API specification

Packages:

external-secrets.io/v1beta1

Package v1beta1 contains resources for external-secrets

Resource Types:

    AWSAuth

    (Appears on: AWSProvider)

    AWSAuth tells the controller how to do authentication with aws. Only one of secretRef or jwt can be specified. if none is specified the controller will load credentials using the aws sdk defaults.

    Field Description
    secretRef
    AWSAuthSecretRef     		(Optional)
    jwt
    AWSJWTAuth     		(Optional)

    AWSAuthSecretRef

    (Appears on: AWSAuth)

    AWSAuthSecretRef holds secret references for AWS credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.

    Field Description
    accessKeyIDSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The AccessKeyID is used for authentication
    secretAccessKeySecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The SecretAccessKey is used for authentication

    AWSJWTAuth

    (Appears on: AWSAuth)

    Authenticate against AWS using service account tokens.

    Field Description
    serviceAccountRef
    github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector

    AWSProvider

    (Appears on: SecretStoreProvider)

    AWSProvider configures a store to sync secrets with AWS.

    Field Description
    service
    AWSServiceType

    Service defines which service should be used to fetch the secrets
    auth
    AWSAuth     		(Optional)

    Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials
    role
    string     		(Optional)

    Role is a Role ARN which the SecretManager provider will assume
    region
    string

    AWS Region to be used for the provider

    AWSServiceType (string alias)

    (Appears on: AWSProvider)

    AWSServiceType is a enum that defines the service/API that is used to fetch the secrets.

    Value Description

    "ParameterStore"

    AWSServiceParameterStore is the AWS SystemsManager ParameterStore. see: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html

    "SecretsManager"

    AWSServiceSecretsManager is the AWS SecretsManager. see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

    AkeylessAuth

    (Appears on: AkeylessProvider)

    Field Description
    secretRef
    AkeylessAuthSecretRef     		(Optional)

    Reference to a Secret that contains the details to authenticate with Akeyless.
    kubernetesAuth
    AkeylessKubernetesAuth     		(Optional)

    Kubernetes authenticates with Akeyless by passing the ServiceAccount token stored in the named Secret resource.

    AkeylessAuthSecretRef

    (Appears on: AkeylessAuth)

    AkeylessAuthSecretRef AKEYLESS_ACCESS_TYPE_PARAM: AZURE_OBJ_ID OR GCP_AUDIENCE OR ACCESS_KEY OR KUB_CONFIG_NAME.

    Field Description
    accessID
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The SecretAccessID is used for authentication
    accessType
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
    accessTypeParam
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    AkeylessKubernetesAuth

    (Appears on: AkeylessAuth)

    Authenticate with Kubernetes ServiceAccount token stored.

    Field Description
    accessID
    string

    the Akeyless Kubernetes auth-method access-id
    k8sConfName
    string

    Kubernetes-auth configuration name in Akeyless-Gateway
    serviceAccountRef
    github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector     		(Optional)

    Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Akeyless. If the service account selector is not supplied, the secretRef will be used instead.
    secretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    Optional secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Akeyless. If a name is specified without a key, token is the default. If one is not specified, the one bound to the controller will be used.

    AkeylessProvider

    (Appears on: SecretStoreProvider)

    AkeylessProvider Configures an store to sync secrets using Akeyless KV.

    Field Description
    akeylessGWApiURL
    string

    Akeyless GW API Url from which the secrets to be fetched from.
    authSecretRef
    AkeylessAuth

    Auth configures how the operator authenticates with Akeyless.

    AlibabaAuth

    (Appears on: AlibabaProvider)

    AlibabaAuth contains a secretRef for credentials.

    Field Description
    secretRef
    AlibabaAuthSecretRef

    AlibabaAuthSecretRef

    (Appears on: AlibabaAuth)

    AlibabaAuthSecretRef holds secret references for Alibaba credentials.

    Field Description
    accessKeyIDSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The AccessKeyID is used for authentication
    accessKeySecretSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The AccessKeySecret is used for authentication

    AlibabaProvider

    (Appears on: SecretStoreProvider)

    AlibabaProvider configures a store to sync secrets using the Alibaba Secret Manager provider.

    Field Description
    auth
    AlibabaAuth
    endpoint
    string     		(Optional)
    regionID
    string

    Alibaba Region to be used for the provider

    AzureAuthType (string alias)

    (Appears on: AzureKVProvider)

    AuthType describes how to authenticate to the Azure Keyvault Only one of the following auth types may be specified. If none of the following auth type is specified, the default one is ServicePrincipal.

    Value Description

    "ManagedIdentity"

    Using Managed Identity to authenticate. Used with aad-pod-identity installed in the cluster.

    "ServicePrincipal"

    Using service principal to authenticate, which needs a tenantId, a clientId and a clientSecret.

    "WorkloadIdentity"

    Using Workload Identity service accounts to authenticate.

    AzureEnvironmentType (string alias)

    (Appears on: AzureKVProvider)

    AzureEnvironmentType specifies the Azure cloud environment endpoints to use for connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint. The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud

    Value Description

    "ChinaCloud"

    "GermanCloud"

    "PublicCloud"

    "USGovernmentCloud"

    AzureKVAuth

    (Appears on: AzureKVProvider)

    Configuration used to authenticate with Azure.

