API specification
Packages:
external-secrets.io/v1beta1
Package v1beta1 contains resources for external-secrets
Resource Types:
AWSAuth
(Appears on: AWSProvider)
AWSAuth tells the controller how to do authentication with aws. Only one of secretRef or jwt can be specified. if none is specified the controller will load credentials using the aws sdk defaults.
Field | Description |
---|---|
secretRef
AWSAuthSecretRef
|
(Optional) |
jwt
AWSJWTAuth
|
(Optional) |
AWSAuthSecretRef
(Appears on: AWSAuth)
AWSAuthSecretRef holds secret references for AWS credentials both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
Field | Description |
---|---|
accessKeyIDSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The AccessKeyID is used for authentication |
secretAccessKeySecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The SecretAccessKey is used for authentication |
AWSJWTAuth
(Appears on: AWSAuth)
Authenticate against AWS using service account tokens.
Field | Description |
---|---|
serviceAccountRef
github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
|
AWSProvider
(Appears on: SecretStoreProvider)
AWSProvider configures a store to sync secrets with AWS.
Field | Description |
---|---|
service
AWSServiceType
|
Service defines which service should be used to fetch the secrets |
auth
AWSAuth
|
(Optional)
Auth defines the information necessary to authenticate against AWS if not set aws sdk will infer credentials from your environment see: https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials |
role
string
|
(Optional)
Role is a Role ARN which the SecretManager provider will assume |
region
string
|
AWS Region to be used for the provider |
AWSServiceType
(string
alias)
(Appears on: AWSProvider)
AWSServiceType is a enum that defines the service/API that is used to fetch the secrets.
Value | Description |
---|---|
"ParameterStore" |
AWSServiceParameterStore is the AWS SystemsManager ParameterStore. see: https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html |
"SecretsManager" |
AWSServiceSecretsManager is the AWS SecretsManager. see: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html |
AkeylessAuth
(Appears on: AkeylessProvider)
Field | Description |
---|---|
secretRef
AkeylessAuthSecretRef
|
(Optional)
Reference to a Secret that contains the details to authenticate with Akeyless. |
kubernetesAuth
AkeylessKubernetesAuth
|
(Optional)
Kubernetes authenticates with Akeyless by passing the ServiceAccount token stored in the named Secret resource. |
AkeylessAuthSecretRef
(Appears on: AkeylessAuth)
AkeylessAuthSecretRef AKEYLESS_ACCESS_TYPE_PARAM: AZURE_OBJ_ID OR GCP_AUDIENCE OR ACCESS_KEY OR KUB_CONFIG_NAME.
Field | Description |
---|---|
accessID
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The SecretAccessID is used for authentication |
accessType
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
|
accessTypeParam
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
AkeylessKubernetesAuth
(Appears on: AkeylessAuth)
Authenticate with Kubernetes ServiceAccount token stored.
Field | Description |
---|---|
accessID
string
|
the Akeyless Kubernetes auth-method access-id |
k8sConfName
string
|
Kubernetes-auth configuration name in Akeyless-Gateway |
serviceAccountRef
github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
|
(Optional)
Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Akeyless. If the service account selector is not supplied, the secretRef will be used instead. |
secretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
Optional secret field containing a Kubernetes ServiceAccount JWT used
for authenticating with Akeyless. If a name is specified without a key,
|
AkeylessProvider
(Appears on: SecretStoreProvider)
AkeylessProvider Configures an store to sync secrets using Akeyless KV.
Field | Description |
---|---|
akeylessGWApiURL
string
|
Akeyless GW API Url from which the secrets to be fetched from. |
authSecretRef
AkeylessAuth
|
Auth configures how the operator authenticates with Akeyless. |
AlibabaAuth
(Appears on: AlibabaProvider)
AlibabaAuth contains a secretRef for credentials.
Field | Description |
---|---|
secretRef
AlibabaAuthSecretRef
|
AlibabaAuthSecretRef
(Appears on: AlibabaAuth)
AlibabaAuthSecretRef holds secret references for Alibaba credentials.
Field | Description |
---|---|
accessKeyIDSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The AccessKeyID is used for authentication |
accessKeySecretSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The AccessKeySecret is used for authentication |
AlibabaProvider
(Appears on: SecretStoreProvider)
AlibabaProvider configures a store to sync secrets using the Alibaba Secret Manager provider.
Field | Description |
---|---|
auth
AlibabaAuth
|
|
endpoint
string
|
(Optional) |
regionID
string
|
Alibaba Region to be used for the provider |
AzureAuthType
(string
alias)
(Appears on: AzureKVProvider)
AuthType describes how to authenticate to the Azure Keyvault Only one of the following auth types may be specified. If none of the following auth type is specified, the default one is ServicePrincipal.
Value | Description |
---|---|
"ManagedIdentity" |
Using Managed Identity to authenticate. Used with aad-pod-identity installed in the cluster. |
"ServicePrincipal" |
Using service principal to authenticate, which needs a tenantId, a clientId and a clientSecret. |
"WorkloadIdentity" |
Using Workload Identity service accounts to authenticate. |
AzureEnvironmentType
(string
alias)
(Appears on: AzureKVProvider)
AzureEnvironmentType specifies the Azure cloud environment endpoints to use for connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint. The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud
Value | Description |
---|---|
"ChinaCloud" |
|
"GermanCloud" |
|
"PublicCloud" |
|
"USGovernmentCloud" |
AzureKVAuth
(Appears on: AzureKVProvider)
Configuration used to authenticate with Azure.
