host are set. The API requires a password and private key provided in a secret.

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: passbolt
spec:
  provider:
    passbolt:
      host: https://passbolt.passbolt.svc.cluster.local
      auth:
        passwordSecretRef:
          key: password
          name: passbolt-credentials
        privateKeySecretRef:
          key: privateKey
          name: passbolt-credentials

Custom CA certificate

If your Passbolt instance uses a certificate signed by a private or custom Certificate Authority, you can configure the CA bundle that ESO uses to validate the Passbolt server certificate. Either supply the PEM-encoded bundle inline via caBundle, or reference a Secret/ConfigMap via caProvider.

apiVersion: external-secrets.io/v1
kind: SecretStore
metadata:
  name: passbolt-with-custom-ca
spec:
  provider:
    passbolt:
      host: https://passbolt.example.com
      # Reference a ConfigMap or Secret containing the CA bundle that signed
      # the Passbolt server certificate.
      caProvider:
        type: ConfigMap
        name: passbolt-ca-bundle
        key: ca.crt
      auth:
        passwordSecretRef:
          key: password
          name: passbolt-credentials
        privateKeySecretRef:
          key: privateKey
          name: passbolt-credentials

If neither caBundle nor caProvider is set, ESO uses the system root certificates to validate the TLS connection.

Creating an external secret

To sync a Passbolt secret to a Kubernetes secret, a Kind=ExternalSecret is needed. By default the secret contains name, username, uri, password and description.

To only select a single property add the property key.

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: passbolt-example-simple
spec:
  refreshInterval: "1h0m0s"
  secretStoreRef:
    name: passbolt
    kind: SecretStore
  target:
    name: passbolt-example
  data:
  - secretKey: full_secret
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4 # Replace with ID of exising Passbolt secret
  - secretKey: password_only
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4 # Replace with ID of exising Passbolt secret
      property: password # You can limit the secret to only display one property

The above external secret will lead to the creation of a secret in the following form:

apiVersion: v1
kind: Secret
metadata:
  name: passbolt-example
data:
  full_secret: '{"name":"passbolt-secret","username":"some-username","password":"supersecretpassword","uri":"passbolt.com","description":"some description"}'
  password_only: supersecretpassword
type: Opaque

Finding a secret by name

Instead of retrieving secrets by ID you can also use dataFrom to search for secrets by name.

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: passbolt-example
spec:
  refreshInterval: "1h0m0s"
  secretStoreRef:
    name: passbolt
    kind: SecretStore
  target:
    name: passbolt-example
  dataFrom:
    - find:
        name:
          regexp: ".*"

Custom fields

Passbolt resources can carry arbitrary custom fields beyond the standard name, username, password, uri, and description properties. ESO surfaces each custom field through the custom_fields.<name> property syntax, where <name> is the field's display name as configured in Passbolt.

apiVersion: external-secrets.io/v1
kind: ExternalSecret
metadata:
  name: passbolt-custom-fields-example
spec:
  refreshInterval: "1h0m0s"
  secretStoreRef:
    name: passbolt
    kind: SecretStore
  target:
    name: passbolt-custom-fields
  data:
    # Fetch a single custom field by its display name (metadata_key).
    # The property value is the literal prefix "custom_fields." followed by
    # the name of the field as configured in Passbolt.
  - secretKey: api_token
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4 # Replace with the ID of an existing Passbolt secret
      property: custom_fields.api-token
  - secretKey: deploy_key
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4
      property: custom_fields.deploy-key
    # Omitting property returns the full secret as JSON, with custom_fields
    # included as a nested object keyed by the field display name.
  - secretKey: full_secret
    remoteRef:
      key: e22487a8-feb8-4591-95aa-14b193930cb4

The above external secret produces a Kubernetes Secret in the following form:

apiVersion: v1
kind: Secret
metadata:
  name: passbolt-custom-fields
data:
  api_token: my-api-token-value
  deploy_key: ssh-ed25519-AAAA...
  full_secret: '{"name":"my-service","username":"deploy","password":"supersecretpassword","uri":"https://example.com","description":"","custom_fields":{"api-token":"my-api-token-value","deploy-key":"ssh-ed25519-AAAA..."}}'
type: Opaque

When no property is specified, the full secret is returned as a JSON object. The custom_fields key is included in that object whenever the resource has at least one named custom field.

Passbolt stores each half of a custom field on whichever side the field's configuration calls for: a name is either cleartext metadata or encrypted alongside the secret, and so is a value. ESO decrypts both sides before reading them, so a field is addressable by its display name either way.