    Field Description
    clientId
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    The Azure clientId of the service principle used for authentication.
    clientSecret
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    The Azure ClientSecret of the service principle used for authentication.

    AzureKVProvider

    (Appears on: SecretStoreProvider)

    Configures an store to sync secrets using Azure KV.

    Field Description
    authType
    AzureAuthType     		(Optional)

    Auth type defines how to authenticate to the keyvault service. Valid values are: - “ServicePrincipal” (default): Using a service principal (tenantId, clientId, clientSecret) - “ManagedIdentity”: Using Managed Identity assigned to the pod (see aad-pod-identity)
    vaultUrl
    string

    Vault Url from which the secrets to be fetched from.
    tenantId
    string     		(Optional)

    TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type.
    environmentType
    AzureEnvironmentType

    EnvironmentType specifies the Azure cloud environment endpoints to use for connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint. The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
    authSecretRef
    AzureKVAuth     		(Optional)

    Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type.
    serviceAccountRef
    github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector     		(Optional)

    ServiceAccountRef specified the service account that should be used when authenticating with WorkloadIdentity.
    identityId
    string     		(Optional)

    If multiple Managed Identity is assigned to the pod, you can select the one to be used

    CAProvider

    (Appears on: KubernetesServer, VaultProvider)

    Used to provide custom certificate authority (CA) certificates for a secret store. The CAProvider points to a Secret or ConfigMap resource that contains a PEM-encoded certificate.

    Field Description
    type
    CAProviderType

    The type of provider to use such as “Secret”, or “ConfigMap”.
    name
    string

    The name of the object located at the provider type.
    key
    string

    The key where the CA certificate can be found in the Secret or ConfigMap.
    namespace
    string     		(Optional)

    The namespace the Provider type is in. Can only be defined when used in a ClusterSecretStore.

    CAProviderType (string alias)

    (Appears on: CAProvider)

    Value Description

    "ConfigMap"

    "Secret"

    CertAuth

    (Appears on: KubernetesAuth)

    Field Description
    clientCert
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
    clientKey
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    ClusterExternalSecret

    ClusterExternalSecret is the Schema for the clusterexternalsecrets API.

    Field Description
    metadata
    Kubernetes meta/v1.ObjectMeta     		Refer to the Kubernetes API documentation for the fields of the metadata field.
    spec
    ClusterExternalSecretSpec

    externalSecretSpec
    ExternalSecretSpec

    The spec for the ExternalSecrets to be created
    externalSecretName
    string     		(Optional)

    The name of the external secrets to be created defaults to the name of the ClusterExternalSecret
    namespaceSelector
    Kubernetes meta/v1.LabelSelector

    The labels to select by to find the Namespaces to create the ExternalSecrets in.
    refreshTime
    Kubernetes meta/v1.Duration

    The time in which the controller should reconcile it’s objects and recheck namespaces for labels.
    status
    ClusterExternalSecretStatus

    ClusterExternalSecretConditionType (string alias)

    (Appears on: ClusterExternalSecretStatusCondition)

    Value Description

    "NotReady"

    "PartiallyReady"

    "Ready"

    ClusterExternalSecretNamespaceFailure

    (Appears on: ClusterExternalSecretStatus)

    ClusterExternalSecretNamespaceFailure represents a failed namespace deployment and it’s reason.

    Field Description
    namespace
    string

    Namespace is the namespace that failed when trying to apply an ExternalSecret
    reason
    string     		(Optional)

    Reason is why the ExternalSecret failed to apply to the namespace

    ClusterExternalSecretSpec

    (Appears on: ClusterExternalSecret)

    ClusterExternalSecretSpec defines the desired state of ClusterExternalSecret.

    Field Description
    externalSecretSpec
    ExternalSecretSpec

    The spec for the ExternalSecrets to be created
    externalSecretName
    string     		(Optional)

    The name of the external secrets to be created defaults to the name of the ClusterExternalSecret
    namespaceSelector
    Kubernetes meta/v1.LabelSelector

    The labels to select by to find the Namespaces to create the ExternalSecrets in.
    refreshTime
    Kubernetes meta/v1.Duration

    The time in which the controller should reconcile it’s objects and recheck namespaces for labels.

    ClusterExternalSecretStatus

    (Appears on: ClusterExternalSecret)

    ClusterExternalSecretStatus defines the observed state of ClusterExternalSecret.

    Field Description
    failedNamespaces
    []ClusterExternalSecretNamespaceFailure     		(Optional)

    Failed namespaces are the namespaces that failed to apply an ExternalSecret
    provisionedNamespaces
    []string     		(Optional)

    ProvisionedNamespaces are the namespaces where the ClusterExternalSecret has secrets
    conditions
    []ClusterExternalSecretStatusCondition     		(Optional)

    ClusterExternalSecretStatusCondition

    (Appears on: ClusterExternalSecretStatus)

    Field Description
    type
    ClusterExternalSecretConditionType
    status
    Kubernetes core/v1.ConditionStatus
    message
    string     		(Optional)

    ClusterSecretStore

    ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

    Field Description
    metadata
    Kubernetes meta/v1.ObjectMeta     		Refer to the Kubernetes API documentation for the fields of the metadata field.
    spec
    SecretStoreSpec

    controller
    string     		(Optional)

    Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
    provider
    SecretStoreProvider

    Used to configure the provider. Only one provider may be set
    retrySettings
    SecretStoreRetrySettings     		(Optional)

    Used to configure http retries if failed
    refreshInterval
    int     		(Optional)

    Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.
    status
    SecretStoreStatus

    DopplerAuth

    (Appears on: DopplerProvider)

    Field Description
    secretRef
    DopplerAuthSecretRef

    DopplerAuthSecretRef

    (Appears on: DopplerAuth)

    Field Description
    dopplerToken
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The DopplerToken is used for authentication. See https://docs.doppler.com/reference/api#authentication for auth token types. The Key attribute defaults to dopplerToken if not specified.