Field | Description |
---|---|
clientId
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
The Azure clientId of the service principle used for authentication. |
clientSecret
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
The Azure ClientSecret of the service principle used for authentication. |
AzureKVProvider
(Appears on: SecretStoreProvider)
Configures an store to sync secrets using Azure KV.
Field | Description |
---|---|
authType
AzureAuthType
|
(Optional)
Auth type defines how to authenticate to the keyvault service. Valid values are: - “ServicePrincipal” (default): Using a service principal (tenantId, clientId, clientSecret) - “ManagedIdentity”: Using Managed Identity assigned to the pod (see aad-pod-identity) |
vaultUrl
string
|
Vault Url from which the secrets to be fetched from. |
tenantId
string
|
(Optional)
TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. |
environmentType
AzureEnvironmentType
|
EnvironmentType specifies the Azure cloud environment endpoints to use for connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint. The following endpoints are available, also see here: https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152 PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud |
authSecretRef
AzureKVAuth
|
(Optional)
Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. |
serviceAccountRef
github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
|
(Optional)
ServiceAccountRef specified the service account that should be used when authenticating with WorkloadIdentity. |
identityId
string
|
(Optional)
If multiple Managed Identity is assigned to the pod, you can select the one to be used |
CAProvider
(Appears on: KubernetesServer, VaultProvider)
Used to provide custom certificate authority (CA) certificates for a secret store. The CAProvider points to a Secret or ConfigMap resource that contains a PEM-encoded certificate.
Field | Description |
---|---|
type
CAProviderType
|
The type of provider to use such as “Secret”, or “ConfigMap”. |
name
string
|
The name of the object located at the provider type. |
key
string
|
The key where the CA certificate can be found in the Secret or ConfigMap. |
namespace
string
|
(Optional)
The namespace the Provider type is in. Can only be defined when used in a ClusterSecretStore. |
CAProviderType
(string
alias)
(Appears on: CAProvider)
Value | Description |
---|---|
"ConfigMap" |
|
"Secret" |
CertAuth
(Appears on: KubernetesAuth)
Field | Description |
---|---|
clientCert
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
|
clientKey
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
ClusterExternalSecret
ClusterExternalSecret is the Schema for the clusterexternalsecrets API.
Field | Description | ||||||||
---|---|---|---|---|---|---|---|---|---|
metadata
Kubernetes meta/v1.ObjectMeta
|
Refer to the Kubernetes API documentation for the fields of the
metadata field.
|
||||||||
spec
ClusterExternalSecretSpec
|
|
||||||||
status
ClusterExternalSecretStatus
|
ClusterExternalSecretConditionType
(string
alias)
(Appears on: ClusterExternalSecretStatusCondition)
Value | Description |
---|---|
"NotReady" |
|
"PartiallyReady" |
|
"Ready" |
ClusterExternalSecretNamespaceFailure
(Appears on: ClusterExternalSecretStatus)
ClusterExternalSecretNamespaceFailure represents a failed namespace deployment and it’s reason.
Field | Description |
---|---|
namespace
string
|
Namespace is the namespace that failed when trying to apply an ExternalSecret |
reason
string
|
(Optional)
Reason is why the ExternalSecret failed to apply to the namespace |
ClusterExternalSecretSpec
(Appears on: ClusterExternalSecret)
ClusterExternalSecretSpec defines the desired state of ClusterExternalSecret.
Field | Description |
---|---|
externalSecretSpec
ExternalSecretSpec
|
The spec for the ExternalSecrets to be created |
externalSecretName
string
|
(Optional)
The name of the external secrets to be created defaults to the name of the ClusterExternalSecret |
namespaceSelector
Kubernetes meta/v1.LabelSelector
|
The labels to select by to find the Namespaces to create the ExternalSecrets in. |
refreshTime
Kubernetes meta/v1.Duration
|
The time in which the controller should reconcile it’s objects and recheck namespaces for labels. |
ClusterExternalSecretStatus
(Appears on: ClusterExternalSecret)
ClusterExternalSecretStatus defines the observed state of ClusterExternalSecret.
Field | Description |
---|---|
failedNamespaces
[]ClusterExternalSecretNamespaceFailure
|
(Optional)
Failed namespaces are the namespaces that failed to apply an ExternalSecret |
provisionedNamespaces
[]string
|
(Optional)
ProvisionedNamespaces are the namespaces where the ClusterExternalSecret has secrets |
conditions
[]ClusterExternalSecretStatusCondition
|
(Optional) |
ClusterExternalSecretStatusCondition
(Appears on: ClusterExternalSecretStatus)
Field | Description |
---|---|
type
ClusterExternalSecretConditionType
|
|
status
Kubernetes core/v1.ConditionStatus
|
|
message
string
|
(Optional) |
ClusterSecretStore
ClusterSecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef
fields.
Field | Description | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
metadata
Kubernetes meta/v1.ObjectMeta
|
Refer to the Kubernetes API documentation for the fields of the
metadata field.
|
||||||||||
spec
SecretStoreSpec
|
|
||||||||||
status
SecretStoreStatus
|
ClusterSecretStoreCondition
(Appears on: SecretStoreSpec)
ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in for a ClusterSecretStore instance.
Field | Description |
---|---|
namespaceSelector
Kubernetes meta/v1.LabelSelector
|
(Optional)
Choose namespace using a labelSelector |
namespaces
[]string
|
Choose namespaces by name |
DopplerAuth
(Appears on: DopplerProvider)
Field | Description |
---|---|
secretRef
DopplerAuthSecretRef
|
DopplerAuthSecretRef
(Appears on: DopplerAuth)
Field | Description |
---|---|
dopplerToken
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The DopplerToken is used for authentication. See https://docs.doppler.com/reference/api#authentication for auth token types. The Key attribute defaults to dopplerToken if not specified. |
DopplerProvider
(Appears on: SecretStoreProvider)
DopplerProvider configures a store to sync secrets using the Doppler provider. Project and Config are required if not using a Service Token.
Field | Description |
---|---|
auth
DopplerAuth
|
Auth configures how the Operator authenticates with the Doppler API |
project
string
|
(Optional)
Doppler project (required if not using a Service Token) |
config
string
|
(Optional)
Doppler config (required if not using a Service Token) |
nameTransformer
string
|
(Optional)
Environment variable compatible name transforms that change secret names to a different format |
format
string
|
(Optional)
Format enables the downloading of secrets as a file (string) |
ExternalSecret
ExternalSecret is the Schema for the external-secrets API.
Field | Description | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
metadata
Kubernetes meta/v1.ObjectMeta
|
Refer to the Kubernetes API documentation for the fields of the
metadata field.
|
||||||||||
spec
ExternalSecretSpec
|
|
||||||||||
status
ExternalSecretStatus
|
ExternalSecretConditionType
(string
alias)
(Appears on: ExternalSecretStatusCondition)
Value | Description |
---|---|
"Deleted" |
|
"Ready" |
ExternalSecretConversionStrategy
(string
alias)
(Appears on: ExternalSecretDataRemoteRef, ExternalSecretFind)
Value | Description |
---|---|
"Default" |
|
"Unicode" |
ExternalSecretCreationPolicy
(string
alias)
(Appears on: ExternalSecretTarget)
ExternalSecretCreationPolicy defines rules on how to create the resulting Secret.
Value | Description |
---|---|
"Merge" |
Merge does not create the Secret, but merges the data fields to the Secret. |
"None" |
None does not create a Secret (future use with injector). |
"Orphan" |
Orphan creates the Secret and does not set the ownerReference. I.e. it will be orphaned after the deletion of the ExternalSecret. |
"Owner" |
Owner creates the Secret and sets .metadata.ownerReferences to the ExternalSecret resource. |
ExternalSecretData
(Appears on: ExternalSecretSpec)
ExternalSecretData defines the connection between the Kubernetes Secret key (spec.data.
Field | Description |
---|---|
secretKey
string
|
|
remoteRef
ExternalSecretDataRemoteRef
|
ExternalSecretDataFromRemoteRef
(Appears on: ExternalSecretSpec)
Field | Description |
---|---|
extract
ExternalSecretDataRemoteRef
|
(Optional)
Used to extract multiple key/value pairs from one secret |
find
ExternalSecretFind
|
(Optional)
Used to find secrets based on tags or regular expressions |
rewrite
[]ExternalSecretRewrite
|
(Optional)
Used to rewrite secret Keys after getting them from the secret Provider Multiple Rewrite operations can be provided. They are applied in a layered order (first to last) |
ExternalSecretDataRemoteRef
(Appears on: ExternalSecretData, ExternalSecretDataFromRemoteRef)
ExternalSecretDataRemoteRef defines Provider data location.
Field | Description |
---|---|
key
string
|
Key is the key used in the Provider, mandatory |
metadataPolicy
ExternalSecretMetadataPolicy
|
(Optional)
Policy for fetching tags/labels from provider secrets, possible options are Fetch, None. Defaults to None |
property
string
|
(Optional)
Used to select a specific property of the Provider value (if a map), if supported |
version
string
|
(Optional)
Used to select a specific version of the Provider value, if supported |
conversionStrategy
ExternalSecretConversionStrategy
|
(Optional)
Used to define a conversion Strategy |
decodingStrategy
ExternalSecretDecodingStrategy
|
(Optional)
Used to define a decoding Strategy |
ExternalSecretDecodingStrategy
(string
alias)
(Appears on: ExternalSecretDataRemoteRef, ExternalSecretFind)
Value | Description |
---|---|
"Auto" |
|
"Base64" |
|
"Base64URL" |
|
"None" |
ExternalSecretDeletionPolicy
(string
alias)
(Appears on: ExternalSecretTarget)
ExternalSecretDeletionPolicy defines rules on how to delete the resulting Secret.
Value | Description |
---|---|
"Delete" |
Delete deletes the secret if all provider secrets are deleted. If a secret gets deleted on the provider side and is not accessible anymore this is not considered an error and the ExternalSecret does not go into SecretSyncedError status. |
"Merge" |
Merge removes keys in the secret, but not the secret itself. If a secret gets deleted on the provider side and is not accessible anymore this is not considered an error and the ExternalSecret does not go into SecretSyncedError status. |
"Retain" |
Retain will retain the secret if all provider secrets have been deleted. If a provider secret does not exist the ExternalSecret gets into the SecretSyncedError status. |
ExternalSecretFind
(Appears on: ExternalSecretDataFromRemoteRef)
Field | Description |
---|---|
path
string
|
(Optional)
A root path to start the find operations. |
name
FindName
|
(Optional)
Finds secrets based on the name. |
tags
map[string]string
|
(Optional)
Find secrets based on tags. |
conversionStrategy
ExternalSecretConversionStrategy
|
(Optional)
Used to define a conversion Strategy |
decodingStrategy
ExternalSecretDecodingStrategy
|
(Optional)
Used to define a decoding Strategy |
ExternalSecretMetadataPolicy
(string
alias)
(Appears on: ExternalSecretDataRemoteRef)
Value | Description |
---|---|
"Fetch" |
|
"None" |
ExternalSecretRewrite
(Appears on: ExternalSecretDataFromRemoteRef)
Field | Description |
---|---|
regexp
ExternalSecretRewriteRegexp
|
(Optional)
Used to rewrite with regular expressions. The resulting key will be the output of a regexp.ReplaceAll operation. |
ExternalSecretRewriteRegexp
(Appears on: ExternalSecretRewrite)
Field | Description |
---|---|
source
string
|
Used to define the regular expression of a re.Compiler. |
target
string
|
Used to define the target pattern of a ReplaceAll operation. |
ExternalSecretSpec
(Appears on: ClusterExternalSecretSpec, ExternalSecret)
ExternalSecretSpec defines the desired state of ExternalSecret.