    DopplerProvider

    (Appears on: SecretStoreProvider)

    DopplerProvider configures a store to sync secrets using the Doppler provider. Project and Config are required if not using a Service Token.

    Field Description
    auth
    DopplerAuth

    Auth configures how the Operator authenticates with the Doppler API
    project
    string     		(Optional)

    Doppler project (required if not using a Service Token)
    config
    string     		(Optional)

    Doppler config (required if not using a Service Token)
    nameTransformer
    string     		(Optional)

    Environment variable compatible name transforms that change secret names to a different format
    format
    string     		(Optional)

    Format enables the downloading of secrets as a file (string)

    ExternalSecret

    ExternalSecret is the Schema for the external-secrets API.

    Field Description
    metadata
    Kubernetes meta/v1.ObjectMeta     		Refer to the Kubernetes API documentation for the fields of the metadata field.
    spec
    ExternalSecretSpec

    secretStoreRef
    SecretStoreRef
    target
    ExternalSecretTarget     		(Optional)
    refreshInterval
    Kubernetes meta/v1.Duration

    RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.
    data
    []ExternalSecretData     		(Optional)

    Data defines the connection between the Kubernetes Secret keys and the Provider data
    dataFrom
    []ExternalSecretDataFromRemoteRef     		(Optional)

    DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order
    status
    ExternalSecretStatus

    ExternalSecretConditionType (string alias)

    (Appears on: ExternalSecretStatusCondition)

    Value Description

    "Deleted"

    "Ready"

    ExternalSecretConversionStrategy (string alias)

    (Appears on: ExternalSecretDataRemoteRef, ExternalSecretFind)

    Value Description

    "Default"

    "Unicode"

    ExternalSecretCreationPolicy (string alias)

    (Appears on: ExternalSecretTarget)

    ExternalSecretCreationPolicy defines rules on how to create the resulting Secret.

    Value Description

    "Merge"

    Merge does not create the Secret, but merges the data fields to the Secret.

    "None"

    None does not create a Secret (future use with injector).

    "Orphan"

    Orphan creates the Secret and does not set the ownerReference. I.e. it will be orphaned after the deletion of the ExternalSecret.

    "Owner"

    Owner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource.

    ExternalSecretData

    (Appears on: ExternalSecretSpec)

    ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.) and the Provider data.

    Field Description
    secretKey
    string
    remoteRef
    ExternalSecretDataRemoteRef

    ExternalSecretDataFromRemoteRef

    (Appears on: ExternalSecretSpec)

    Field Description
    extract
    ExternalSecretDataRemoteRef     		(Optional)

    Used to extract multiple key/value pairs from one secret
    find
    ExternalSecretFind     		(Optional)

    Used to find secrets based on tags or regular expressions
    rewrite
    []ExternalSecretRewrite     		(Optional)

    Used to rewrite secret Keys after getting them from the secret Provider Multiple Rewrite operations can be provided. They are applied in a layered order (first to last)

    ExternalSecretDataRemoteRef

    (Appears on: ExternalSecretData, ExternalSecretDataFromRemoteRef)

    ExternalSecretDataRemoteRef defines Provider data location.

    Field Description
    key
    string

    Key is the key used in the Provider, mandatory
    metadataPolicy
    ExternalSecretMetadataPolicy     		(Optional)

    Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None
    property
    string     		(Optional)

    Used to select a specific property of the Provider value (if a map), if supported
    version
    string     		(Optional)

    Used to select a specific version of the Provider value, if supported
    conversionStrategy
    ExternalSecretConversionStrategy     		(Optional)

    Used to define a conversion Strategy
    decodingStrategy
    ExternalSecretDecodingStrategy     		(Optional)

    Used to define a decoding Strategy

    ExternalSecretDecodingStrategy (string alias)

    (Appears on: ExternalSecretDataRemoteRef, ExternalSecretFind)

    Value Description

    "Auto"

    "Base64"

    "Base64URL"

    "None"

    ExternalSecretDeletionPolicy (string alias)

    (Appears on: ExternalSecretTarget)

    ExternalSecretDeletionPolicy defines rules on how to delete the resulting Secret.

    Value Description

    "Delete"

    Delete deletes the secret if all provider secrets are deleted. If a secret gets deleted on the provider side and is not accessible anymore this is not considered an error and the ExternalSecret does not go into SecretSyncedError status.

    "Merge"

    Merge removes keys in the secret, but not the secret itself. If a secret gets deleted on the provider side and is not accessible anymore this is not considered an error and the ExternalSecret does not go into SecretSyncedError status.