Field | Description |
---|---|
secretStoreRef
SecretStoreRef
|
|
target
ExternalSecretTarget
|
(Optional) |
refreshInterval
Kubernetes meta/v1.Duration
|
RefreshInterval is the amount of time before the values are read again from the SecretStore provider Valid time units are “ns”, “us” (or “µs”), “ms”, “s”, “m”, “h” May be set to zero to fetch and create it once. Defaults to 1h. |
data
[]ExternalSecretData
|
(Optional)
Data defines the connection between the Kubernetes Secret keys and the Provider data |
dataFrom
[]ExternalSecretDataFromRemoteRef
|
(Optional)
DataFrom is used to fetch all properties from a specific Provider data If multiple entries are specified, the Secret keys are merged in the specified order |
ExternalSecretStatus
(Appears on: ExternalSecret)
Field | Description |
---|---|
refreshTime
Kubernetes meta/v1.Time
|
refreshTime is the time and date the external secret was fetched and the target secret updated |
syncedResourceVersion
string
|
SyncedResourceVersion keeps track of the last synced version |
conditions
[]ExternalSecretStatusCondition
|
(Optional) |
ExternalSecretStatusCondition
(Appears on: ExternalSecretStatus)
Field | Description |
---|---|
type
ExternalSecretConditionType
|
|
status
Kubernetes core/v1.ConditionStatus
|
|
reason
string
|
(Optional) |
message
string
|
(Optional) |
lastTransitionTime
Kubernetes meta/v1.Time
|
(Optional) |
ExternalSecretTarget
(Appears on: ExternalSecretSpec)
ExternalSecretTarget defines the Kubernetes Secret to be created There can be only one target per ExternalSecret.
Field | Description |
---|---|
name
string
|
(Optional)
Name defines the name of the Secret resource to be managed This field is immutable Defaults to the .metadata.name of the ExternalSecret resource |
creationPolicy
ExternalSecretCreationPolicy
|
(Optional)
CreationPolicy defines rules on how to create the resulting Secret Defaults to ‘Owner’ |
deletionPolicy
ExternalSecretDeletionPolicy
|
(Optional)
DeletionPolicy defines rules on how to delete the resulting Secret Defaults to ‘Retain’ |
template
ExternalSecretTemplate
|
(Optional)
Template defines a blueprint for the created Secret resource. |
immutable
bool
|
(Optional)
Immutable defines if the final secret will be immutable |
ExternalSecretTemplate
(Appears on: ExternalSecretTarget)
ExternalSecretTemplate defines a blueprint for the created Secret resource. we can not use native corev1.Secret, it will have empty ObjectMeta values: https://github.com/kubernetes-sigs/controller-tools/issues/448
Field | Description |
---|---|
type
Kubernetes core/v1.SecretType
|
(Optional) |
engineVersion
TemplateEngineVersion
|
|
metadata
ExternalSecretTemplateMetadata
|
(Optional) |
data
map[string]string
|
(Optional) |
templateFrom
[]TemplateFrom
|
(Optional) |
ExternalSecretTemplateMetadata
(Appears on: ExternalSecretTemplate)
ExternalSecretTemplateMetadata defines metadata fields for the Secret blueprint.
Field | Description |
---|---|
annotations
map[string]string
|
(Optional) |
labels
map[string]string
|
(Optional) |
ExternalSecretValidator
FakeProvider
(Appears on: SecretStoreProvider)
FakeProvider configures a fake provider that returns static values.
Field | Description |
---|---|
data
[]FakeProviderData
|
FakeProviderData
(Appears on: FakeProvider)
Field | Description |
---|---|
key
string
|
|
value
string
|
|
valueMap
map[string]string
|
|
version
string
|
FindName
(Appears on: ExternalSecretFind)
Field | Description |
---|---|
regexp
string
|
(Optional)
Finds secrets base |
GCPSMAuth
(Appears on: GCPSMProvider)
Field | Description |
---|---|
secretRef
GCPSMAuthSecretRef
|
(Optional) |
workloadIdentity
GCPWorkloadIdentity
|
(Optional) |
GCPSMAuthSecretRef
(Appears on: GCPSMAuth)
Field | Description |
---|---|
secretAccessKeySecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
The SecretAccessKey is used for authentication |
GCPSMProvider
(Appears on: SecretStoreProvider)
GCPSMProvider Configures a store to sync secrets using the GCP Secret Manager provider.