    "Retain"

    Retain will retain the secret if all provider secrets have been deleted. If a provider secret does not exist the ExternalSecret gets into the SecretSyncedError status.

    ExternalSecretFind

    (Appears on: ExternalSecretDataFromRemoteRef)

    Field Description
    path
    string     		(Optional)

    A root path to start the find operations.
    name
    FindName     		(Optional)

    Finds secrets based on the name.
    tags
    map[string]string     		(Optional)

    Find secrets based on tags.
    conversionStrategy
    ExternalSecretConversionStrategy     		(Optional)

    Used to define a conversion Strategy
    decodingStrategy
    ExternalSecretDecodingStrategy     		(Optional)

    Used to define a decoding Strategy

    ExternalSecretMetadataPolicy (string alias)

    (Appears on: ExternalSecretDataRemoteRef)

    Value Description

    "Fetch"

    "None"

    ExternalSecretRewrite

    (Appears on: ExternalSecretDataFromRemoteRef)

    Field Description
    regexp
    ExternalSecretRewriteRegexp     		(Optional)

    Used to rewrite with regular expressions. The resulting key will be the output of a regexp.ReplaceAll operation.

    ExternalSecretRewriteRegexp

    (Appears on: ExternalSecretRewrite)

    Field Description
    source
    string

    Used to define the regular expression of a re.Compiler.
    target
    string

    Used to define the target pattern of a ReplaceAll operation.

    ExternalSecretSpec

    (Appears on: ClusterExternalSecretSpec, ExternalSecret)

    ExternalSecretSpec defines the desired state of ExternalSecret.

    Field Description
    secretStoreRef
    SecretStoreRef
    target
    ExternalSecretTarget     		(Optional)
    refreshInterval
    Kubernetes meta/v1.Duration

    RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h.
    data
    []ExternalSecretData     		(Optional)

    Data defines the connection between the Kubernetes Secret keys and the Provider data
    dataFrom
    []ExternalSecretDataFromRemoteRef     		(Optional)

    DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order

    ExternalSecretStatus

    (Appears on: ExternalSecret)

    Field Description
    refreshTime
    Kubernetes meta/v1.Time

    refreshTime is the time and date the external secret was fetched and the target secret updated
    syncedResourceVersion
    string

    SyncedResourceVersion keeps track of the last synced version
    conditions
    []ExternalSecretStatusCondition     		(Optional)

    ExternalSecretStatusCondition

    (Appears on: ExternalSecretStatus)

    Field Description
    type
    ExternalSecretConditionType
    status
    Kubernetes core/v1.ConditionStatus
    reason
    string     		(Optional)
    message
    string     		(Optional)
    lastTransitionTime
    Kubernetes meta/v1.Time     		(Optional)

    ExternalSecretTarget

    (Appears on: ExternalSecretSpec)

    ExternalSecretTarget defines the Kubernetes Secret to be created There can be only one target per ExternalSecret.

    Field Description
    name
    string     		(Optional)

    Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource
    creationPolicy
    ExternalSecretCreationPolicy     		(Optional)

    CreationPolicy defines rules on how to create the resulting Secret Defaults to ‘Owner’
    deletionPolicy
    ExternalSecretDeletionPolicy     		(Optional)

    DeletionPolicy defines rules on how to delete the resulting Secret Defaults to ‘Retain’
    template
    ExternalSecretTemplate     		(Optional)

    Template defines a blueprint for the created Secret resource.
    immutable
    bool     		(Optional)

    Immutable defines if the final secret will be immutable

    ExternalSecretTemplate

    (Appears on: ExternalSecretTarget)

    ExternalSecretTemplate defines a blueprint for the created Secret resource. we can not use native corev1.Secret, it will have empty ObjectMeta values: https://github.com/kubernetes-sigs/controller-tools/issues/448

    Field Description
    type
    Kubernetes core/v1.SecretType     		(Optional)
    engineVersion
    TemplateEngineVersion
    metadata
    ExternalSecretTemplateMetadata     		(Optional)
    data
    map[string]string     		(Optional)
    templateFrom
    []TemplateFrom     		(Optional)

    ExternalSecretTemplateMetadata

    (Appears on: ExternalSecretTemplate)

    ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.

    Field Description
    annotations
    map[string]string     		(Optional)
    labels
    map[string]string     		(Optional)

    ExternalSecretValidator

    FakeProvider

    (Appears on: SecretStoreProvider)

    FakeProvider configures a fake provider that returns static values.

    Field Description
    data
    []FakeProviderData

    FakeProviderData

    (Appears on: FakeProvider)

    Field Description
    key
    string
    value
    string
    valueMap
    map[string]string
    version
    string

    FindName

    (Appears on: ExternalSecretFind)

    Field Description
    regexp
    string     		(Optional)

    Finds secrets base

    GCPSMAuth

    (Appears on: GCPSMProvider)

    Field Description
    secretRef
    GCPSMAuthSecretRef     		(Optional)
    workloadIdentity
    GCPWorkloadIdentity     		(Optional)

    GCPSMAuthSecretRef

    (Appears on: GCPSMAuth)

    Field Description
    secretAccessKeySecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    The SecretAccessKey is used for authentication

    GCPSMProvider

    (Appears on: SecretStoreProvider)

    GCPSMProvider Configures a store to sync secrets using the GCP Secret Manager provider.

    Field Description
    auth
    GCPSMAuth     		(Optional)

    Auth defines the information necessary to authenticate against GCP
    projectID
    string

    ProjectID project where secret is located

    GCPWorkloadIdentity

    (Appears on: GCPSMAuth)

    Field Description
    serviceAccountRef
    github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
    clusterLocation
    string
    clusterName
    string
    clusterProjectID
    string

    GenericStore

    GenericStore is a common interface for interacting with ClusterSecretStore or a namespaced SecretStore.

    GenericStoreValidator

    GitlabAuth

    (Appears on: GitlabProvider)

    Field Description
    SecretRef
    GitlabSecretRef

    GitlabProvider

    (Appears on: SecretStoreProvider)

    Configures a store to sync secrets with a GitLab instance.

    Field Description
    url
    string

    URL configures the GitLab instance URL. Defaults to https://gitlab.com/.
    auth
    GitlabAuth

    Auth configures how secret-manager authenticates with a GitLab instance.
    projectID
    string

    ProjectID specifies a project where secrets are located.
    environment
    string

    Environment environment_scope of gitlab CI/CD variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment on how to create environments)

    GitlabSecretRef

    (Appears on: GitlabAuth)

    Field Description
    accessToken
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    AccessToken is used for authentication.

    IBMAuth

    (Appears on: IBMProvider)

    Field Description
    secretRef
    IBMAuthSecretRef
    containerAuth
    IBMAuthContainerAuth

    IBMAuthContainerAuth

    (Appears on: IBMAuth)

    IBM Container-based auth with IAM Trusted Profile.

    Field Description
    profile
    string

    the IBM Trusted Profile
    tokenLocation
    string

    Location the token is mounted on the pod
    iamEndpoint
    string

    IBMAuthSecretRef

    (Appears on: IBMAuth)

    Field Description
    secretApiKeySecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The SecretAccessKey is used for authentication

    IBMProvider

    (Appears on: SecretStoreProvider)

    Configures an store to sync secrets using a IBM Cloud Secrets Manager backend.

    Field Description
    auth
    IBMAuth

    Auth configures how secret-manager authenticates with the IBM secrets manager.
    serviceUrl
    string

    ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance

    KubernetesAuth

    (Appears on: KubernetesProvider)

    Field Description
    cert
    CertAuth     		(Optional)

    has both clientCert and clientKey as secretKeySelector
    token
    TokenAuth     		(Optional)

    use static token to authenticate with
    serviceAccount
    github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector     		(Optional)

    points to a service account that should be used for authentication

    KubernetesProvider

    (Appears on: SecretStoreProvider)

    Configures a store to sync secrets with a Kubernetes instance.

    Field Description
    server
    KubernetesServer

    configures the Kubernetes server Address.
    auth
    KubernetesAuth

    Auth configures how secret-manager authenticates with a Kubernetes instance.
    remoteNamespace
    string     		(Optional)

    Remote namespace to fetch the secrets from

    KubernetesServer

    (Appears on: KubernetesProvider)

    Field Description
    url
    string     		(Optional)

    configures the Kubernetes server Address.
    caBundle
    []byte     		(Optional)

    CABundle is a base64-encoded CA certificate
    caProvider
    CAProvider     		(Optional)

    see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider

    NoSecretError

    NoSecretError shall be returned when a GetSecret can not find the desired secret. This is used for deletionPolicy.

    OnePasswordAuth

    (Appears on: OnePasswordProvider)

    OnePasswordAuth contains a secretRef for credentials.

    Field Description
    secretRef
    OnePasswordAuthSecretRef

    OnePasswordAuthSecretRef

    (Appears on: OnePasswordAuth)

    OnePasswordAuthSecretRef holds secret references for 1Password credentials.

    Field Description
    connectTokenSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    The ConnectToken is used for authentication to a 1Password Connect Server.

    OnePasswordProvider

    (Appears on: SecretStoreProvider)

    OnePasswordProvider configures a store to sync secrets using the 1Password Secret Manager provider.

    Field Description
    auth
    OnePasswordAuth

    Auth defines the information necessary to authenticate against OnePassword Connect Server
    connectHost
    string

    ConnectHost defines the OnePassword Connect Server to connect to
    vaults
    map[string]int

    Vaults defines which OnePassword vaults to search in which order

    OracleAuth

    (Appears on: OracleProvider)

    Field Description
    tenancy
    string

    Tenancy is the tenancy OCID where user is located.
    user
    string

    User is an access OCID specific to the account.
    secretRef
    OracleSecretRef

    SecretRef to pass through sensitive information.

    OracleProvider

    (Appears on: SecretStoreProvider)

    Configures an store to sync secrets using a Oracle Vault backend.

    Field Description
    region
    string

    Region is the region where vault is located.
    vault
    string

    Vault is the vault’s OCID of the specific vault where secret is located.
    auth
    OracleAuth     		(Optional)

    Auth configures how secret-manager authenticates with the Oracle Vault. If empty, use the instance principal, otherwise the user credentials specified in Auth.