Field | Description |
---|---|
auth
GCPSMAuth
|
(Optional)
Auth defines the information necessary to authenticate against GCP |
projectID
string
|
ProjectID project where secret is located |
GCPWorkloadIdentity
(Appears on: GCPSMAuth)
Field | Description |
---|---|
serviceAccountRef
github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
|
|
clusterLocation
string
|
|
clusterName
string
|
|
clusterProjectID
string
|
GenericStore
GenericStore is a common interface for interacting with ClusterSecretStore or a namespaced SecretStore.
GenericStoreValidator
GitlabAuth
(Appears on: GitlabProvider)
Field | Description |
---|---|
SecretRef
GitlabSecretRef
|
GitlabProvider
(Appears on: SecretStoreProvider)
Configures a store to sync secrets with a GitLab instance.
Field | Description |
---|---|
url
string
|
URL configures the GitLab instance URL. Defaults to https://gitlab.com/. |
auth
GitlabAuth
|
Auth configures how secret-manager authenticates with a GitLab instance. |
projectID
string
|
ProjectID specifies a project where secrets are located. |
environment
string
|
Environment environment_scope of gitlab CI/CD variables (Please see https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment on how to create environments) |
GitlabSecretRef
(Appears on: GitlabAuth)
Field | Description |
---|---|
accessToken
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
AccessToken is used for authentication. |
IBMAuth
(Appears on: IBMProvider)
Field | Description |
---|---|
secretRef
IBMAuthSecretRef
|
|
containerAuth
IBMAuthContainerAuth
|
IBMAuthContainerAuth
(Appears on: IBMAuth)
IBM Container-based auth with IAM Trusted Profile.
Field | Description |
---|---|
profile
string
|
the IBM Trusted Profile |
tokenLocation
string
|
Location the token is mounted on the pod |
iamEndpoint
string
|
IBMAuthSecretRef
(Appears on: IBMAuth)
Field | Description |
---|---|
secretApiKeySecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The SecretAccessKey is used for authentication |
IBMProvider
(Appears on: SecretStoreProvider)
Configures an store to sync secrets using a IBM Cloud Secrets Manager backend.
Field | Description |
---|---|
auth
IBMAuth
|
Auth configures how secret-manager authenticates with the IBM secrets manager. |
serviceUrl
string
|
ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance |
KubernetesAuth
(Appears on: KubernetesProvider)
Field | Description |
---|---|
cert
CertAuth
|
(Optional)
has both clientCert and clientKey as secretKeySelector |
token
TokenAuth
|
(Optional)
use static token to authenticate with |
serviceAccount
github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
|
(Optional)
points to a service account that should be used for authentication |
KubernetesProvider
(Appears on: SecretStoreProvider)
Configures a store to sync secrets with a Kubernetes instance.
Field | Description |
---|---|
server
KubernetesServer
|
configures the Kubernetes server Address. |
auth
KubernetesAuth
|
Auth configures how secret-manager authenticates with a Kubernetes instance. |
remoteNamespace
string
|
(Optional)
Remote namespace to fetch the secrets from |
KubernetesServer
(Appears on: KubernetesProvider)
Field | Description |
---|---|
url
string
|
(Optional)
configures the Kubernetes server Address. |
caBundle
[]byte
|
(Optional)
CABundle is a base64-encoded CA certificate |
caProvider
CAProvider
|
(Optional)
see: https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider |
NoSecretError
NoSecretError shall be returned when a GetSecret can not find the desired secret. This is used for deletionPolicy.
OnePasswordAuth
(Appears on: OnePasswordProvider)
OnePasswordAuth contains a secretRef for credentials.
Field | Description |
---|---|
secretRef
OnePasswordAuthSecretRef
|
OnePasswordAuthSecretRef
(Appears on: OnePasswordAuth)
OnePasswordAuthSecretRef holds secret references for 1Password credentials.
Field | Description |
---|---|
connectTokenSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
The ConnectToken is used for authentication to a 1Password Connect Server. |
OnePasswordProvider
(Appears on: SecretStoreProvider)
OnePasswordProvider configures a store to sync secrets using the 1Password Secret Manager provider.
Field | Description |
---|---|
auth
OnePasswordAuth
|
Auth defines the information necessary to authenticate against OnePassword Connect Server |
connectHost
string
|
ConnectHost defines the OnePassword Connect Server to connect to |
vaults
map[string]int
|
Vaults defines which OnePassword vaults to search in which order |
OracleAuth
(Appears on: OracleProvider)
Field | Description |
---|---|
tenancy
string
|
Tenancy is the tenancy OCID where user is located. |
user
string
|
User is an access OCID specific to the account. |
secretRef
OracleSecretRef
|
SecretRef to pass through sensitive information. |
OracleProvider
(Appears on: SecretStoreProvider)
Configures an store to sync secrets using a Oracle Vault backend.
Field | Description |
---|---|
region
string
|
Region is the region where vault is located. |
vault
string
|
Vault is the vault’s OCID of the specific vault where secret is located. |
auth
OracleAuth
|
(Optional)
Auth configures how secret-manager authenticates with the Oracle Vault. If empty, use the instance principal, otherwise the user credentials specified in Auth. |
OracleSecretRef
(Appears on: OracleAuth)
Field | Description |
---|---|
privatekey
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
PrivateKey is the user’s API Signing Key in PEM format, used for authentication. |
fingerprint
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
Fingerprint is the fingerprint of the API private key. |
Provider
Provider is a common interface for interacting with secret backends.
SecretStore
SecretStore represents a secure external location for storing secrets, which can be referenced as part of storeRef
fields.