    OracleSecretRef

    (Appears on: OracleAuth)

    Field Description
    privatekey
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    PrivateKey is the user’s API Signing Key in PEM format, used for authentication.
    fingerprint
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    Fingerprint is the fingerprint of the API private key.

    Provider

    Provider is a common interface for interacting with secret backends.

    SecretStore

    SecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef fields.

    Field Description
    metadata
    Kubernetes meta/v1.ObjectMeta     		Refer to the Kubernetes API documentation for the fields of the metadata field.
    spec
    SecretStoreSpec

    controller
    string     		(Optional)

    Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
    provider
    SecretStoreProvider

    Used to configure the provider. Only one provider may be set
    retrySettings
    SecretStoreRetrySettings     		(Optional)

    Used to configure http retries if failed
    refreshInterval
    int     		(Optional)

    Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.
    status
    SecretStoreStatus

    SecretStoreConditionType (string alias)

    (Appears on: SecretStoreStatusCondition)

    Value Description

    "Ready"

    SecretStoreProvider

    (Appears on: SecretStoreSpec)

    SecretStoreProvider contains the provider-specific configuration.

    Field Description
    aws
    AWSProvider     		(Optional)

    AWS configures this store to sync secrets using AWS Secret Manager provider
    azurekv
    AzureKVProvider     		(Optional)

    AzureKV configures this store to sync secrets using Azure Key Vault provider
    akeyless
    AkeylessProvider     		(Optional)

    Akeyless configures this store to sync secrets using Akeyless Vault provider
    vault
    VaultProvider     		(Optional)

    Vault configures this store to sync secrets using Hashi provider
    gcpsm
    GCPSMProvider     		(Optional)

    GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
    oracle
    OracleProvider     		(Optional)

    Oracle configures this store to sync secrets using Oracle Vault provider
    ibm
    IBMProvider     		(Optional)

    IBM configures this store to sync secrets using IBM Cloud provider
    yandexcertificatemanager
    YandexCertificateManagerProvider     		(Optional)

    YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider
    yandexlockbox
    YandexLockboxProvider     		(Optional)

    YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
    gitlab
    GitlabProvider     		(Optional)

    Gitlab configures this store to sync secrets using Gitlab Variables provider
    alibaba
    AlibabaProvider     		(Optional)

    Alibaba configures this store to sync secrets using Alibaba Cloud provider
    onepassword
    OnePasswordProvider     		(Optional)

    OnePassword configures this store to sync secrets using the 1Password Cloud provider
    webhook
    WebhookProvider     		(Optional)

    Webhook configures this store to sync secrets using a generic templated webhook
    kubernetes
    KubernetesProvider     		(Optional)

    Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
    fake
    FakeProvider     		(Optional)

    Fake configures a store with static key/value pairs
    senhasegura
    SenhaseguraProvider     		(Optional)

    Senhasegura configures this store to sync secrets using senhasegura provider
    doppler
    DopplerProvider     		(Optional)

    Doppler configures this store to sync secrets using the Doppler provider

    SecretStoreRef

    (Appears on: ExternalSecretSpec)

    SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.

    Field Description
    name
    string

    Name of the SecretStore resource
    kind
    string     		(Optional)

    Kind of the SecretStore resource (SecretStore or ClusterSecretStore) Defaults to SecretStore

    SecretStoreRetrySettings

    (Appears on: SecretStoreSpec)

    Field Description
    maxRetries
    int32
    retryInterval
    string

    SecretStoreSpec

    (Appears on: ClusterSecretStore, SecretStore)

    SecretStoreSpec defines the desired state of SecretStore.

    Field Description
    controller
    string     		(Optional)

    Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property
    provider
    SecretStoreProvider

    Used to configure the provider. Only one provider may be set
    retrySettings
    SecretStoreRetrySettings     		(Optional)

    Used to configure http retries if failed
    refreshInterval
    int     		(Optional)

    Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.

    SecretStoreStatus

    (Appears on: ClusterSecretStore, SecretStore)

    SecretStoreStatus defines the observed state of the SecretStore.

    Field Description
    conditions
    []SecretStoreStatusCondition     		(Optional)

    SecretStoreStatusCondition

    (Appears on: SecretStoreStatus)

    Field Description
    type
    SecretStoreConditionType
    status
    Kubernetes core/v1.ConditionStatus
    reason
    string     		(Optional)
    message
    string     		(Optional)
    lastTransitionTime
    Kubernetes meta/v1.Time     		(Optional)

    SecretsClient

    SecretsClient provides access to secrets.

    SenhaseguraAuth

    (Appears on: SenhaseguraProvider)

    SenhaseguraAuth tells the controller how to do auth in senhasegura.

    Field Description
    clientId
    string
    clientSecretSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    SenhaseguraModuleType (string alias)

    (Appears on: SenhaseguraProvider)

    SenhaseguraModuleType enum defines senhasegura target module to fetch secrets

    Value Description

    "DSM"

    		 
     SenhaseguraModuleDSM is the senhasegura DevOps Secrets Management module
see: https://senhasegura.com/devops

    SenhaseguraProvider

    (Appears on: SecretStoreProvider)

    SenhaseguraProvider setup a store to sync secrets with senhasegura.