Field | Description | ||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
metadata
Kubernetes meta/v1.ObjectMeta
|
Refer to the Kubernetes API documentation for the fields of the
metadata field.
|
||||||||||
spec
SecretStoreSpec
|
|
||||||||||
status
SecretStoreStatus
|
SecretStoreConditionType
(string
alias)
(Appears on: SecretStoreStatusCondition)
Value | Description |
---|---|
"Ready" |
SecretStoreProvider
(Appears on: SecretStoreSpec)
SecretStoreProvider contains the provider-specific configuration.
Field | Description |
---|---|
aws
AWSProvider
|
(Optional)
AWS configures this store to sync secrets using AWS Secret Manager provider |
azurekv
AzureKVProvider
|
(Optional)
AzureKV configures this store to sync secrets using Azure Key Vault provider |
akeyless
AkeylessProvider
|
(Optional)
Akeyless configures this store to sync secrets using Akeyless Vault provider |
vault
VaultProvider
|
(Optional)
Vault configures this store to sync secrets using Hashi provider |
gcpsm
GCPSMProvider
|
(Optional)
GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider |
oracle
OracleProvider
|
(Optional)
Oracle configures this store to sync secrets using Oracle Vault provider |
ibm
IBMProvider
|
(Optional)
IBM configures this store to sync secrets using IBM Cloud provider |
yandexcertificatemanager
YandexCertificateManagerProvider
|
(Optional)
YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider |
yandexlockbox
YandexLockboxProvider
|
(Optional)
YandexLockbox configures this store to sync secrets using Yandex Lockbox provider |
gitlab
GitlabProvider
|
(Optional)
Gitlab configures this store to sync secrets using Gitlab Variables provider |
alibaba
AlibabaProvider
|
(Optional)
Alibaba configures this store to sync secrets using Alibaba Cloud provider |
onepassword
OnePasswordProvider
|
(Optional)
OnePassword configures this store to sync secrets using the 1Password Cloud provider |
webhook
WebhookProvider
|
(Optional)
Webhook configures this store to sync secrets using a generic templated webhook |
kubernetes
KubernetesProvider
|
(Optional)
Kubernetes configures this store to sync secrets using a Kubernetes cluster provider |
fake
FakeProvider
|
(Optional)
Fake configures a store with static key/value pairs |
senhasegura
SenhaseguraProvider
|
(Optional)
Senhasegura configures this store to sync secrets using senhasegura provider |
doppler
DopplerProvider
|
(Optional)
Doppler configures this store to sync secrets using the Doppler provider |
SecretStoreRef
(Appears on: ExternalSecretSpec)
SecretStoreRef defines which SecretStore to fetch the ExternalSecret data.
Field | Description |
---|---|
name
string
|
Name of the SecretStore resource |
kind
string
|
(Optional)
Kind of the SecretStore resource (SecretStore or ClusterSecretStore)
Defaults to |
SecretStoreRetrySettings
(Appears on: SecretStoreSpec)
Field | Description |
---|---|
maxRetries
int32
|
|
retryInterval
string
|
SecretStoreSpec
(Appears on: ClusterSecretStore, SecretStore)
SecretStoreSpec defines the desired state of SecretStore.
Field | Description |
---|---|
controller
string
|
(Optional)
Used to select the correct KES controller (think: ingress.ingressClassName) The KES controller is instantiated with a specific controller name and filters ES based on this property |
provider
SecretStoreProvider
|
Used to configure the provider. Only one provider may be set |
retrySettings
SecretStoreRetrySettings
|
(Optional)
Used to configure http retries if failed |
refreshInterval
int
|
(Optional)
Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config. |
conditions
[]ClusterSecretStoreCondition
|
(Optional)
Used to constraint a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore |
SecretStoreStatus
(Appears on: ClusterSecretStore, SecretStore)
SecretStoreStatus defines the observed state of the SecretStore.
Field | Description |
---|---|
conditions
[]SecretStoreStatusCondition
|
(Optional) |
SecretStoreStatusCondition
(Appears on: SecretStoreStatus)
Field | Description |
---|---|
type
SecretStoreConditionType
|
|
status
Kubernetes core/v1.ConditionStatus
|
|
reason
string
|
(Optional) |
message
string
|
(Optional) |
lastTransitionTime
Kubernetes meta/v1.Time
|
(Optional) |
SecretsClient
SecretsClient provides access to secrets.
SenhaseguraAuth
(Appears on: SenhaseguraProvider)
SenhaseguraAuth tells the controller how to do auth in senhasegura.
Field | Description |
---|---|
clientId
string
|
|
clientSecretSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
SenhaseguraModuleType
(string
alias)
(Appears on: SenhaseguraProvider)
SenhaseguraModuleType enum defines senhasegura target module to fetch secrets
Value | Description |
---|---|
"DSM" |
|
SenhaseguraProvider
(Appears on: SecretStoreProvider)
SenhaseguraProvider setup a store to sync secrets with senhasegura.
Field | Description |
---|---|
url
string
|
URL of senhasegura |
module
SenhaseguraModuleType
|
Module defines which senhasegura module should be used to get secrets |
auth
SenhaseguraAuth
|
Auth defines parameters to authenticate in senhasegura |
ignoreSslCertificate
bool
|
IgnoreSslCertificate defines if SSL certificate must be ignored |
TemplateEngineVersion
(string
alias)
(Appears on: ExternalSecretTemplate)
Value | Description |
---|---|
"v1" |
|
"v2" |
TemplateFrom
(Appears on: ExternalSecretTemplate)
Field | Description |
---|---|
configMap
TemplateRef
|
|
secret
TemplateRef
|
TemplateRef
(Appears on: TemplateFrom)
Field | Description |
---|---|
name
string
|
|
items
[]TemplateRefItem
|
TemplateRefItem
(Appears on: TemplateRef)
Field | Description |
---|---|
key
string
|
TokenAuth
(Appears on: KubernetesAuth)
Field | Description |
---|---|
bearerToken
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
ValidationResult
(byte
alias)
Value | Description |
---|---|
2 |
Error indicates that there is a misconfiguration. |
0 |
Ready indicates that the client is confgured correctly and can be used. |
1 |
Unknown indicates that the client can be used but information is missing and it can not be validated. |
VaultAppRole
(Appears on: VaultAuth)
VaultAppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource.
Field | Description |
---|---|
path
string
|
Path where the App Role authentication backend is mounted in Vault, e.g: “approle” |
roleId
string
|
RoleID configured in the App Role authentication backend when setting up the authentication backend in Vault. |
secretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
Reference to a key in a Secret that contains the App Role secret used
to authenticate with Vault.
The |
VaultAuth
(Appears on: VaultProvider)
VaultAuth is the configuration used to authenticate with a Vault server.
Only one of tokenSecretRef
, appRole
, kubernetes
, ldap
, jwt
or cert
can be specified.
Field | Description |
---|---|
tokenSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
TokenSecretRef authenticates with Vault by presenting a token. |
appRole
VaultAppRole
|
(Optional)
AppRole authenticates with Vault using the App Role auth mechanism, with the role and secret stored in a Kubernetes Secret resource. |
kubernetes
VaultKubernetesAuth
|
(Optional)
Kubernetes authenticates with Vault by passing the ServiceAccount token stored in the named Secret resource to the Vault server. |
ldap
VaultLdapAuth
|
(Optional)
Ldap authenticates with Vault by passing username/password pair using the LDAP authentication method |
jwt
VaultJwtAuth
|
(Optional)
Jwt authenticates with Vault by passing role and JWT token using the JWT/OIDC authentication method |
cert
VaultCertAuth
|
(Optional)
Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate Cert authentication method |
VaultCertAuth
(Appears on: VaultAuth)
VaultJwtAuth authenticates with Vault using the JWT/OIDC authentication method, with the role name and token stored in a Kubernetes Secret resource.
Field | Description |
---|---|
clientCert
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
ClientCert is a certificate to authenticate using the Cert Vault authentication method |
secretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
SecretRef to a key in a Secret resource containing client private key to authenticate with Vault using the Cert authentication method |
VaultJwtAuth
(Appears on: VaultAuth)
VaultJwtAuth authenticates with Vault using the JWT/OIDC authentication
method, with the role name and a token stored in a Kubernetes Secret resource or
a Kubernetes service account token retrieved via TokenRequest
.
Field | Description |
---|---|
path
string
|
Path where the JWT authentication backend is mounted in Vault, e.g: “jwt” |
role
string
|
(Optional)
Role is a JWT role to authenticate using the JWT/OIDC Vault authentication method |
secretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
Optional SecretRef that refers to a key in a Secret resource containing JWT token to authenticate with Vault using the JWT/OIDC authentication method. |
kubernetesServiceAccountToken
VaultKubernetesServiceAccountTokenAuth
|
(Optional)
Optional ServiceAccountToken specifies the Kubernetes service account for which to request
a token for with the |
VaultKVStoreVersion
(string
alias)
(Appears on: VaultProvider)
Value | Description |
---|---|
"v1" |
|
"v2" |
VaultKubernetesAuth
(Appears on: VaultAuth)
Authenticate against Vault using a Kubernetes ServiceAccount token stored in a Secret.
Field | Description |
---|---|
mountPath
string
|
Path where the Kubernetes authentication backend is mounted in Vault, e.g: “kubernetes” |
serviceAccountRef
github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
|
(Optional)
Optional service account field containing the name of a kubernetes ServiceAccount. If the service account is specified, the service account secret token JWT will be used for authenticating with Vault. If the service account selector is not supplied, the secretRef will be used instead. |
secretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
Optional secret field containing a Kubernetes ServiceAccount JWT used
for authenticating with Vault. If a name is specified without a key,
|
role
string
|
A required field containing the Vault Role to assume. A Role binds a Kubernetes ServiceAccount with a set of Vault policies. |
VaultKubernetesServiceAccountTokenAuth
(Appears on: VaultJwtAuth)
VaultKubernetesServiceAccountTokenAuth authenticates with Vault using a temporary
Kubernetes service account token retrieved by the TokenRequest
API.
Field | Description |
---|---|
serviceAccountRef
github.com/external-secrets/external-secrets/apis/meta/v1.ServiceAccountSelector
|
Service account field containing the name of a kubernetes ServiceAccount. |
audiences
[]string
|
(Optional)
Optional audiences field that will be used to request a temporary Kubernetes service
account token for the service account referenced by |
expirationSeconds
int64
|
(Optional)
Optional expiration time in seconds that will be used to request a temporary
Kubernetes service account token for the service account referenced by
|
VaultLdapAuth
(Appears on: VaultAuth)
VaultLdapAuth authenticates with Vault using the LDAP authentication method, with the username and password stored in a Kubernetes Secret resource.
Field | Description |
---|---|
path
string
|
Path where the LDAP authentication backend is mounted in Vault, e.g: “ldap” |
username
string
|
Username is a LDAP user name used to authenticate using the LDAP Vault authentication method |
secretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
SecretRef to a key in a Secret resource containing password for the LDAP user used to authenticate with Vault using the LDAP authentication method |
VaultProvider
(Appears on: SecretStoreProvider)
Configures an store to sync secrets using a HashiCorp Vault KV backend.