    Field Description
    url
    string

    URL of senhasegura
    module
    SenhaseguraModuleType

    Module defines which senhasegura module should be used to get secrets
    auth
    SenhaseguraAuth

    Auth defines parameters to authenticate in senhasegura
    ignoreSslCertificate
    bool

    IgnoreSslCertificate defines if SSL certificate must be ignored

    TemplateEngineVersion (string alias)

    (Appears on: ExternalSecretTemplate)

    Value Description

    "v1"

    "v2"

    TemplateFrom

    (Appears on: ExternalSecretTemplate)

    Field Description
    configMap
    TemplateRef
    secret
    TemplateRef

    TemplateRef

    (Appears on: TemplateFrom)

    Field Description
    name
    string
    items
    []TemplateRefItem

    TemplateRefItem

    (Appears on: TemplateRef)

    Field Description
    key
    string

    TokenAuth

    (Appears on: KubernetesAuth)

    Field Description
    bearerToken
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    ValidationResult (byte alias)

    Value Description

    2

    Error indicates that there is a misconfiguration.

    0

    Ready indicates that the client is confgured correctly and can be used.

    1

    Unknown indicates that the client can be used but information is missing and it can not be validated.

    VaultAppRole

    (Appears on: VaultAuth)

    VaultAppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.

    Field Description
    path
    string

    Path where the App Role authentication backend is mounted in Vault, e.g: “approle”
    roleId
    string

    RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault.
    secretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    Reference to a key in a Secret that contains the App Role secret used to authenticate with Vault. The key field must be specified and denotes which entry within the Secret resource is used as the app role secret.

    VaultAuth

    (Appears on: VaultProvider)

    VaultAuth is the configuration used to authenticate with a Vault server. Only one of tokenSecretRef, appRole, kubernetes, ldap, jwt or cert can be specified.

    Field Description
    tokenSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    TokenSecretRef authenticates with Vault by presenting a token.
    appRole
    VaultAppRole     		(Optional)

    AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.
    kubernetes
    VaultKubernetesAuth     		(Optional)

    Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server.
    ldap
    VaultLdapAuth     		(Optional)

    Ldap authenticates with Vault by passing username/password pair using the LDAP authentication method
    jwt
    VaultJwtAuth     		(Optional)

    Jwt authenticates with Vault by passing role and JWT token using the JWT/OIDC authentication method
    cert
    VaultCertAuth     		(Optional)

    Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate Cert authentication method

    VaultCertAuth

    (Appears on: VaultAuth)

    VaultJwtAuth authenticates with Vault using the JWT/OIDC authentication method, with the role name and token stored in a Kubernetes Secret resource.

    Field Description
    clientCert
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    ClientCert is a certificate to authenticate using the Cert Vault authentication method
    secretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    SecretRef to a key in a Secret resource containing client private key to authenticate with Vault using the Cert authentication method

    VaultJwtAuth

    (Appears on: VaultAuth)

    VaultJwtAuth authenticates with Vault using the JWT/OIDC authentication method, with the role name and a token stored in a Kubernetes Secret resource or a Kubernetes service account token retrieved via TokenRequest.

    Field Description
    path
    string

    Path where the JWT authentication backend is mounted in Vault, e.g: “jwt”
    role
    string     		(Optional)

    Role is a JWT role to authenticate using the JWT/OIDC Vault authentication method
    secretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    Optional SecretRef that refers to a key in a Secret resource containing JWT token to authenticate with Vault using the JWT/OIDC authentication method.
    kubernetesServiceAccountToken
    VaultKubernetesServiceAccountTokenAuth     		(Optional)

    Optional ServiceAccountToken specifies the Kubernetes service account for which to request a token for with the TokenRequest API.

    VaultKVStoreVersion (string alias)

    (Appears on: VaultProvider)

    Value Description

    "v1"

    "v2"

    VaultKubernetesAuth

    (Appears on: VaultAuth)

    Authenticate against Vault using a Kubernetes ServiceAccount token stored in a Secret.

    Field Description
    mountPath
    string

    Path where the Kubernetes authentication backend is mounted in Vault, e.g: “kubernetes”
    serviceAccountRef
    github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector     		(Optional)

    Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Vault. If the service account selector is not supplied, the secretRef will be used instead.
    secretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    Optional secret field containing a Kubernetes ServiceAccount JWT used for authenticating with Vault. If a name is specified without a key, token is the default. If one is not specified, the one bound to the controller will be used.
    role
    string

    A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies.

    VaultKubernetesServiceAccountTokenAuth

    (Appears on: VaultJwtAuth)

    VaultKubernetesServiceAccountTokenAuth authenticates with Vault using a temporary Kubernetes service account token retrieved by the TokenRequest API.

    Field Description
    serviceAccountRef
    github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector

    Service account field containing the name of a kubernetes ServiceAccount.
    audiences
    []string     		(Optional)

    Optional audiences field that will be used to request a temporary Kubernetes service account token for the service account referenced by serviceAccountRef. Defaults to a single audience vault it not specified. Deprecated: use serviceAccountRef.Audiences instead
    expirationSeconds
    int64     		(Optional)

    Optional expiration time in seconds that will be used to request a temporary Kubernetes service account token for the service account referenced by serviceAccountRef. Deprecated: this will be removed in the future. Defaults to 10 minutes.

    VaultLdapAuth

    (Appears on: VaultAuth)

    VaultLdapAuth authenticates with Vault using the LDAP authentication method, with the username and password stored in a Kubernetes Secret resource.

    Field Description
    path
    string

    Path where the LDAP authentication backend is mounted in Vault, e.g: “ldap”
    username
    string

    Username is a LDAP user name used to authenticate using the LDAP Vault authentication method
    secretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    SecretRef to a key in a Secret resource containing password for the LDAP user used to authenticate with Vault using the LDAP authentication method

    VaultProvider

    (Appears on: SecretStoreProvider)

    Configures an store to sync secrets using a HashiCorp Vault KV backend.

    Field Description
    auth
    VaultAuth

    Auth configures how secret-manager authenticates with the Vault server.
    server
    string

    Server is the connection address for the Vault server, e.g: “https://vault.example.com:8200”.
    path
    string     		(Optional)

    Path is the mount path of the Vault KV backend endpoint, e.g: “secret”. The v2 KV secret engine version specific “/data” path suffix for fetching secrets from Vault is optional and will be appended if not present in specified path.
    version
    VaultKVStoreVersion

    Version is the Vault KV secret engine version. This can be either “v1” or “v2”. Version defaults to “v2”.
    namespace
    string     		(Optional)

    Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: “ns1”. More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces
    caBundle
    []byte     		(Optional)

    PEM encoded CA bundle used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection.
    caProvider
    CAProvider     		(Optional)

    The provider for the CA bundle to use to validate Vault server certificate.
    readYourWrites
    bool     		(Optional)

    ReadYourWrites ensures isolated read-after-write semantics by providing discovered cluster replication states in each request. More information about eventual consistency in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency
    forwardInconsistent
    bool     		(Optional)

    ForwardInconsistent tells Vault to forward read-after-write requests to the Vault leader instead of simply retrying within a loop. This can increase performance if the option is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header

    WebhookCAProvider

    (Appears on: WebhookProvider)

    Defines a location to fetch the cert for the webhook provider from.

    Field Description
    type
    WebhookCAProviderType

    The type of provider to use such as “Secret”, or “ConfigMap”.
    name
    string

    The name of the object located at the provider type.
    key
    string

    The key the value inside of the provider type to use, only used with “Secret” type
    namespace
    string     		(Optional)

    The namespace the Provider type is in.

    WebhookCAProviderType (string alias)

    (Appears on: WebhookCAProvider)

    Value Description

    "ConfigMap"

    "Secret"

    WebhookProvider

    (Appears on: SecretStoreProvider)

    AkeylessProvider Configures an store to sync secrets using Akeyless KV.

    Field Description
    method
    string

    Webhook Method
    url
    string

    Webhook url to call
    headers
    map[string]string     		(Optional)

    Headers
    body
    string     		(Optional)

    Body
    timeout
    Kubernetes meta/v1.Duration     		(Optional)

    Timeout
    result
    WebhookResult

    Result formatting
    secrets
    []WebhookSecret     		(Optional)

    Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name
    caBundle
    []byte     		(Optional)

    PEM encoded CA bundle used to validate webhook server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection.
    caProvider
    WebhookCAProvider     		(Optional)

    The provider for the CA bundle to use to validate webhook server certificate.

    WebhookResult

    (Appears on: WebhookProvider)

    Field Description
    jsonPath
    string     		(Optional)

    Json path of return value

    WebhookSecret

    (Appears on: WebhookProvider)

    Field Description
    name
    string

    Name of this secret in templates
    secretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    Secret ref to fill in credentials

    YandexCertificateManagerAuth

    (Appears on: YandexCertificateManagerProvider)

    Field Description
    authorizedKeySecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    The authorized key used for authentication

    YandexCertificateManagerCAProvider

    (Appears on: YandexCertificateManagerProvider)

    Field Description
    certSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    YandexCertificateManagerProvider

    (Appears on: SecretStoreProvider)

    YandexCertificateManagerProvider Configures a store to sync secrets using the Yandex Certificate Manager provider.

    Field Description
    apiEndpoint
    string     		(Optional)

    Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’)
    auth
    YandexCertificateManagerAuth

    Auth defines the information necessary to authenticate against Yandex Certificate Manager
    caProvider
    YandexCertificateManagerCAProvider     		(Optional)

    The provider for the CA bundle to use to validate Yandex.Cloud server certificate.

    YandexLockboxAuth

    (Appears on: YandexLockboxProvider)

    Field Description
    authorizedKeySecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector     		(Optional)

    The authorized key used for authentication

    YandexLockboxCAProvider

    (Appears on: YandexLockboxProvider)

    Field Description
    certSecretRef
    github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector

    YandexLockboxProvider

    (Appears on: SecretStoreProvider)

    YandexLockboxProvider Configures a store to sync secrets using the Yandex Lockbox provider.

    Field Description
    apiEndpoint
    string     		(Optional)

    Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’)
    auth
    YandexLockboxAuth

    Auth defines the information necessary to authenticate against Yandex Lockbox
    caProvider
    YandexLockboxCAProvider     		(Optional)

    The provider for the CA bundle to use to validate Yandex.Cloud server certificate.

    Generated with gen-crd-api-reference-docs.