Field | Description |
---|---|
auth
VaultAuth
|
Auth configures how secret-manager authenticates with the Vault server. |
server
string
|
Server is the connection address for the Vault server, e.g: “https://vault.example.com:8200”. |
path
string
|
(Optional)
Path is the mount path of the Vault KV backend endpoint, e.g: “secret”. The v2 KV secret engine version specific “/data” path suffix for fetching secrets from Vault is optional and will be appended if not present in specified path. |
version
VaultKVStoreVersion
|
Version is the Vault KV secret engine version. This can be either “v1” or “v2”. Version defaults to “v2”. |
namespace
string
|
(Optional)
Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows Vault environments to support Secure Multi-tenancy. e.g: “ns1”. More about namespaces can be found here https://www.vaultproject.io/docs/enterprise/namespaces |
caBundle
[]byte
|
(Optional)
PEM encoded CA bundle used to validate Vault server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. |
caProvider
CAProvider
|
(Optional)
The provider for the CA bundle to use to validate Vault server certificate. |
readYourWrites
bool
|
(Optional)
ReadYourWrites ensures isolated read-after-write semantics by providing discovered cluster replication states in each request. More information about eventual consistency in Vault can be found here https://www.vaultproject.io/docs/enterprise/consistency |
forwardInconsistent
bool
|
(Optional)
ForwardInconsistent tells Vault to forward read-after-write requests to the Vault leader instead of simply retrying within a loop. This can increase performance if the option is enabled serverside. https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header |
WebhookCAProvider
(Appears on: WebhookProvider)
Defines a location to fetch the cert for the webhook provider from.
Field | Description |
---|---|
type
WebhookCAProviderType
|
The type of provider to use such as “Secret”, or “ConfigMap”. |
name
string
|
The name of the object located at the provider type. |
key
string
|
The key the value inside of the provider type to use, only used with “Secret” type |
namespace
string
|
(Optional)
The namespace the Provider type is in. |
WebhookCAProviderType
(string
alias)
(Appears on: WebhookCAProvider)
Value | Description |
---|---|
"ConfigMap" |
|
"Secret" |
WebhookProvider
(Appears on: SecretStoreProvider)
AkeylessProvider Configures an store to sync secrets using Akeyless KV.
Field | Description |
---|---|
method
string
|
Webhook Method |
url
string
|
Webhook url to call |
headers
map[string]string
|
(Optional)
Headers |
body
string
|
(Optional)
Body |
timeout
Kubernetes meta/v1.Duration
|
(Optional)
Timeout |
result
WebhookResult
|
Result formatting |
secrets
[]WebhookSecret
|
(Optional)
Secrets to fill in templates These secrets will be passed to the templating function as key value pairs under the given name |
caBundle
[]byte
|
(Optional)
PEM encoded CA bundle used to validate webhook server certificate. Only used if the Server URL is using HTTPS protocol. This parameter is ignored for plain HTTP protocol connection. If not set the system root certificates are used to validate the TLS connection. |
caProvider
WebhookCAProvider
|
(Optional)
The provider for the CA bundle to use to validate webhook server certificate. |
WebhookResult
(Appears on: WebhookProvider)
Field | Description |
---|---|
jsonPath
string
|
(Optional)
Json path of return value |
WebhookSecret
(Appears on: WebhookProvider)
Field | Description |
---|---|
name
string
|
Name of this secret in templates |
secretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
Secret ref to fill in credentials |
YandexCertificateManagerAuth
(Appears on: YandexCertificateManagerProvider)
Field | Description |
---|---|
authorizedKeySecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
The authorized key used for authentication |
YandexCertificateManagerCAProvider
(Appears on: YandexCertificateManagerProvider)
Field | Description |
---|---|
certSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
YandexCertificateManagerProvider
(Appears on: SecretStoreProvider)
YandexCertificateManagerProvider Configures a store to sync secrets using the Yandex Certificate Manager provider.
Field | Description |
---|---|
apiEndpoint
string
|
(Optional)
Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’) |
auth
YandexCertificateManagerAuth
|
Auth defines the information necessary to authenticate against Yandex Certificate Manager |
caProvider
YandexCertificateManagerCAProvider
|
(Optional)
The provider for the CA bundle to use to validate Yandex.Cloud server certificate. |
YandexLockboxAuth
(Appears on: YandexLockboxProvider)
Field | Description |
---|---|
authorizedKeySecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
(Optional)
The authorized key used for authentication |
YandexLockboxCAProvider
(Appears on: YandexLockboxProvider)
Field | Description |
---|---|
certSecretRef
github.com/external-secrets/external-secrets/apis/meta/v1.SecretKeySelector
|
YandexLockboxProvider
(Appears on: SecretStoreProvider)
YandexLockboxProvider Configures a store to sync secrets using the Yandex Lockbox provider.
Field | Description |
---|---|
apiEndpoint
string
|
(Optional)
Yandex.Cloud API endpoint (e.g. ‘api.cloud.yandex.net:443’) |
auth
YandexLockboxAuth
|
Auth defines the information necessary to authenticate against Yandex Lockbox |
caProvider
YandexLockboxCAProvider
|
(Optional)
The provider for the CA bundle to use to validate Yandex.Cloud server certificate. |
Generated with gen-crd-api-reference-docs
.